How to find the memory used by a process from kernel mode in Windows

Question

I am trying to get the memory used by a process in kernel mode of Windows.

I tried using the GetProcessMemoryInfo API through PSAPI.h . but this is a USER mode function, and it's not giving me data.

Is there any other way to get the memory details?

Answer 1

you need use ProcessVmCounters and ProcessIoCounters with ZwQueryInformationProcess or NtQueryInformationProcess dependent on previous mode

ULONG rcb;
union {
    VM_COUNTERS vmc;
    VM_COUNTERS_EX vmcex;
};
IO_COUNTERS ioc;
ZwQueryInformationProcess(NtCurrentProcess(), ProcessVmCounters, &vmc, sizeof(vmc), &rcb);
ZwQueryInformationProcess(NtCurrentProcess(), ProcessVmCounters, &vmcex, sizeof(vmcex), &rcb);
ZwQueryInformationProcess(NtCurrentProcess(), ProcessIoCounters, &ioc, sizeof(ioc), &rcb);