How to get system RAM size from a driver?

NTDEV
1

What is the best way to get system RAM size from a driver without
querying the registry or asking an user-mode application?

MmQuerySystemSize() is not enough for me.

Can ZwQuerySystemInformation() provide the answer?
I don’t have docs for it.

Thanks,
Dmitriy Budko

2

Hi!
ZwQuerySystemInformation proto:

NTSYSAPI
NTSTATUS
NTAPI
ZwQuerySystemInformation(
IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
IN OUT PVOID SystemInformation,
IN ULONG SystemInformationLength,
OUT PULONG ReturnLength OPTIONAL
);

typedef enum _SYSTEM_INFORMATION_CLASS {
SystemBasicInformation = 0,
// there are a lot of values, see “Windows NT/2000 Native API Reference”
// by Gary Nebbet for details
}SYSTEM_INFORMATION_CLASS;

typedef struct _SYSTEM_BASIC_INFORMATION {
ULONG Unknown; // Unknown
ULONG MaximumIncrement; // Timer increment in 100 ns units
ULONG PhysicalPageSize; // Hope, you know
ULONG NumberOfPhysicalPages; // Total number of pages manged by ntoskrnl
ULONG LowestPhysicalPage; // Lowest physical page number (usually
2 on PC)
ULONG HighestPhysicalPage; // Highest physical page number (This is
exactly you need)
ULONG AllocationGranularity;
ULONG LowestUserAddress;
ULONG HighestUserAddress;
ULONG ActiveProcessors;
UCHAR NumberProcessors;
} SYSTEM_BASIC_INFORMATION, *PSYSTEM_BASIC_INFORMATION;

However NumberOfPhysicalPages field is the number of pages managed by NT OS
memory manager; so this value is lower than the ‘real’ number of MB.
Note, some amount of memory is reserved for BIOS/Option ROM shadowing, some
for ACPI tables and etc.

WBR
Igor