Referenced by: TSysProcMonThread, GetRecord, GetRecordByPID, GetProcessList


TProcessRecord = record

  PID,

  SessionID :Cardinal;

  Handle: THandle;

  Name,

  ImageName,

  DomainName,

  UserName,

  CommandLine,

  Desktop,

  Environment,

  ParentImage,

  ParentCmd: string;

  Priority,

  BasePriority,

  ParentPID,

  HandleCount,

  GDIHandleCount,

  USERHandleCount,

  ThreadCount: Cardinal;

  Affinity: NativeUInt;

  VMCounters: TVMCounters;

  IOCounters: TIOCounters;

  KernelTime: UInt64;

  UserTime: UInt64;

  Privileges: TPrivilegeList;

  Groups: TTokenGroupList;

  &Platform: Cardinal;

  ProcessMachine: word;

  ProcessNativeMachine: word;

  CreationTime: TDateTime;

  VersionInfo: TVersionInfo;

  Performance: TProcessPerformanceRecord;

  IsSuspended: Boolean;

  System: Boolean;

  Elevated: Boolean;

  ElevationType: integer;

  DpiAwareness: TDpiAwareness;

  ProtectedType: TPsProtectedType;

  ProtectedSigner: TPsProtectedSigner;

  DEP: TProcessMitigationDEPPolicy;

  ASLR: TProcessMitigationASLRPolicy;

  CFGuard: TProcessMitigationControlFlowGuardPolicy;

  StackProtection: TProcessMitigationUserShadowStackPolicy;

  Cycles: UInt64;

  ChildCount: integer;

  ChildInstancesPrivateBytes: UInt64;

  WindowCount: integer;

  ThreadList: TList;

  ModuleList: TList;

  HandleList: TList;

  IsNew: Boolean;

  SHA1: string;

  _Exists: Boolean;

  _ImageIndex: integer;


  procedure Initialize;

  procedure Finalize(ACloseHandle: boolean = True);

  procedure ClearLists;

  procedure CopyFrom(const ARecord: TProcessRecord);


  function IndexOfThread(ATID: Cardinal): integer;


  function ProtectionStr: string;

  function ASLRStr: string;

  function DEPStr: string;

  function CFGuardStr: string;

  function StackProtectionStr: string;

  function ElevationStr: string;

end;

PProcessRecord = ^TProcessRecord;

Created with the Personal Edition of HelpNDoc: Full-featured Kindle eBooks generator