Undocumented functions of NTDLL

2OO1, 5 March

typedef enum _SYSTEM_INFORMATION_CLASS {




    SystemBasicInformation,
    SystemProcessorInformation,
    SystemPerformanceInformation,
    SystemTimeOfDayInformation,
    SystemPathInformation,
    SystemProcessInformation,
    SystemCallCountInformation,
    SystemDeviceInformation,
    SystemProcessorPerformanceInformation,
    SystemFlagsInformation,
    SystemCallTimeInformation,
    SystemModuleInformation,
    SystemLocksInformation,
    SystemStackTraceInformation,
    SystemPagedPoolInformation,
    SystemNonPagedPoolInformation,
    SystemHandleInformation,
    SystemObjectInformation,
    SystemPageFileInformation,
    SystemVdmInstemulInformation,
    SystemVdmBopInformation,
    SystemFileCacheInformation,
    SystemPoolTagInformation,
    SystemInterruptInformation,
    SystemDpcBehaviorInformation,
    SystemFullMemoryInformation,
    SystemLoadGdiDriverInformation,
    SystemUnloadGdiDriverInformation,
    SystemTimeAdjustmentInformation,
    SystemSummaryMemoryInformation,
    SystemNextEventIdInformation,
    SystemEventIdsInformation,
    SystemCrashDumpInformation,
    SystemExceptionInformation,
    SystemCrashDumpStateInformation,
    SystemKernelDebuggerInformation,
    SystemContextSwitchInformation,
    SystemRegistryQuotaInformation,
    SystemExtendServiceTableInformation,
    SystemPrioritySeperation,
    SystemPlugPlayBusInformation,
    SystemDockInformation,
    SystemPowerInformation,
    SystemProcessorSpeedInformation,
    SystemCurrentTimeZoneInformation,
    SystemLookasideInformation


} SYSTEM_INFORMATION_CLASS, *PSYSTEM_INFORMATION_CLASS;

• SystemBasicInformation

• SystemProcessorInformation

• SystemPerformanceInformation 0x138 GET

• SystemTimeOfDayInformation 0x020 GET

• SystemPathInformation

System path is avaiable via structure KUSER_SHARED_DATA

• SystemProcessInformation

• SystemCallCountInformation

• SystemDeviceInformation 0x018 GET SystemConfigurationInformation

• SystemProcessorPerformanceInformation

• SystemFlagsInformation 0x004 GET SET

• SystemCallTimeInformation NOT_IMPLEMENTED

• SystemModuleInformation

• SystemLocksInformation 0x028+ GET

• SystemStackTraceInformation 0x05C GET

• SystemPagedPoolInformation 0x01C GET checked build only

• SystemNonPagedPoolInformation 0x01C GET checked build only

• SystemHandleInformation

• SystemObjectInformation

• SystemPageFileInformation

• SystemVdmInstemulInformation 0x088 GET

• SystemVdmBopInformation INVALID_INFO_CLASS

• SystemFileCacheInformation 0x00C, 0x024 GET SET

• SystemPoolTagInformation 0x020+ GET

• SystemInterruptInformation 0x018 GET

• SystemDpcBehaviorInformation 0x014 GET SET

• SystemFullMemoryInformation 0x014 GET checked build only

• SystemLoadGdiDriverInformation 0x018 SET

• SystemUnloadGdiDriverInformation 0x004 SET

• SystemTimeAdjustmentInformation

• SystemSummaryMemoryInformation 0x014 GET checked build only

• SystemNextEventIdInformation ???? (C0000005) GET checked build only

• SystemEventIdsInformation 0xB66 GET checked build only

• SystemCrashDumpInformation 0x004 GET

• SystemExceptionInformation 0x010 GET

• SystemCrashDumpStateInformation 0x004 GET

• SystemKernelDebuggerInformation 0x002 GET

• SystemContextSwitchInformation 0x030 GET

• SystemRegistryQuotaInformation

• SystemExtendServiceTableInformation

• SystemPrioritySeperation 0x004 SET

• SystemPlugPlayBusInformation NOT_IMPLEMENTED, GET

• SystemDockInformation NOT_IMPLEMENTED, GET

• SystemPowerInformation INVALID_INFO_CLASS

• SystemProcessorSpeedInformation INVALID_INFO_CLASS

• SystemCurrentTimeZoneInformation 0x0AC GET

• SystemLookasideInformation 0x000 GET
  
  
  

  Documented by:

  Tomasz Nowak

  
  
  
  

Library: ntdll.lib

NtQuerySystemInformation

NtSetSystemInformation