Also see my answer in http://www.experts-exchang
which lists all processes and then all threads and allows you to suspend a thread, but should gve you the info you need
regards
Main Topics
Browse All TopicsI would like to use this function to get a list of running processes and threads. It is for rootkit detection.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Also see my answer in http://www.experts-exchang
which lists all processes and then all threads and allows you to suspend a thread, but should gve you the info you need
regards
Business Accounts
Answer for Membership
by: pcsentinelPosted on 2006-08-18 at 23:21:41ID: 17346967
Here is a few things
***UNIT CODE********************** *******
t : dword;
: TObject); n(5,buf,$1 0000,@rl); p]); ring(pszPr ocessName) (dwThreadC ount)); (dwThreadC ount)); ationTime, SystemTime); teTime('dd /mm/yy hh:mm:ss',SystemTimeToDate Time(Syste mTime))); (dwBasePri ority)); (dwProcess ID)); (dwParentP rocessID)) ; (dwHandleC ount)); (dwVirtual BytesPeak) ); (dwVirtual Bytes)); (dwPageFau lts)); (dwWorking SetPeak)); (dwWorking Set)); (dwPagedPo ol)); (dwNonPage dPool)); (dwPageFil eBytes)); (dwPageFil eBytesPeak )); (dwPrivate Bytes));
List of processes and other info
********************FORM CODE********************
object Form1: TForm1
Left = 216
Top = 203
Width = 696
Height = 480
Caption = 'Form1'
Color = clBtnFace
Font.Charset = DEFAULT_CHARSET
Font.Color = clWindowText
Font.Height = -11
Font.Name = 'MS Sans Serif'
Font.Style = []
OldCreateOrder = False
PixelsPerInch = 96
TextHeight = 13
object lvMsg: TListView
Left = 16
Top = 80
Width = 648
Height = 349
BorderStyle = bsNone
Columns = <
item
Caption = 'Name'
Width = 200
end
item
Caption = 'Threads'
end
item
Caption = 'Creation'
end
item
Caption = 'Base Priority'
end
item
Caption = 'Process ID'
end
item
Caption = 'Parent ID'
end
item
Caption = 'Handles'
end
item
Caption = 'VM Peak Bytes'
end
item
Caption = 'VM Bytes'
end
item
Caption = 'Page Faults'
end
item
Caption = 'Mem Peak'
end
item
Caption = 'Mem'
end
item
Caption = 'Paged'
end
item
Caption = 'Non Paged'
end
item
Caption = 'Page Bytes'
end
item
Caption = 'Peak Page Bytes'
end
item
Caption = 'Private Bytes'
end>
ColumnClick = False
Constraints.MinHeight = 100
GridLines = True
HideSelection = False
ReadOnly = True
RowSelect = True
TabOrder = 0
ViewStyle = vsReport
end
object Button1: TButton
Left = 40
Top = 28
Width = 75
Height = 25
Caption = 'Button1'
TabOrder = 1
OnClick = Button1Click
end
end
**************************
unit Unit1;
interface
uses
Windows, Messages, SysUtils, Classes, Graphics, Controls, Forms, Dialogs,
ComCtrls, StdCtrls;
type
PBA = ^TBA;
TBA = array[0..1000000] of byte;
PThreadInfo = ^TThreadInfo;
TThreadInfo = record
ftCreationTime : TFileTime;
dwUnknown1 : dword;
dwStartAddress : dword;
dwOwningPID : dword;
dwThreadID : dword;
dwCurrentPriority : dword;
dwBasePriority : dword;
dwContextSwitches : dword;
dwThreadState : dword;
dwUnknown2 : dword;
dwUnknown3 : dword;
dwUnknown4 : dword;
dwUnknown5 : dword;
dwUnknown6 : dword;
dwUnknown : dword;
end;
PProcessInfo = ^TProcessInfo;
TProcessInfo=record
dwOffset : dword; // an ofset to the next Process structure
dwThreadCount : dword;
dwUnkown1 : array[0..5] of dword;
ftCreationTime : TFileTime;
dwUnkown2 : dword;
dwUnkown3 : dword;
dwUnkown4 : dword;
dwUnkown5 : dword;
dwUnkown6 : dword;
pszProcessName : PWideChar;
dwBasePriority : dword;
dwProcessID : dword;
dwParentProcessID : dword;
dwHandleCount : dword;
dwUnkown7 : dword;
dwUnkown8 : dword;
dwVirtualBytesPeak : dword;
dwVirtualBytes : dword;
dwPageFaults : dword;
dwWorkingSetPeak : dword;
dwWorkingSet : dword;
dwUnkown9 : dword;
dwPagedPool : dword; // kbytes
dwUnkown10 : dword;
dwNonPagedPool : dword; // kbytes
dwPageFileBytes : dword;
dwPageFileBytesPeak : dword;
dwPrivateBytes : dword;
dwUnkown11 : dword;
dwUnkown12 : dword;
dwUnkown13 : dword;
dwUnkown14 : dword;
ThreadInfo : PThreadInfo; // Thread list
end;
TForm1 = class(TForm)
lvMsg: TListView;
Button1: TButton;
procedure Button1Click(Sender: TObject);
private
public
{ Public declarations }
end;
var
Form1: TForm1;
implementation
function NtQuerySystemInformation(d
buf : pointer;
bufsize : dword;
retlen : pointer) : dword; stdcall;external 'ntdll.dll';
{$R *.DFM}
procedure TForm1.Button1Click(Sender
var
i,rl,cp : dword;
pinfo : PProcessInfo;
buf : PBA;
Item: TListItem;
ModifiedTime: TFileTime;
SystemTime: TSystemTime;
begin
GetMem(buf,$10000);
rl:=0;
i:=NtQuerySystemInformatio
lvMsg.Items.Clear;
if i=0 then begin
cp:=0;
repeat
pinfo:=PProcessInfo(@buf[c
cp:=cp+pinfo.dwOffset;
begin
with pinfo^ do begin
Item:=lvMsg.Items.Add;
if pszProcessName<>nil then
Item.Caption:=WideCharToSt
else
Item.Caption:='System Idle';
Item.SubItems.Add(IntToStr
Item.SubItems.Add(IntToStr
FileTimeToSystemTime(ftCre
Item.SubItems.Add(FormatDa
Item.SubItems.Add(IntToStr
Item.SubItems.Add(IntToStr
Item.SubItems.Add(IntToStr
Item.SubItems.Add(IntToStr
Item.SubItems.Add(IntToStr
Item.SubItems.Add(IntToStr
Item.SubItems.Add(IntToStr
Item.SubItems.Add(IntToStr
Item.SubItems.Add(IntToStr
Item.SubItems.Add(IntToStr
Item.SubItems.Add(IntToStr
Item.SubItems.Add(IntToStr
Item.SubItems.Add(IntToStr
Item.SubItems.Add(IntToStr
end;
end;
until pinfo.dwOffset=0;
end;
FreeMem(buf);
end;
end.