调用NTQuerySystemInforamtion函数失败？ (100分)

资料介绍通信NTQuerySystemInforamtion可以得到线程的状态？可调用那函数总是出错<br>const<br>&nbsp; SystemBasicInformation = 0;<br>&nbsp; SystemPerformanceInformation = 2;<br>&nbsp; PROCESS_INFORMATION = 5; &nbsp; //ProcessesInfo<br>&nbsp; DRIVER_INFORMATION= 11;<br>type<br>&nbsp; TPDword=PWORD;<br>&nbsp; SYSTEM_THREADS=^TthreadInfo;<br>&nbsp; TthreadInfo=Packed Record<br>&nbsp; &nbsp; DwUnKnown1 &nbsp; &nbsp;: DWORD;<br>&nbsp; &nbsp; dwStartAddress: DWORD;<br>&nbsp; &nbsp; dwOwningPID &nbsp; : DWORD;<br>&nbsp; &nbsp; dwThreadID &nbsp; &nbsp;: DWORD;<br>&nbsp; &nbsp; dwCurrentPriority: DWORD;<br>&nbsp; &nbsp; dwBasepriority: DWORD;<br>&nbsp; &nbsp; dwContextSwitches: DWORD;<br>&nbsp; &nbsp; dwThreadState : DWORD;<br>&nbsp; &nbsp; dwWaitReason &nbsp;: DWORD;<br>&nbsp; &nbsp; dwUnknown2 &nbsp; &nbsp;: DWORD;<br>&nbsp; end;<br><br>&nbsp; TVM_COUNTERS=^_VM_COUNTERS;<br>&nbsp; _VM_COUNTERS=record<br>&nbsp; &nbsp; PeakVirtualSize &nbsp; :ULONG; &nbsp; &nbsp;//虚拟存储峰值大小；<br>&nbsp; &nbsp; VirtualSize &nbsp; &nbsp; &nbsp; :ULONG; &nbsp; &nbsp;//虚拟存储大小；<br>&nbsp; &nbsp; PagedFaultCount &nbsp; :ULONG;<br>&nbsp; &nbsp; PeakWorkingSetSize:ULONG;<br>&nbsp; &nbsp; WorkingSetSize &nbsp; &nbsp;:ULONG;<br>&nbsp; &nbsp; QuotaPeakPagedPoolUsage:ULONG;<br>&nbsp; &nbsp; QuotaPagedPoolUsage:ULONG;<br>&nbsp; &nbsp; QuotaPeakNonPagedPoolUsage:ULONG;<br>&nbsp; &nbsp; QuotaNonPagedPoolUsage:ULONG;<br>&nbsp; &nbsp; PagefileUsage &nbsp; &nbsp; :ULONG;<br>&nbsp; &nbsp; PeakPagefileUsage :ULONG;<br>&nbsp; end;<br><br>&nbsp; TIO_COUNTERS=^_IO_COUNTERS;<br>&nbsp; _IO_COUNTERS=record<br>&nbsp; &nbsp; ReadOperationCount: LARGE_INTEGER; &nbsp; &nbsp; //I/O读操作数目;INTEGER<br>&nbsp; &nbsp; WriteOperationCount: LARGE_INTEGER; &nbsp; &nbsp;//I/O写操作数目;<br>&nbsp; &nbsp; OtherOperationCount: LARGE_INTEGER; &nbsp; &nbsp;//I/O其他操作数目;<br>&nbsp; &nbsp; ReadTransferCount: LARGE_INTEGER; &nbsp; &nbsp;//I/O读数据数目;<br>&nbsp; &nbsp; WriteTransferCount: LARGE_INTEGER; &nbsp; &nbsp; //I/O写数据数目;<br>&nbsp; &nbsp; OtherTransferCount: LARGE_INTEGER; &nbsp; &nbsp; //I/O其他操作数据数目;<br>&nbsp; end;<br><br>&nbsp; PSYSTEM_PROCESSES=^TSYSTEM_PROCESSES;<br>&nbsp; TSYSTEM_PROCESSES=packed record<br>&nbsp; &nbsp; NextEntryDelta: ULONG; &nbsp; &nbsp; &nbsp;//构成结构序列的偏移量;<br>&nbsp; &nbsp; ThreadCount: ULONG; &nbsp; &nbsp; &nbsp; //线程数目;<br>&nbsp; &nbsp; Reserved1: array [0..6] of ULONG; &nbsp; &nbsp; //<br>&nbsp; &nbsp; CreateTime: LARGE_INTEGER; &nbsp; &nbsp; &nbsp; &nbsp;//创建时间;<br>&nbsp; &nbsp; UserTime: LARGE_INTEGER; &nbsp; &nbsp; &nbsp; &nbsp;//用户模式(Ring 3)的CPU时间;<br>&nbsp; &nbsp; KernelTime: LARGE_INTEGER; &nbsp; &nbsp; &nbsp; &nbsp;//内核模式(Ring 0)的CPU时间;<br>&nbsp; &nbsp; ProcessName: STRING; &nbsp; &nbsp; &nbsp; //进程名称;UNICODE_<br>&nbsp; &nbsp; BasePriority: ULONG; &nbsp; &nbsp; &nbsp;//进程优先权;<br>&nbsp; &nbsp; ProcessId: ULONG; &nbsp; &nbsp; &nbsp; &nbsp; //进程标识符;<br>&nbsp; &nbsp; InheritedFromProcessId: ULONG; &nbsp;//父进程的标识符;<br>&nbsp; &nbsp; HandleCount:ULONG; &nbsp; &nbsp; &nbsp; //句柄数目;<br>&nbsp; &nbsp; Reserved2:array [0..2]of ULONG; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;//[0..2]<br>&nbsp; &nbsp; VmCounters: TVM_COUNTERS; &nbsp; &nbsp; &nbsp; &nbsp;//虚拟存储器的结构，见下;<br>&nbsp; &nbsp; IoCounters: TIO_COUNTERS; &nbsp; &nbsp; &nbsp; &nbsp;//IO计数结构，见下;<br>&nbsp; &nbsp; Threads: array [0..1]of TthreadInfo; &nbsp; &nbsp; &nbsp; &nbsp;//进程相关线程的结构数组，见下;<br>&nbsp;end;<br>function NtQuerySystemInformation<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;infoClass: DWORD;<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;buffer: Pointer;<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;bufSize: DWORD;<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;returnSize: TPDword<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ): DWORD;stdcall ;external 'ntdll.dll' name 'NtQuerySystemInformation';<br><br>procedure TForm1.btnSysInfoClick(Sender: TObject);<br>var<br>&nbsp; SysProcessInfo: PTSYSTEM_PROCESSES;<br>&nbsp; status: Longint; {long}<br>&nbsp; temp, Index, numBytes, numEntries: DWORD;<br>&nbsp; buf: TPDword;<br>begin<br>&nbsp; NtQuerySystemInformation(PROCESS_INFORMATION,<br>&nbsp; &nbsp; @temp, 0, @numBytes);<br><br>&nbsp; buf := AllocMem(numBytes * 2);<br><br>&nbsp; status := NtQuerySystemInformation(PROCESS_INFORMATION,<br>&nbsp; &nbsp; Buf, numBytes *2 , @numBytes);<br>&nbsp; if status &lt;&gt; 0 then<br>&nbsp; begin<br>&nbsp; &nbsp; ShowOsError(Status);<br>&nbsp; end;<br>end;<br>

http://www.delphibbs.com/delphibbs/dispq.asp?lid=1360311<br>检测某个程序占用的内存<br>这似乎有一个调用的例子，你看看？？

谢谢 app2001:<br>&nbsp; &nbsp;小弟惨愧，看过之后，也没调试成功。不管怎么试，执行NtQuerySystemInformation都没有返回过零。