From 76424950e373d3b04ac3dd13019151bfba3e8423 Mon Sep 17 00:00:00 2001 From: sumuel Date: Mon, 17 Aug 2026 20:44:55 +0000 Subject: Add the files --- src/detection/swap/swap_windows.c | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) create mode 100644 src/detection/swap/swap_windows.c (limited to 'src/detection/swap/swap_windows.c') diff --git a/src/detection/swap/swap_windows.c b/src/detection/swap/swap_windows.c new file mode 100644 index 0000000..e96298b --- /dev/null +++ b/src/detection/swap/swap_windows.c @@ -0,0 +1,35 @@ +#include "swap.h" +#include "common/windows/unicode.h" + +#include +#include +#include +#include + +const char* ffDetectSwap(FFlist* result) { + alignas(SYSTEM_PAGEFILE_INFORMATION) uint8_t buffer[4096]; + ULONG size = sizeof(buffer); + SYSTEM_PAGEFILE_INFORMATION* pstart = (SYSTEM_PAGEFILE_INFORMATION*) buffer; + if (!NT_SUCCESS(NtQuerySystemInformation(SystemPagefileInformation, pstart, size, &size))) { + return "NtQuerySystemInformation(SystemPagefileInformation, size) failed"; + } + + if (size == 0) { + return NULL; + } + + uint32_t pageSize = instance.state.platform.sysinfo.pageSize; + for (SYSTEM_PAGEFILE_INFORMATION* current = pstart;; current = (SYSTEM_PAGEFILE_INFORMATION*) ((uint8_t*) current + current->NextEntryOffset)) { + FFSwapResult* swap = FF_LIST_ADD(FFSwapResult, *result); + ffStrbufInitNWS(&swap->name, current->FileName.Length / sizeof(wchar_t), current->FileName.Buffer); + if (ffStrbufStartsWithS(&swap->name, "\\??\\")) { + ffStrbufSubstrAfter(&swap->name, strlen("\\??\\") - 1); + } + swap->bytesUsed = (uint64_t) current->TotalUsed * pageSize; + swap->bytesTotal = (uint64_t) current->CurrentSize * pageSize; + if (current->NextEntryOffset == 0) { + break; + } + } + return NULL; +} -- cgit v1.2.3