SYSTEM_PERFORMANCE_INFORMATION

The SYSTEM_PERFORMANCE_INFORMATION structure is what a successful call to ZwQuerySystemInformation or NtQuerySystemInformation produces in its output buffer when given the information class SystemPerformanceInformation (0x02).

Documentation Status

The SYSTEM_PERFORMANCE_INFORMATION structure is defined in WINTERNL.H from the Software Development Kit (SDK). The definition there has the whole structure as one array of 0x0138 bytes, named Reserved1. Documentation of NtQuerySystemInformation describes the structure as “opaque” and suggests that whatever is produced in it for the SystemPerformanceInformation case “can be used to generate an unpredictable seed for a random number generator.”

Microsoft does publish the practical equivalent of a C-language definition as type information in public symbol files, though not for the kernel, where the structure is prepared, nor even for low-level user-mode DLLs that interpret the structure, but for various higher-level user-mode DLLs such as URLMON.DLL and only then starting with version 6.2.

Two earlier disclosures of type information are known, though not in symbol files but in statically linked libraries: GDISRVL.LIB from the Device Driver Kit (DDK) for Windows NT 3.51; and SHELL32.LIB from the DDK for Windows NT 4.0.

Layout

The SYSTEM_PERFORMANCE_INFORMATION is the same in both 32-bit and 64-bit Windows. The structure exists in three sizes:

• 0x0138 bytes in versions 3.10 to 6.0;
• 0x0148 bytes in version 6.1;
• 0x0158 bytes in version 6.2 and higher.

Except for some reuse of members in the ealiest versions, the structure has changed only by extension. Early forms of the structure are supported in later versions simply by allowing callers to ask just for an old size.

LARGE_INTEGER IdleProcessTime;

LARGE_INTEGER IoReadTransferCount;

LARGE_INTEGER IoWriteTransferCount;

LARGE_INTEGER IoOtherTransferCount;

ULONG IoReadOperationCount;

ULONG IoWriteOperationCount;

ULONG IoOtherOperationCount;

ULONG AvailablePages;

ULONG CommittedPages;

ULONG CommitLimit;

ULONG PeakCommitment;

ULONG PageFaultCount;

ULONG CopyOnWriteCount;

ULONG TransitionCount;

ULONG CacheTransitionCount;

ULONG DemandZeroCount;

ULONG PageReadCount;

ULONG PageReadIoCount;

ULONG CacheReadCount;

ULONG CacheIoCount;

ULONG DirtyPagesWriteCount;

ULONG DirtyWriteIoCount;

ULONG MappedPagesWriteCount;

ULONG MappedWriteIoCount;

ULONG PagedPoolPages;

ULONG NonPagedPoolPages;

ULONG PagedPoolAllocs;

ULONG PagedPoolFrees;

ULONG NonPagedPoolAllocs;

ULONG NonPagedPoolFrees;

ULONG FreeSystemPtes;

ULONG ResidentSystemCodePage;

ULONG TotalSystemDriverPages;

ULONG TotalSystemCodePages;

ULONG Spare0Count;

ULONG NonPagedPoolLookasideHits;

ULONG Spare1Count;

ULONG PagedPoolLookasideHits;

ULONG Spare3Count;

ULONG AvailablePagedPoolPages;

ULONG ResidentSystemCachePage;

ULONG ResidentPagedPoolPage;

ULONG ResidentSystemDriverPage;

ULONG CcFastReadNoWait;

ULONG CcFastReadWait;

ULONG CcFastReadResourceMiss;

ULONG CcFastReadNotPossible;

ULONG CcFastMdlReadNoWait;

ULONG CcFastMdlReadWait;

ULONG CcFastMdlReadResourceMiss;

ULONG CcFastMdlReadNotPossible;

ULONG CcMapDataNoWait;

ULONG CcMapDataWait;

ULONG CcMapDataNoWaitMiss;

ULONG CcMapDataWaitMiss;

ULONG CcPinMappedDataCount;

ULONG CcPinReadNoWait;

ULONG CcPinReadWait;

ULONG CcPinReadNoWaitMiss;

ULONG CcPinReadWaitMiss;

ULONG CcCopyReadNoWait;

ULONG CcCopyReadWait;

ULONG CcCopyReadNoWaitMiss;

ULONG CcCopyReadWaitMiss;

ULONG CcMdlReadNoWait;

ULONG CcMdlReadWait;

ULONG CcMdlReadNoWaitMiss;

ULONG CcMdlReadWaitMiss;

ULONG CcReadAheadIos;

ULONG CcLazyWriteIos;

ULONG CcLazyWritePages;

ULONG CcDataFlushes;

ULONG CcDataPages;

ULONG ContextSwitches;

ULONG FirstLevelTbFills;

ULONG SecondLevelTbFills;

ULONG SystemCalls;

ULONGLONG CcTotalDirtyPages;

ULONGLONG CcDirtyPageThreshold;

LONGLONG ResidentAvailablePages;

ULONGLONG SharedCommittedPages;

No use is known in version 3.10 of the three members at offsets 0x8C to 0x94. In contrast, at offsets 0x98 to 0xAC version 3.10 keeps four counters that the earliest known type information, for version 3.51, explicitly labels spare and two more that are used differently as early as version 3.50. Microsoft’s names may never be known. What the early versions count at offsets 0x98 to 0xA4 are waits for which the given reason is respectively WrLpcReceive, WrLpcReply, WrQueue or WrSpare0 (which was in those days defined as WrEventPair). Offsets 0xA8 and 0xAC in version 3.50 count times that the high and low events in an event pair get set.

It is not known how the sequence from Spare0Count to Spare3Count ever had a Spare2Count.