ANTICHAT — форум по информационной безопасности, OSINT и технологиям

.text:7C835241 ; BOOL __stdcall GetProcessTimes(HANDLE hProcess, LPFILETIME lpCreationTime, LPFILETIME lpExitTime, LPFILETIME lpKernelTime, LPFILETIME lpUserTime) .text:7C835241                 public GetProcessTimes .text:7C835241 GetProcessTimes proc near
.....

   mov     edi, edi
.text:7C835243                 push    ebp
.text:7C835244                 mov     ebp, esp
.text:7C835246                 sub     esp, 20h
.text:7C835249                 push    0
.text:7C83524B                 push    20h
.text:7C83524D                 lea     eax, [ebp+var_20]
.text:7C835250                 push    eax
.text:7C835251                 push    4
.text:7C835253                 push    [ebp+hProcess]
.text:7C835256                 call    ds:NtQueryInformationProcess

//---------

#include "stdio.h"
#include "windows.h"

//---------

typedef DWORD (__stdcall *LPFN_NtQuerySystemInformation)(DWORD, PVOID, DWORD, PDWORD);

#define SystemProcessorPerformanceInformation 0x8

//---------

#pragma pack(push,8)

typedef struct _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION {
    LARGE_INTEGER IdleTime;
    LARGE_INTEGER KernelTime;
    LARGE_INTEGER UserTime;
    LARGE_INTEGER DpcTime;
    LARGE_INTEGER InterruptTime;
    ULONG InterruptCount;
} SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION,
*PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION;

#pragma pack(pop)

//---------

int main(int argc, char* argv[]) {

	SYSTEM_INFO   systeminfo;
	unsigned long bytesreturned;

	SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION spi_old[32];
	memset(spi_old,0,sizeof(SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION)*32);

	SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION spi[32];
	memset(spi,0,sizeof(SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION)*32);

	LPFN_NtQuerySystemInformation ntquerysysteminformation =(LPFN_NtQuerySystemInformation) GetProcAddress(GetModuleHandle("ntdll.dll"), "NtQuerySystemInformation");

	if(!ntquerysysteminformation) {

	  printf("\n*** no ntquerysysteminformation api?.. bugger");
	  return -1;
	}

	GetSystemInfo(&systeminfo);

	printf("\n[i] Processor Count: %d\n",systeminfo.dwNumberOfProcessors);

	ntquerysysteminformation(SystemProcessorPerformanceInformation,spi_old, (sizeof(SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION)*systeminfo.dwNumberOfProcessors),&bytesreturned);

	Sleep(500);

	ntquerysysteminformation(SystemProcessorPerformanceInformation,spi, (sizeof(SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION)*systeminfo.dwNumberOfProcessors),&bytesreturned);

	for(int cpuloopcount = 0; cpuloopcount < systeminfo.dwNumberOfProcessors; cpuloopcount++) {

		BYTE cpuusage = (BYTE) (100 - (((spi[cpuloopcount].IdleTime.QuadPart - spi_old[cpuloopcount].IdleTime.QuadPart) * 100) /  \
		((spi[cpuloopcount].KernelTime.QuadPart +  spi[cpuloopcount].UserTime.QuadPart) - (spi_old[cpuloopcount].KernelTime.QuadPart + spi_old[cpuloopcount].UserTime.QuadPart))));

		printf("\n[i] CPU %02d: = %0d%%",cpuloopcount, cpuusage);

	}
  return 0;
}