{"componentChunkName":"component---src-templates-post-template-js","path":"/rust-winapi-use-ntapi-en","result":{"data":{"markdownRemark":{"id":"496425f6-ea73-58ef-a7a5-d4e802eed5e5","html":"
\n

This page has been machine-translated from the original page.

\n
\n

Continuing on from the previous articles, this time I tried creating a program that uses the windows crate in Rust to load a DLL with APIs such as GetModuleHandleW, and then uses NTAPI such as NtQuerySystemInformation, which is not included in the official windows crate.

\n

Reference: NtQuerySystemInformation function (winternl.h) - Win32 apps | Microsoft Learn

\n\n

Table of Contents

\n\n

The Code I Wrote

\n

The code I wrote this time is shown below.

\n

When you run this code, it uses the NtQuerySystemInformation API to enumerate information such as the processes and handles running in the system.

\n

\n \n \n \n \n \n \n \n \n

\n
// cargo run --bin CallNtApi\n\nuse windows::{\n    // core::{ HSTRING, PCSTR },\n    core:: { s, w },\n    Wdk::System::SystemServices::VM_COUNTERS,\n    Win32::{Foundation::CloseHandle, System::{\n        LibraryLoader::{ GetModuleHandleW, GetProcAddress },\n        Threading::IO_COUNTERS\n    }}\n};\n\nuse std::{\n    // ffi::CString,\n    io::stdin,\n    mem::transmute,\n    os::raw::{ c_void, c_ulong, c_ushort },\n    ptr::null_mut,\n    slice::from_raw_parts\n};\n\ntype HANDLE = *mut c_void;\ntype ULONG = c_ulong;\ntype USHORT = c_ushort;\ntype WCHAR = u16;\n\n#[repr(C)]\nstruct UNICODE_STRING {\n    Length: USHORT,\n    MaximumLength: USHORT,\n    Buffer: *const WCHAR,\n}\n\n#[repr(C)]\nstruct SYSTEM_PROCESS_INFORMATION {\n    NextEntryOffset: ULONG,\n    NumberOfThreads: ULONG,\n    Reserved: [u8; 48],\n    ImageName: UNICODE_STRING,\n    BasePriority: ULONG,\n    UniqueProcessId: HANDLE,\n    InheritedFromUniqueProcessId: HANDLE,\n    HandleCount: ULONG,\n    Reserved2: ULONG,\n    PrivatePageCount: ULONG,\n    VirtualMemoryCounters: VM_COUNTERS,\n    IoCounters: IO_COUNTERS\n    // 省略 Threads: SYSTEM_THREAD\n}\n\ntype NtQuerySystemInformationFn = unsafe extern \"system\" fn(\n    SystemInformationClass: ULONG,\n    SystemInformation: *mut c_void,\n    SystemInformationLength: ULONG,\n    ReturnLength: *mut ULONG,\n) -> i32;\n\n\nfn get_input(input_string: &str) {\n    println!(\"{}\", input_string);\n    let mut input = String::new();\n    stdin().read_line(&mut input).expect(\"Failed to read input.\");\n    return;\n}\n\n\nfn main() {\n    unsafe {\n\n        // Load ntdll\n        // let ntdll = &HSTRING::from(\"ntdll.dll\");\n        let ntdll = w!(\"ntdll.dll\");\n        let h_ntdll_module = GetModuleHandleW(ntdll).unwrap();\n        if h_ntdll_module.is_invalid() {\n            eprintln!(\"Failed to get handle to ntdll.dll\");\n            return;\n        } else {\n            println!(\"Created h_ntdll: {:?}\", h_ntdll_module);\n        }\n\n        // Get proc address\n        // let s_func_name = CString::new(\"NtQuerySystemInformation\").unwrap();\n        let s_func_name = s!(\"NtQuerySystemInformation\");\n        let func_addr = GetProcAddress(h_ntdll_module, s_func_name);\n        if func_addr.is_none() {\n            eprintln!(\"Failed to get proc address.\");\n            return;\n        } else {\n            println!(\"Get proc address: {:?}\", func_addr);\n        }\n        let nt_query_system_information: NtQuerySystemInformationFn = transmute(func_addr);\n\n        // First call func\n        let system_process_information = 5; // SystemProcessInformation\n        let mut u_return_length: ULONG = 0;\n        let status = nt_query_system_information(\n            system_process_information,\n            null_mut(),\n            0,\n            &mut u_return_length,\n        );\n        // println!(\"First NtQuerySystemInformation call status: {:#x}\", status);\n        assert!(status as u32 == 0xc0000004);\n        println!(\"NtQuerySystemInformation return length: {:?}\", u_return_length);\n\n        // Second call func\n        let buffer = vec![0u8; u_return_length as usize];\n        let status = nt_query_system_information(\n            system_process_information,\n            buffer.as_ptr() as *mut c_void,\n            u_return_length,\n            &mut u_return_length,\n        );\n        if status != 0 {\n            eprintln!(\"NtQuerySystemInformation failed: {:?}\", status);\n            return;\n        }\n\n        // Analyze buffer\n        let mut offset = 0;\n        while offset < u_return_length {\n            let spi = &*(buffer.as_ptr().add(offset as usize) as *const SYSTEM_PROCESS_INFORMATION);\n\n            let name = if !spi.ImageName.Buffer.is_null() && spi.ImageName.Length > 0 {\n                let slice = from_raw_parts(spi.ImageName.Buffer, (spi.ImageName.Length / 2) as usize);\n                String::from_utf16_lossy(slice)\n            } else {\n                String::from(\"System Idle Process\")\n            };\n\n            println!(\n                \"Name: {},\\tPID: {:?},\\tPPID: {:?},\\tThreads: {:?},\\tHandles: {:?}\",\n                name,\n                spi.UniqueProcessId,\n                spi.InheritedFromUniqueProcessId,\n                spi.NumberOfThreads,\n                spi.HandleCount\n            );\n\n            if spi.NextEntryOffset == 0 {\n                break;\n            }\n\n            offset += spi.NextEntryOffset;\n\n        }\n\n    }\n\n    get_input(\"Finish program.\");\n    return;\n}
\n

Modules Used

\n

This time I load the following modules.

\n

The commented-out modules were ones I had been using to prepare Param<PCWSTR> and Param<PCSTR> values for Windows API arguments, but I stopped using them because it is more convenient to use handy macros such as s! and w! from windows::core.

\n

Reference: w in windows_sys::core - Rust

\n

Reference: s in windows_sys::core - Rust

\n
use windows::{\n    // core::{ HSTRING, PCSTR },\n    core:: { s, w },\n    Wdk::System::SystemServices::VM_COUNTERS,\n    Win32::{Foundation::CloseHandle, System::{\n        LibraryLoader::{ GetModuleHandleW, GetProcAddress },\n        Threading::IO_COUNTERS\n    }}\n};\n\nuse std::{\n    // ffi::CString,\n    io::stdin,\n    mem::transmute,\n    os::raw::{ c_void, c_ulong, c_ushort },\n    ptr::null_mut,\n    slice::from_raw_parts\n};
\n

Using GetModuleHandleW

\n

First, I use the GetModuleHandleW API to obtain the module handle of ntdll.dll, which exports NtQuerySystemInformation.

\n

GetModuleHandleW is an API that can obtain the module handle of a module loaded in the caller process.

\n

Reference: GetModuleHandleW function (libloaderapi.h) - Win32 apps | Microsoft Learn

\n

Because GetModuleHandleW requires Param<PCWSTR> as an argument, I use w!(\"ntdll.dll\") to convert the string literal.

\n

Reference: GetModuleHandleW in windows::Win32::System::LibraryLoader - Rust

\n

Reference: HMODULE in windows::Win32::Foundation - Rust

\n
// Load ntdll\n// let ntdll = &HSTRING::from(\"ntdll.dll\");\nlet ntdll = w!(\"ntdll.dll\");\nlet h_ntdll_module = GetModuleHandleW(ntdll).unwrap();\nif h_ntdll_module.is_invalid() {\n    eprintln!(\"Failed to get handle to ntdll.dll\");\n    return;\n} else {\n    println!(\"Created h_ntdll: {:?}\", h_ntdll_module);\n}
\n

Also, the windows crate’s GetModuleHandleW returns Result<HMODULE>, so I use unwrap to extract the HMODULE.

\n

Getting the Address of NtQuerySystemInformation

\n

Next, using the module handle I obtained, I call GetProcAddress to retrieve the function address of NtQuerySystemInformation.

\n

Reference: GetProcAddress function (libloaderapi.h) - Win32 apps | Microsoft Learn

\n

This one requires Param<PCSTR> rather than Param<PCWSTR>, so I pass a string literal converted with s!(\"NtQuerySystemInformation\").

\n

Reference: GetProcAddress in windows::Win32::System::LibraryLoader - Rust

\n
// Get proc address\n// let s_func_name = CString::new(\"NtQuerySystemInformation\").unwrap();\nlet s_func_name = s!(\"NtQuerySystemInformation\");\nlet func_addr = GetProcAddress(h_ntdll_module, s_func_name);\nif func_addr.is_none() {\n    eprintln!(\"Failed to get proc address.\");\n    return;\n} else {\n    println!(\"Get proc address: {:?}\", func_addr);\n}\nlet nt_query_system_information: NtQuerySystemInformationFn = transmute(func_addr);
\n

Using the NtQuerySystemInformation Function

\n

Next, I use the function address I obtained to enumerate process information via NtQuerySystemInformation.

\n
// First call func\nlet system_process_information = 5; // SystemProcessInformation\nlet mut u_return_length: ULONG = 0;\nlet status = nt_query_system_information(\n    system_process_information,\n    null_mut(),\n    0,\n    &mut u_return_length,\n);\n// println!(\"First NtQuerySystemInformation call status: {:#x}\", status);\nassert!(status as u32 == 0xc0000004);\nprintln!(\"NtQuerySystemInformation return length: {:?}\", u_return_length);\n\n// Second call func\nlet buffer = vec![0u8; u_return_length as usize];\nlet status = nt_query_system_information(\n    system_process_information,\n    buffer.as_ptr() as *mut c_void,\n    u_return_length,\n    &mut u_return_length,\n);\nif status != 0 {\n    eprintln!(\"NtQuerySystemInformation failed: {:?}\", status);\n    return;\n}
\n

Checking the Array Size to Retrieve

\n

Because the goal this time is to enumerate processes, I call the NtQuerySystemInformation function with the SystemProcessInformation flag as its argument.

\n

Reference: SystemProcessInformation

\n

At that point, the size of the returned array of SYSTEM_PROCESS_INFORMATION structures is unknown, so I first call NtQuerySystemInformation once to obtain the size.

\n

This call fails with error 0xc0000004 because inappropriate values are set for the second and third arguments, but u_return_length is populated with the size of the returned structure array.

\n
// First call func\nlet system_process_information = 5; // SystemProcessInformation\nlet mut u_return_length: ULONG = 0;\nlet status = nt_query_system_information(\n    system_process_information,\n    null_mut(),\n    0,\n    &mut u_return_length,\n);\n// println!(\"First NtQuerySystemInformation call status: {:#x}\", status);\nassert!(status as u32 == 0xc0000004);\nprintln!(\"NtQuerySystemInformation return length: {:?}\", u_return_length);
\n

Retrieving an Array of Structures Containing Process Information

\n

Once I can obtain the size of the structure array returned by the first function call, I next call the NtQuerySystemInformation function again, using that size as the third argument, SystemInformationLength.

\n

The returned structure array is stored in a vector of size u_return_length allocated with the vec! macro.

\n
// Second call func\nlet buffer = vec![0u8; u_return_length as usize];\nlet status = nt_query_system_information(\n    system_process_information,\n    buffer.as_ptr() as *mut c_void,\n    u_return_length,\n    &mut u_return_length,\n);\nif status != 0 {\n    eprintln!(\"NtQuerySystemInformation failed: {:?}\", status);\n    return;\n}
\n

With this, I was able to obtain the SYSTEM_PROCESS_INFORMATION structure array containing process information.

\n

Parsing the Structures

\n

Finally, I parse the information for each process from the array of SYSTEM_PROCESS_INFORMATION structures I retrieved.

\n

Handling C-defined structures like SYSTEM_PROCESS_INFORMATION from Rust was a little tedious, but it worked once I defined the structure information myself based on how it is implemented in the C header files.

\n
type HANDLE = *mut c_void;\ntype ULONG = c_ulong;\ntype USHORT = c_ushort;\ntype WCHAR = u16;\n\n#[repr(C)]\nstruct UNICODE_STRING {\n    Length: USHORT,\n    MaximumLength: USHORT,\n    Buffer: *const WCHAR,\n}\n\n#[repr(C)]\nstruct SYSTEM_PROCESS_INFORMATION {\n    NextEntryOffset: ULONG,\n    NumberOfThreads: ULONG,\n    Reserved: [u8; 48],\n    ImageName: UNICODE_STRING,\n    BasePriority: ULONG,\n    UniqueProcessId: HANDLE,\n    InheritedFromUniqueProcessId: HANDLE,\n    HandleCount: ULONG,\n    Reserved2: ULONG,\n    PrivatePageCount: ULONG,\n    VirtualMemoryCounters: VM_COUNTERS,\n    IoCounters: IO_COUNTERS\n    // 省略 Threads: SYSTEM_THREAD\n}
\n

I use Rust’s #[repr(C)] to define the structure information.

\n

This notation instructs Rust to use the C data layout, making it possible to define a structure with the same memory layout as a C structure rather than allowing Rust to optimize the layout freely.

\n

Reference: Rust Struct Memory Layout - ryochack.blog

\n

Reference: Other reprs - The Rustonomicon

\n

This time I defined two structures: UNICODE_STRING and SYSTEM_PROCESS_INFORMATION.

\n

However, I omitted the SYSTEM_THREAD structure this time because I could not find its definition and did not particularly need it.

\n

Reference: NTAPI Undocumented Functions

\n

Reference: UNICODESTRING (ntdef.h) - Win32 apps | Microsoft Learn

\n

Once the structure definitions were ready, I finally parsed the array of SYSTEM_PROCESS_INFORMATION structures obtained with the NtQuerySystemInformation function.

\n

Conveniently, the SYSTEM_PROCESS_INFORMATION structure has a member called NextEntryOffset that contains the offset to the next array element, so I access the next element by adding that value inside the loop.

\n
// Analyze buffer\nlet mut offset = 0;\nwhile offset < u_return_length {\n    let spi = &*(buffer.as_ptr().add(offset as usize) as *const SYSTEM_PROCESS_INFORMATION);\n\n    let name = if !spi.ImageName.Buffer.is_null() && spi.ImageName.Length > 0 {\n        let slice = from_raw_parts(spi.ImageName.Buffer, (spi.ImageName.Length / 2) as usize);\n        String::from_utf16_lossy(slice)\n    } else {\n        String::from(\"System Idle Process\")\n    };\n\n    println!(\n        \"Name: {},\\tPID: {:?},\\tPPID: {:?},\\tThreads: {:?},\\tHandles: {:?}\",\n        name,\n        spi.UniqueProcessId,\n        spi.InheritedFromUniqueProcessId,\n        spi.NumberOfThreads,\n        spi.HandleCount\n    );\n\n    if spi.NextEntryOffset == 0 {\n        break;\n    }\n\n    offset += spi.NextEntryOffset;\n\n}
\n

Also, in &*(buffer.as_ptr().add(offset as usize) as *const SYSTEM_PROCESS_INFORMATION);, I declare a variable that interprets the address obtained by adding the offset from the array pointer to the target structure as a SYSTEM_PROCESS_INFORMATION structure.

\n

Furthermore, to extract the process name from ImageName stored in the UNICODE_STRING structure, I create a slice of UTF-16 code units with from_raw_parts and decode it with from_utf16_lossy.

\n
let name = if !spi.ImageName.Buffer.is_null() && spi.ImageName.Length > 0 {\n    let slice = from_raw_parts(spi.ImageName.Buffer, (spi.ImageName.Length / 2) as usize);\n    String::from_utf16_lossy(slice)\n} else {\n    String::from(\"System Idle Process\")\n};
\n

Reference: fromrawparts in std::slice - Rust

\n

Reference: String in std::string - Rust

\n

With this, I was able to obtain various kinds of process information, including process names.

\n

Summary

\n

Now I can use NTAPI from Rust as well.

\n

However, I am still not entirely sure whether there is any benefit to going out of my way to use it from Rust.

","fields":{"slug":"/rust-winapi-use-ntapi-en","tagSlugs":["/tag/rust/","/tag/windows/","/tag/rust-win-api/","/tag/english/"]},"frontmatter":{"date":"2025-04-13","description":"How to use NTAPI in Rust","tags":["Rust","Windows","Rust-WinAPI","English"],"title":"Using NTAPI in Rust","socialImage":{"publicURL":"/static/f6fe03f6828d1dd556ac8be98361963e/rust-winapi-use-ntapi.png"}}}},"pageContext":{"slug":"/rust-winapi-use-ntapi-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}