Platform SDK: Performance Monitoring

QueryWorkingSet

The QueryWorkingSet function retrieves information about the pages currently added to the working set of the specified process.

BOOL QueryWorkingSet(
  HANDLE hProcess,  // handle to process
  PVOID pv,         // information buffer
  DWORD cb          // size of buffer
);

Parameters

hProcess: [in] Handle to the process.
pv: [out] Pointer to the buffer that receives the information.
cb: [in] Specifies the size, in bytes, of the buffer.

Return Value

If the function succeeds, the return value is nonzero.

If the function fails, the return value is zero. To get extended error information, call GetLastError.

Remarks

The return buffer consists of a DWORD value and a variable number of DWORD_PTR values. The DWORD contains the number of valid DWORD_PTR values that follow it in the buffer. Each remaining DWORD_PTR represents one page in the process working set.

Each DWORD_PTR value is an address of a bit field containing information about a specific working set page. To decode these DWORD_PTR values, it is necessary to split the highest-order 52 bits from the lowest-order 12 bits.

The highest-order 52 bits (obtained by using a bitwise AND operator with 0xFFFFFFFFFFFFF000) contain the address of a page of memory loaded into the specified process.

The lowest-order 12 bits of this bit field contain the following 4 fields, from highest-order bit to lowest-order.

A 3-bit filler field. No information is currently returned in these bits.
A 1-bit flag specifying whether the page is shared. The value is 1 if it is a shared page, and 0 if it is not.
A 3-bit field containing the number of processes that this field is shared between. The maximum value of this field is 7.
A 5-bit field containing a value between 0 and 31 that specifies the protection attributes of the page. The following table lists these values and their corresponding meaning.

Value	Meaning
0	The page is not accessed.
1	The page is read-only.
2	The page is executable.
3	The page is executable and read-only.
4	The page has read/write access.
5	The page is copy-on-write.
6	The page is executable and has read/write access.
7	The page is executable and has copy-on-write access.
8	The page is not accessed.
9	The page is not cached and has read-only access.
10	The page is not cached and is executable.
11	The page is not cached, is executable, and has read-only access.
12	The page is not cached and has read/write access.
13	The page is not cached and has copy-on-write access.
14	The page is not cached, is executable, and has read/write access.
15	The page is not cached, is executable, and has copy-on-write access.
16	The page is not accessed.
17	The page is a guard page and has read-only access.
18	The page is a guard page and is executable.
19	The page is a guard page, is executable, and has read-only access.
20	The page is a guard page and has read/write access.
21	The page is a guard page and has copy-on-write access.
22	The page is a guard page, is executable, and has read/write access.
23	The page is a guard page, is executable, and has copy-on-write access.
24	The page is not accessed.
25	The page is a non-cacheable guard page and has read-only access.
26	The page is a non-cacheable guard page and has executable access.
27	The page is a non-cacheable guard page, is executable, and has read-only access.
28	The page is a non-cacheable guard page and has read/write access.
29	The page is a non-cacheable guard page and has copy-on-write access.
30	The page is a non-cacheable guard page, is executable, and has read/write access.
31	The page is a non-cacheable guard page, is executable, and has copy-on-write access.

Requirements

  Windows NT/2000: Requires Windows NT 4.0 or later.
  Header: Declared in Psapi.h.
  Library: Use Psapi.lib.

QueryWorkingSet

Parameters

Return Value

Remarks

Requirements

See Also