0

I would like to query the private working set size of a given process only using WinAPI - no WMI. I can already query the memory information using GetProcessMemoryInfo(), but this only contains the working set size, not the private working set size.

I've found several approaches but all of them involve WMI, which I would like to avoid using. Also found comments suggesting that you can query memory information using VirtualQuery and calculate the value yourself, but non of them describe how, and documentation on this is just awful.

Krisztián Szabó
  • 554
  • 3
  • 12
  • Maybe `QueryWorkingSet`? – user7860670 Feb 27 '19 at 10:34
  • Already looked into that, but documentation on that is just as bad. It's absolutely unclear to me how I can calculate the private working set size based on the returned [working set blocks](https://learn.microsoft.com/en-us/windows/desktop/api/psapi/ns-psapi-_psapi_working_set_ex_block). – Krisztián Szabó Feb 27 '19 at 10:38
  • https://stackoverflow.com/a/42986966/6401656 – RbMm Feb 27 '19 at 10:42
  • But is it possible to call `ZwQueryInformationProcess` outside of a kernel driver/library? Because if not then this is not a solution to me. I was going to mention no NT calls, but I'm not sure if there's a way to get around that. – Krisztián Szabó Feb 27 '19 at 11:28
  • If you want to rule out all viable solutions, then you can just give up – David Heffernan Feb 27 '19 at 12:03
  • `ZwQueryInformationProcess` this is **user mode** api exported from *ntdll.dll*. call it like any usual api – RbMm Feb 27 '19 at 13:05

0 Answers0