ASM Community

77E7A7DF > 64:A1 18000000   MOV EAX,DWORD PTR FS:[18]

77E7A7E5   8B40 24          MOV EAX,DWORD PTR DS:[EAX+24]

77E7A7E8   C3               RETN

// ProcessInformationClasses for NtQueryInformationProcess

#Define ProcessBasicInformation 000000000h

#Define ProcessQuotaLimits 000000001h

#Define ProcessIoCounters 000000002h

#Define ProcessVmCounters 000000003h

#Define ProcessTimes 000000004h

#Define ProcessBasePriority 000000005h

#Define ProcessRaisePriority 000000006h

#Define ProcessDebugPort 000000007h

#Define ProcessExceptionPort 000000008h

#Define ProcessAccessToken 000000009h

#Define ProcessLdtInformation 00000000Ah

#Define ProcessLdtSize 00000000Bh

#Define ProcessDefaultHardErrorMode 00000000Ch

#Define ProcessIoPortHandlers 00000000Dh ; Kernel mode only

#Define ProcessPooledUsageAndLimits 00000000Eh

#Define ProcessWorkingSetWatch 00000000Fh

#Define ProcessUserModeIOPL 000000010h

#Define ProcessEnableAlignmentFaultFixup 000000011h

#Define ProcessPriorityClass 000000012h

#Define ProcessWx86Information 000000013h

#Define ProcessHandleCount 000000014h

#Define ProcessAffinityMask 000000015h

#Define ProcessPriorityBoost 000000016h

#Define ProcessDeviceMap 000000017h

#Define ProcessSessionInformation 000000018h

#Define ProcessForegroundInformation 000000019h

#Define ProcessWow64Information 00000001Ah

#Define MaxProcessInfoClass 00000001Bh



/*

Structures for NtQueryInformationProcess

All structures must be aligned at 16 byte

boundaries or the call will fail

*/



PROCESS_BASIC_INFORMATION STRUCT

	//  NtQueryInformationProcess using ProcessBasicInfo

	ExitStatus			DD

	PebBaseAddress			DD

	AffinityMask			DD

	BasePriority			DD

	UniqueProcessId			DD

	InheritedFromUniqueProcessId	DD

ENDS



PROCESS_SESSION_INFORMATION STRUCT

	//  NtQueryInformationProcess using ProcessSessionInformation

	SessionId		DD

ENDS



QUOTA_LIMITS STRUCT

	//  NtQueryInformationProcess using ProcessQuotaLimits

	//  NtQueryInformationProcess using ProcessPooledQuotaLimits

	//  NtSetInformationProcess using ProcessQuotaLimits

	PagedPoolLimit		DD ; SIZE_T ?

	NonPagedPoolLimit	DD ; SIZE_T ?

	MinimumWorkingSetSize	DD ; SIZE_T ?

	MaximumWorkingSetSize	DD ; SIZE_T ?

	PagefileLimit		DD ; SIZE_T ?

	TimeLimit		DQ ; SIZE_T ?

ENDS



IO_COUNTERS STRUCT

	//  NtQueryInformationProcess using ProcessIoCounters

	ReadOperationCount	DD 2 DUP (?) ; ULONGLONG ?

	WriteOperationCount	DD 2 DUP (?) ; ULONGLONG ?

	OtherOperationCount	DD 2 DUP (?) ; ULONGLONG ?

	ReadTransferCount	DD 2 DUP (?) ; ULONGLONG ?

	WriteTransferCount	DD 2 DUP (?) ; ULONGLONG ?

	OtherTransferCount	DD 2 DUP (?) ; ULONGLONG ?

ENDS



VM_COUNTERS STRUCT

	//  NtQueryInformationProcess using ProcessVmCounters

	PeakVirtualSize			DD ; SIZE_T ?

	VirtualSize			DD ; SIZE_T ?

	PageFaultCount			DD

	PeakWorkingSetSize		DD ; SIZE_T ?

	WorkingSetSize			DD ; SIZE_T ?

	QuotaPeakPagedPoolUsage		DD ; SIZE_T ?

	QuotaPagedPoolUsage		DD ; SIZE_T ?

	QuotaPeakNonPagedPoolUsage	DD ; SIZE_T ?

	QuotaNonPagedPoolUsage		DD ; SIZE_T ?

	PagefileUsage			DD ; SIZE_T ?

	PeakPagefileUsage		DD ; SIZE_T ?

ENDS



POOLED_USAGE_AND_LIMITS STRUCT

	//  NtSetInformationProcess using ProcessAccessToken

	//  PROCESS_SET_ACCESS_TOKEN access to the process is needed

	PeakPagedPoolUsage		DD ; SIZE_T ?

	PagedPoolUsage			DD ; SIZE_T ?

	PagedPoolLimit			DD ; SIZE_T ?

	PeakNonPagedPoolUsage		DD ; SIZE_T ?

	NonPagedPoolUsage		DD ; SIZE_T ?

	NonPagedPoolLimit		DD ; SIZE_T ?

	PeakPagefileUsage		DD ; SIZE_T ?

	PagefileUsage			DD ; SIZE_T ?

	PagefileLimit			DD ; SIZE_T ?

ENDS



PROCESS_ACCESS_TOKEN STRUCT

	//  NtSetInformationProcess using ProcessAccessToken

	//  PROCESS_SET_ACCESS_TOKEN access to the process is needed

	Token	DD

	Thread	DD

ENDS



KERNEL_USER_TIMES STRUCT

	//  NtQueryInformationProcess using ProcessTimes

	//  NtQueryInformationThread using ThreadTimes

	//	Note all times are zulu

	CreateTime	DQ

	ExitTime	DQ

	KernelTime	DQ

	UserTime	DQ

ENDS



TIME_FIELDS STRUCT

	// Use with RtlTimeToTimeFields

	// RtlTimeToTimeFields,offset DQTIME,offset TIME_FIELDS

	// Needed to convert KERNEL_USER_TIMES fields

	Year		DW ; range [1601...]

	Month		DW ; range [1..12]

	Day		DW ; range [1..31]

	Hour		DW ; range [0..23]

	Minute		DW ; range [0..59]

	Second		DW ; range [0..59]

	Milliseconds	DW ; range [0..999]

	Weekday		DW ; range [0..6] == [Sunday..Saturday]

ENDS

DATA SECTION

retlen DD ?



ALIGN 16

kut KERNEL_USER_TIMES <?>

	

ALIGN 16

tflds TIME_FIELDS <?>



CODE SECTION

invoke NTDLL:NtQueryInformationProcess, [hProcess], ProcessTimes, offset kut,

		sizeof KERNEL_USER_TIMES, offset retlen

invoke NTDLL:RtlTimeToTimeFields, offset kut.CreateTime, offset tflds

	CURRENT_PROCESS_9X EQU <7FFFFFFFh>

	CURRENT_PROCESS_NT EQU <-1>

	mov eax, dword ptr fs:[30h]

	mov eax, dword ptr [eax + 10h]

	mov eax, dword ptr [eax + 74h]

	mov eax, dword ptr fs:[30h]

	mov eax, dword ptr [eax + 10h]

	mov eax, dword ptr [eax + 44h]