src/detection/swap/swap_windows.c


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

#include "swap.h"
#include "common/windows/unicode.h"

#include <winternl.h>
#include <ntstatus.h>
#include <windows.h>
#include <stdalign.h>

const char* ffDetectSwap(FFlist* result) {
    alignas(SYSTEM_PAGEFILE_INFORMATION) uint8_t buffer[4096];
    ULONG size = sizeof(buffer);
    SYSTEM_PAGEFILE_INFORMATION* pstart = (SYSTEM_PAGEFILE_INFORMATION*) buffer;
    if (!NT_SUCCESS(NtQuerySystemInformation(SystemPagefileInformation, pstart, size, &size))) {
        return "NtQuerySystemInformation(SystemPagefileInformation, size) failed";
    }

    if (size == 0) {
        return NULL;
    }

    uint32_t pageSize = instance.state.platform.sysinfo.pageSize;
    for (SYSTEM_PAGEFILE_INFORMATION* current = pstart;; current = (SYSTEM_PAGEFILE_INFORMATION*) ((uint8_t*) current + current->NextEntryOffset)) {
        FFSwapResult* swap = FF_LIST_ADD(FFSwapResult, *result);
        ffStrbufInitNWS(&swap->name, current->FileName.Length / sizeof(wchar_t), current->FileName.Buffer);
        if (ffStrbufStartsWithS(&swap->name, "\\??\\")) {
            ffStrbufSubstrAfter(&swap->name, strlen("\\??\\") - 1);
        }
        swap->bytesUsed = (uint64_t) current->TotalUsed * pageSize;
        swap->bytesTotal = (uint64_t) current->CurrentSize * pageSize;
        if (current->NextEntryOffset == 0) {
            break;
        }
    }
    return NULL;
}