/* * Process Hacker Extra Plugins - * Pool Table Plugin * * Copyright (C) 2016 dmex * * This file is part of Process Hacker. * * Process Hacker is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * Process Hacker is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with Process Hacker. If not, see . */ #include "main.h" NTSTATUS EnumPoolTagTable( _Out_ PVOID* Buffer ) { NTSTATUS status; PVOID buffer; ULONG bufferSize; ULONG attempts; bufferSize = 0x100; buffer = PhAllocate(bufferSize); status = NtQuerySystemInformation( SystemPoolTagInformation, buffer, bufferSize, &bufferSize ); attempts = 0; while (status == STATUS_INFO_LENGTH_MISMATCH && attempts < 8) { PhFree(buffer); buffer = PhAllocate(bufferSize); status = NtQuerySystemInformation( SystemPoolTagInformation, buffer, bufferSize, &bufferSize ); attempts++; } if (NT_SUCCESS(status)) *Buffer = buffer; else PhFree(buffer); return status; } NTSTATUS EnumBigPoolTable( _Out_ PVOID* Buffer ) { NTSTATUS status; PVOID buffer; ULONG bufferSize; ULONG attempts; bufferSize = 0x100; buffer = PhAllocate(bufferSize); status = NtQuerySystemInformation( SystemBigPoolInformation, buffer, bufferSize, &bufferSize ); attempts = 0; while (status == STATUS_INFO_LENGTH_MISMATCH && attempts < 8) { PhFree(buffer); buffer = PhAllocate(bufferSize); status = NtQuerySystemInformation( SystemBigPoolInformation, buffer, bufferSize, &bufferSize ); attempts++; } if (NT_SUCCESS(status)) *Buffer = buffer; else PhFree(buffer); return status; }