A forum for reverse engineering, OS internals and malware analysis 

 #240  by __Genius__
 Tue Mar 16, 2010 9:42 am
Well, you may know What is NtQuerySystemInformation doing, it an undocumented function which can be used to collect information about running processes, it's threads and etc .
This Application is written in Delphi 7 which can be helpful, you can view source codes to see how you can use NtQuerySystemInformation from user-mode application to grabs information about your system .
personally I couldn't compile it with Delphi 2010, so if anyone can please put the information here .
Source code attached .
Also, related modules are included .

best regards,
__Genius__
Attachments
NtQuerySystemInformation
(177.54 KiB) Downloaded 100 times
 #242  by EP_X0FF
 Tue Mar 16, 2010 11:20 am
Hello,

this is sample application and library written by Igor Shevshenko.They demonstrates how to use ntdll Native API in typical Delphi projects.
This sample was written on Delphi <= 5 version. I was able to compile and successfully start with Delphi5 and after some quick additions compile and start with Delphi 2009.
Seems to be due to some changes in Windows.pas module Delphi 2009 compilation result differs from Delphi 5 (few information classes not listed by application as supported except SystemProcessesAndThreads). However this is just a question of debug.

If you have questions about Delphi or pascal syntax - feel free to ask.

I'm moving this topic to Newbie Questions section.

Regards.
 #243  by __Genius__
 Tue Mar 16, 2010 11:48 am
Thanks EP,
I found this application at a Russian website sometimes ago (if I can remember then I'll point to it)
yes, I have some problems with Delphi / pascal syntax and in a soon future I will ask them here, Previously I was working and writing my applications in C++ (ring 3 applications) but after a few advices from one of my friends I moved to delphi and I'm so satisfied. C++ in my opinion is not a suitable language for ring3 applications, personally i prefer delphi to C in this area, now I just use C language for driver development, Delphi is quite robust with simplicity . I advice anyone who love programming try to learn delphi , at least you never be uncomfortable with this migration, I'm using Delphi 7.0 and latest 2010 .

[ .. ] EP, why you are working with the 5.0 version?
 #244  by EP_X0FF
 Tue Mar 16, 2010 1:38 pm
Hi,
EP, why you are working with the 5.0 version?
I simple don't need more. I don't need new syntax, new functions, new databases support, new components.
I'm using Delphi mostly in cases when it is necessarily to quickly build something with GUI and in projects where our internals rtl is needed.
Unfortunately main restriction here is 32 bit only support. For everything else I'm using C (Visual Studio along with Borland C compiler).

However it is quite off-topic, so I'm quit.

Regards.
 #868  by Vrtule
 Fri Apr 23, 2010 11:49 pm
Yes, it is good that one can use native APIs in Delphi without too much effort. I also prefer Delphi language when coding something bigger. It is simple to create GUI with it. And the rest is solved by Windows API :-).