From 62f78ca60cedfdd75f8d9dbab91696bcb89e9eb9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E6=9D=8E=E9=80=9A=E6=B4=B2?= Date: Wed, 2 Sep 2026 16:23:06 +0800 Subject: [PATCH] Processes (Windows): uses SystemHandleCountInformation if available --- src/detection/processes/processes_windows.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/src/detection/processes/processes_windows.c b/src/detection/processes/processes_windows.c index 0a2ba2f41..b5d65b301 100644 --- a/src/detection/processes/processes_windows.c +++ b/src/detection/processes/processes_windows.c @@ -1,10 +1,23 @@ #include "processes.h" #include "common/mallocHelper.h" +#include "common/windows/nt.h" #include #include const char* ffDetectProcesses(const FFProcessesOptions* options, FFProcessesResult* result) { + if (options->countKprocs && ffIsSystemBasicProcessInfoAvailable()) { + // SystemHandleCountInformation reports the total process/thread counts directly, + // so we don't need to walk the whole process table. + SYSTEM_HANDLECOUNT_INFORMATION info = {}; // Seems that kernel only fills the lower 32 bits of the counts, leave the upper 32 bits untouched. + if (NT_SUCCESS(NtQuerySystemInformation(SystemHandleCountInformation, &info, sizeof(info), NULL))) { + result->processes = info.ProcessCount; + result->threads = info.ThreadCount; + return nullptr; + } + // Otherwise fall back to walking the process table + } + FF_AUTO_FREE SYSTEM_PROCESS_INFORMATION* pstart = nullptr; // Multiple attempts in case processes change while