Processes (Windows): uses SystemHandleCountInformation if available

src/detection/processes/processes_windows.c

@@ -1,10 +1,23 @@
 #include "processes.h"
 #include "common/mallocHelper.h"
+#include "common/windows/nt.h"
 
 #include <ntstatus.h>
 #include <winternl.h>
 
 const char* ffDetectProcesses(const FFProcessesOptions* options, FFProcessesResult* result) {
+    if (options->countKprocs && ffIsSystemBasicProcessInfoAvailable()) {
+        // SystemHandleCountInformation reports the total process/thread counts directly,
+        // so we don't need to walk the whole process table.
+        SYSTEM_HANDLECOUNT_INFORMATION info = {}; // Seems that kernel only fills the lower 32 bits of the counts, leave the upper 32 bits untouched.
+        if (NT_SUCCESS(NtQuerySystemInformation(SystemHandleCountInformation, &info, sizeof(info), NULL))) {
+            result->processes = info.ProcessCount;
+            result->threads = info.ThreadCount;
+            return nullptr;
+        }
+        // Otherwise fall back to walking the process table
+    }
+
     FF_AUTO_FREE SYSTEM_PROCESS_INFORMATION* pstart = nullptr;
 
     // Multiple attempts in case processes change while