NtQuerySystemInformation

CreateToolhelp32Snapshot

NtQuerySystemInformation

var
 SystemInformation, SystemInformationIterator: PSYSTEM_PROCESS_INFORMATION;
 ReturnLength: DWORD;
 ModuleName: String;
begin
 ReturnLength := 0;
 if NtQuerySystemInformation(
   SystemProcessesAndThreadsInformation,
   nil, 0, ReturnLength) <> STATUS_INFO_LENGTH_MISMATCH then Exit;
 if ReturnLength > 0 then
 begin
   GetMem(SystemInformation, ReturnLength);
   try
     if NtQuerySystemInformation(SystemProcessesAndThreadsInformation,
       SystemInformation, ReturnLength, ReturnLength) = 0 then

     begin
       SystemInformationIterator := SystemInformation;
       repeat
         if SystemInformationIterator^.ModuleName = nil then
           ModuleName := 'System Idle Process'
         else
           ModuleName := SystemInformationIterator^.ModuleName;
         Form1.ListBox1.Items.Add(ModuleName);
         SystemInformationIterator :=
           Pointer(DWORD(SystemInformationIterator) +
           SystemInformationIterator^.NextOffset);
       until SystemInformationIterator^.NextOffset = 0;
     end;
   finally
     FreeMem(SystemInformation);
   end;
 end else
   ShowMessage('NO');

Return Value:

   Returns one of the following status codes:

       STATUS_SUCCESS - normal, successful completion.

       STATUS_INVALID_INFO_CLASS - The SystemInformationClass parameter
           did not specify a valid value.

       STATUS_INFO_LENGTH_MISMATCH - The value of the SystemInformationLength
           parameter did not match the length required for the information
           class requested by the SystemInformationClass parameter.

       STATUS_ACCESS_VIOLATION - Either the SystemInformation buffer pointer
           or the ReturnLength pointer value specified an invalid address.

       STATUS_WORKING_SET_QUOTA - The process does not have sufficient
           working set to lock the specified output structure in memory.

       STATUS_INSUFFICIENT_RESOURCES - Insufficient system resources exist
           for this request to complete.

nErrCode = NtQuerySystemInformation
 (
  SystemProcessesAndThreadsInformation,
  pInfoBuffer,
  nSize,
  NULL
 );

 /* double the buffer size */
 nSize += nSize;
}
/* repeat until the buffer is big enough */
while(nErrCode == STATUS_INFO_LENGTH_MISMATCH);

/* failure */
if(!NT_SUCCESS(nErrCode))
{
 DPRINT(FAILED_WITH_STATUS, "NtQuerySystemInformation", nErrCode);
 return nErrCode;  
}