From a971f6d933669e25fff67d72603580a472f95148 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9D=8E=E9=80=9A=E6=B4=B2?= <zhangsongcui3371@sina.com>
Date: Sat, 5 Aug 2023 11:40:23 +0800
Subject: [PATCH] Revert "Memory / Swap (Windows): simplify implementation"

Doesn't work at all

This reverts commit 0c2edd4064685b4ff6b42884dd92a6f5f96c4a1e.
---
 src/detection/memory/memory_windows.c | 17 +++++++----------
 src/detection/swap/swap_windows.c     | 22 +++++++++++++++++-----
 2 files changed, 24 insertions(+), 15 deletions(-)

diff --git a/src/detection/memory/memory_windows.c b/src/detection/memory/memory_windows.c
index b50e068c6..666d79727 100644
--- a/src/detection/memory/memory_windows.c
+++ b/src/detection/memory/memory_windows.c
@@ -1,19 +1,16 @@
 #include "memory.h"
 
-#include <winternl.h>
-#include <ntstatus.h>
 #include <windows.h>
 
 const char* ffDetectMemory(FFMemoryResult* ram)
 {
-    SYSTEM_INFO sysInfo;
-    GetNativeSystemInfo(&sysInfo);
-
-    SYSTEM_PERFORMANCE_INFORMATION info;
-    if (!NT_SUCCESS(NtQuerySystemInformation(SystemPerformanceInformation, &info, sizeof(info), NULL)))
-        return "NtQuerySystemInformation(SystemPerformanceInformation) failed";
-    ram->bytesUsed = (uint64_t)(info.TotalCommitLimit - info.AvailablePages) * sysInfo.dwPageSize;
-    ram->bytesTotal = (uint64_t)info.TotalCommitLimit * sysInfo.dwPageSize;
+    MEMORYSTATUSEX statex = {
+        .dwLength = sizeof(statex),
+    };
+    if (!GlobalMemoryStatusEx(&statex))
+        return "GlobalMemoryStatusEx() failed";
 
+    ram->bytesTotal = statex.ullTotalPhys;
+    ram->bytesUsed = statex.ullTotalPhys - statex.ullAvailPhys;
     return NULL;
 }
diff --git a/src/detection/swap/swap_windows.c b/src/detection/swap/swap_windows.c
index 0855f76e4..f541f1964 100644
--- a/src/detection/swap/swap_windows.c
+++ b/src/detection/swap/swap_windows.c
@@ -1,4 +1,5 @@
 #include "swap.h"
+#include "util/mallocHelper.h"
 
 #include <winternl.h>
 #include <ntstatus.h>
@@ -9,11 +10,22 @@ const char* ffDetectSwap(FFSwapResult* swap)
     SYSTEM_INFO sysInfo;
     GetNativeSystemInfo(&sysInfo);
 
-    SYSTEM_PAGEFILE_INFORMATION info;
-    if (!NT_SUCCESS(NtQuerySystemInformation(SystemPagefileInformation, &info, sizeof(info), NULL)))
-        return "NtQuerySystemInformation(SystemPagefileInformation) failed";
-    swap->bytesUsed = (uint64_t)info.TotalUsed * sysInfo.dwPageSize;
-    swap->bytesTotal = (uint64_t)info.CurrentSize * sysInfo.dwPageSize;
+    ULONG size = sizeof(SYSTEM_PAGEFILE_INFORMATION);
+    SYSTEM_PAGEFILE_INFORMATION* FF_AUTO_FREE pstart = (SYSTEM_PAGEFILE_INFORMATION*)malloc(size);
+    while(true)
+    {
+        NTSTATUS status = NtQuerySystemInformation(SystemPagefileInformation, pstart, size, &size);
+        if(status == STATUS_INFO_LENGTH_MISMATCH)
+        {
+            if(!(pstart = (SYSTEM_PAGEFILE_INFORMATION*)realloc(pstart, size)))
+                return "realloc(pstart, size) failed";
+        }
+        else if(!NT_SUCCESS(status))
+            return "NtQuerySystemInformation(SystemPagefileInformation, size) failed";
+        break;
+    }
+    swap->bytesUsed = (uint64_t)pstart->TotalUsed * sysInfo.dwPageSize;
+    swap->bytesTotal = (uint64_t)pstart->CurrentSize * sysInfo.dwPageSize;
 
     return NULL;
 }