user57 Posted yesterday at 07:09 PM Posted yesterday at 07:09 PM i looked at it in doxygen QueryWorkingSet and Ex are doing partly the same thing they call up NtQueryVirtualMemory where then both access the either "MemoryWorkingSetList" or "MemoryWorkingSetListEx" as parameter // typedef enum _MEMORY_INFORMATION_CLASS { MemoryBasicInformation, MemoryWorkingSetList, // <-- this MemorySectionName, MemoryBasicVlmInformation, MemoryWorkingSetExList // <-- and this } MEMORY_INFORMATION_CLASS; however on msdn they might look different: (QueryWorkingSet) typedef struct _PSAPI_WORKING_SET_INFORMATION { ULONG_PTR NumberOfEntries; PSAPI_WORKING_SET_BLOCK WorkingSetInfo[1]; } PSAPI_WORKING_SET_INFORMATION, *PPSAPI_WORKING_SET_INFORMATION; (QueryWorkingSetEx) typedef struct _PSAPI_WORKING_SET_EX_INFORMATION { PVOID VirtualAddress; PSAPI_WORKING_SET_EX_BLOCK VirtualAttributes; } PSAPI_WORKING_SET_EX_INFORMATION, *PPSAPI_WORKING_SET_EX_INFORMATION; the parameter sizes are the same, so a linking to that function works, just maybe not fully functional that we should keep an eye on if it behave different if they behave different you have have to write a code that redirects to QueryWorkingSetEx to -> NtQueryVirtualMemory with that MemoryWorkingSetExList xp might got this function parameter
nicolaasjan Posted 7 hours ago Posted 7 hours ago Here is another test version, using the PR fork with EJS support (also works on Vista). Instead of Deno, Windows 7 (and Vista) users can install QuickJS. 2
TSNH Posted 1 hour ago Posted 1 hour ago 6 hours ago, nicolaasjan said: Here is another test version, using the PR fork with EJS support (also works on Vista). Just tested on Vista seems to work well 1
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now