Programatic access to kernel variables

NTDEV
1

Is it possible to query kernel variables
such as ‘MmSizeOfNonPagedPoolInBytes’
from either user or kernel level? Obviously task
manager has the ability to do so. I need to
do this within the context of an application
so just dumping the variable out in the debugger isn’t
an option.

Failing that, is there a way to query the
perfmon memory object programatically (ie,
without bringing up the GUI) to get the
pertinent fields?

2

Use GetPerformanceInfo.

Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting

----- Original Message -----
From: “Peter Lawthers”
To: “Windows System Software Developers Interest List”
Sent: Tuesday, August 12, 2003 12:23 PM
Subject: [ntdev] Programatic access to kernel variables

> Is it possible to query kernel variables
> such as ‘MmSizeOfNonPagedPoolInBytes’
> from either user or kernel level? Obviously task
> manager has the ability to do so. I need to
> do this within the context of an application
> so just dumping the variable out in the debugger isn’t
> an option.
>
> Failing that, is there a way to query the
> perfmon memory object programatically (ie,
> without bringing up the GUI) to get the
> pertinent fields?
>
>
>
>
> —
> Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@acm.org
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

3

All perfmon objects are exposed as some registry branch, which is emulated by
the registry server (WINLOGON in NT4) and ADVAPI32, and is not accessible via
ZwOpenKey and such.

The old way of accessing them is documented here in July MSDN Library:

ms-help://MS.MSDNQTR.2003JUL.1033/perfmon/base/retrieving_counter_names_and_exp
lanations.htm

The more modern way is PdhXxx routines, which are documented nearby.

WMI is also suitable.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

4

That will give me the current np pool size,
but is there any way to get the max (ie,
MmMaximumNonPagedPoolInBytes) ? I can’t
seem to find that one exposed in any perfmon
counter.

Thanks!

Don Burn wrote:

Use GetPerformanceInfo.

Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting

----- Original Message -----
From: “Peter Lawthers”
> To: “Windows System Software Developers Interest List”
> Sent: Tuesday, August 12, 2003 12:23 PM
> Subject: [ntdev] Programatic access to kernel variables
>
>
>
>>Is it possible to query kernel variables
>>such as ‘MmSizeOfNonPagedPoolInBytes’
>>from either user or kernel level? Obviously task
>>manager has the ability to do so. I need to
>>do this within the context of an application
>>so just dumping the variable out in the debugger isn’t
>>an option.
>>
>>Failing that, is there a way to query the
>>perfmon memory object programatically (ie,
>>without bringing up the GUI) to get the
>>pertinent fields?
>>
>>
>>
>>
>>—
>>Questions? First check the Kernel Driver FAQ at
>
> http://www.osronline.com/article.cfm?id=256
>
>>You are currently subscribed to ntdev as: xxxxx@acm.org
>>To unsubscribe send a blank email to xxxxx@lists.osr.com
>>
>
>
>
>
> —
> Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@adic.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>