From c613e558fdc95ede72abb78ab116e421bbce5e14 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9D=8E=E9=80=9A=E6=B4=B2?= <zhangsongcui3371@sina.com>
Date: Tue, 18 Nov 2025 15:36:49 +0800
Subject: [PATCH] Swap (Windows): adds `K32GetPerformanceInfo` fallback

---
 src/detection/swap/swap_windows.c | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/src/detection/swap/swap_windows.c b/src/detection/swap/swap_windows.c
index ad4965836..1bbb8098c 100644
--- a/src/detection/swap/swap_windows.c
+++ b/src/detection/swap/swap_windows.c
@@ -5,8 +5,9 @@
 #include <winternl.h>
 #include <ntstatus.h>
 #include <windows.h>
+#include <psapi.h>
 
-const char* ffDetectSwap(FFlist* result)
+const char* detectByNqsi(FFlist* result)
 {
     uint8_t buffer[4096];
     ULONG size = sizeof(buffer);
@@ -26,6 +27,27 @@ const char* ffDetectSwap(FFlist* result)
         if (current->NextEntryOffset == 0)
             break;
     }
+    return NULL;
+}
+
+const char* detectByKgpi(FFlist* result)
+{
+    PERFORMANCE_INFORMATION pi = {};
+    if (!K32GetPerformanceInfo(&pi, sizeof(pi)))
+        return "K32GetPerformanceInfo(&pi, sizeof(pi)) failed";
+    FFSwapResult* swap = ffListAdd(result);
+    ffStrbufInitS(&swap->name, "Page File");
+    swap->bytesTotal = (uint64_t) (pi.CommitLimit > pi.PhysicalTotal ? pi.CommitLimit - pi.PhysicalTotal : 0) * pi.PageSize;
+    swap->bytesUsed = (uint64_t) (pi.CommitTotal > pi.PhysicalTotal ? pi.CommitTotal - pi.PhysicalTotal : 0) * pi.PageSize;
 
     return NULL;
 }
+
+const char* ffDetectSwap(FFlist* result)
+{
+    const char* err = detectByNqsi(result);
+    if (err == NULL)
+        return NULL;
+
+    return detectByKgpi(result);
+}