Improve PhGetProcessWorkingSetInformation
@@ -1617,9 +1617,43 @@ NTSTATUS PhGetProcessWorkingSetInformation(
)
{
NTSTATUS status;
- PVOID buffer;
+ PMEMORY_WORKING_SET_INFORMATION buffer;
SIZE_T bufferSize;
+ ULONG attempts = 0;
+
+ bufferSize = 0x8000;
+ buffer = PhAllocate(bufferSize);
+
+ status = NtQueryVirtualMemory(
+ ProcessHandle,
+ NULL,
+ MemoryWorkingSetInformation,
+ buffer,
+ bufferSize,
+ NULL
+ );
+
+ while (status == STATUS_INFO_LENGTH_MISMATCH && attempts < 8)
+ {
+ bufferSize = UFIELD_OFFSET(MEMORY_WORKING_SET_INFORMATION, WorkingSetInfo[buffer->NumberOfEntries]);
+ PhFree(buffer);
+ buffer = PhAllocate(bufferSize);
+ status = NtQueryVirtualMemory(
+ ProcessHandle,
+ NULL,
+ MemoryWorkingSetInformation,
+ buffer,
+ bufferSize,
+ NULL
+ );
+
+ attempts++;
+ }
+
+ if (!NT_SUCCESS(status))
+ {
+ // Fall back to using the previous code that we've used since Windows 7 (dmex)
bufferSize = 0x8000;
buffer = PhAllocate(bufferSize);
@@ -1641,6 +1675,7 @@ NTSTATUS PhGetProcessWorkingSetInformation(
buffer = PhAllocate(bufferSize);
}
+ }
if (!NT_SUCCESS(status))
{
