Re: Getting Peak Commit from NtQuerySystemInformation

"Mike Driscoll" <[email protected]> wrote in message 
news:[email protected]...
> Hi,
>
> I was tasked with finding a way to query our workstations for their Peak
> Commit Charge. According to the sysinternals forum:
>
> "The only way I'm aware of that one can get this detail is from the
> uMmPeakCommitLimit member of the SYSTEM_PERFORMANCE_INFORMATION
> structure one passes to NtQuerySystemInformation when calling it with
> the SystemPerformanceInformation type." (see
> http://forum.sysinternals.com/forum_posts.asp?TID=15540&PID=75852)
>
> I started with this question on the PyWin32 mailing list, but it turns
> out that they don't expose the functionality inside
> NtQuerySystemInformation so that's why I came here. Unfortunately, I'm a
> complete newb when it comes to ctypes. While I did find that this worked
> "ctypes.windll.ntdll.NtQuerySystemInformation", I don't know how to go
> on and actually query the object. Can someone give me a clue?
>
> I'm running Python 2.5 on Windows XP. Thanks!
>
> - Mike

REALLY quick and dirty...

Notes:

   2 is the enumeration value of SystemPerformanceInformation out of 
winternl.h.

   SYSTEM_PERFORMANCE_INFOMRATION is an opaque structure of 312 bytes.
   Some DDK header probably has the details...I didn't look.

   NTSTATUS WINAPI NtQuerySystemInformation(
     __in          SYSTEM_INFORMATION_CLASS SystemInformationClass,
     __in_out      PVOID SystemInformation,
     __in          ULONG SystemInformationLength,
     __out_opt     PULONG ReturnLength
   );

C:\>python
Python 2.6.4 (r264:75708, Oct 26 2009, 08:23:19) [MSC v.1500 32 bit (Intel)] 
on win32
Type "help", "copyright", "credits" or "license" for more information.
>>> import ctypes
>>> nt=ctypes.windll.ntdll.NtQuerySystemInformation
>>> b=ctypes.create_string_buffer(312) # create a writable buffer
>>> u=ctypes.c_ulong(0) # create a writable ulong.
>>> nt(2,b,312,ctypes.byref(u))
0
>>> b.raw
'\xe8A\xd2\x00\xc4\x02\x00\x00)Q\xe03\x1c\x00\x00\x00\t"\xafM\x03\x00\x00\x00nqy\xb1\x00\x00\x00\x00\xdc\xba\x95\x01\xec
\\\xc6\x00\xfc\x17\xd7\x04\xb7\xdd\x08\x00ew\x03\x00pc\x11\x00C\xfa\x04\x00\xc1\xa4\'\x0b3:\n\x00\x9b2"\x04\x00\x00\x00\
x00\xbcE\x97\x05\x14\xb9G\x005#\x10\x00\x00\x00\x00\x00\x00\x00\x00\x002\xf3\x0b\x004\xbf\x00\x00\xd1\x18\x02\x002B\x00\
x00ZH\x00\x00j"\x00\x00\x18iE\x04\xd6!C\x04\x96\n\xfb\x02\xd2\x88\xf8\x02\xde\xa1\x01\x004\x02\x00\x00\x19\x0b\x00\x00\x
eb\x00\x00\x001\xb1\xfb#\xd0\xd9\x10\x14\xa6\x1b\x01\x00\xf9\x94\x00\x00\xb3G\x00\x00\xd8\x00\x00\x00\x00\x00\x00\x00\xe
b\x08\xc9\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0
0\x00\x84\x1c\x9e\x01\x00\x00\x00\x00sx\x02\x00\xcb\xa34\x00\x06\x00\x00\x00\xafb\x14\x00K\n\x00\x00M+\x00\x00\xc0Q\x00\
x00\x0c\x01\xf0\x00\x81\x07\x00\x00\xbb\xbc\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0\
x1c"\x00\xf2\x8d\x07\x00h\xb3*\x00(n\x14\x00W\x08]\x00\x96\xb7pD\x00\x00\x00\x00\x00\x00\x00\x00\x1d\xc6i\xbe'

The "struct" module can help decode this if you find the structure 
definition.  ctypes can also be used to declare the structure correctly and 
pass it directly as a parameter, but if you only need, say, a DWORD at 
offset 0x40 in this structure then you can do:

>>> import struct
>>> struct.unpack('L',b.raw[0x40:0x40+4])
(670259,)

Hope this helps...I'm off to bed.
-Mark



------------------------------------------------------------------------------
Download Intel&#174; Parallel Studio Eval
Try the new software tools for yourself. Speed compiling, find bugs
proactively, and fine-tune applications for parallel performance.
See why Intel Parallel Studio got high marks during beta.
http://p.sf.net/sfu/intel-sw-dev