Add PhGetProcessAppMemoryInformation
@@ -670,6 +670,33 @@ PhSetProcessBreakOnTermination(
);
}
+FORCEINLINE
+NTSTATUS
+PhGetProcessAppMemoryInformation(
+ _In_ HANDLE ProcessHandle,
+ _Out_ PPROCESS_JOB_MEMORY_INFO JobMemoryInfo
+ )
+{
+ NTSTATUS status;
+ PROCESS_JOB_MEMORY_INFO jobMemoryInfo;
+
+ // Win32 called this ProcessAppMemoryInfo with APP_MEMORY_INFORMATION struct (dmex)
+ status = NtQueryInformationProcess(
+ ProcessHandle,
+ ProcessJobMemoryInformation,
+ &jobMemoryInfo,
+ sizeof(PROCESS_JOB_MEMORY_INFO),
+ NULL
+ );
+
+ if (NT_SUCCESS(status))
+ {
+ *JobMemoryInfo = jobMemoryInfo;
+ }
+
+ return status;
+}
+
/**
* Gets basic information for a thread.
*
