windows_snapshot/operating_system/processes.rs
1//! The Processes subcategory groups classes that represent system processes and threads.
2//!
3//! | Class | Description |
4//! |-------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------|
5//! | [**Win32\_Process**](Win32_Process) | Instance class<br/> Represents a sequence of events on a computer system running Windows.<br/> |
6//! | [**Win32\_Thread**](Win32_Thread) | Instance class<br/> Represents a thread of execution.<br/> |
7
8use crate::update;
9use serde::{Deserialize, Serialize};
10use std::time::SystemTime;
11use wmi::{COMLibrary, WMIConnection, WMIDateTime};
12
13/// Represents the state of Windows Processes
14#[derive(Deserialize, Serialize, Debug, Clone)]
15pub struct Processes {
16 /// Sequence of Process based on when they were launched in chronological order
17 pub processes: Vec<Win32_Process>,
18 /// When was the record last updated
19 pub last_updated: SystemTime,
20}
21
22update!(Processes, processes);
23
24/// Represents the state of Windows threads
25#[derive(Deserialize, Serialize, Debug, Clone)]
26pub struct Threads {
27 /// Sequence of Threads based on when they were launched in chronological order
28 pub threads: Vec<Win32_Thread>,
29 /// When was the record last updated
30 pub last_updated: SystemTime,
31}
32
33update!(Threads, threads);
34
35/// The `Win32_Process` WMI class represents a process on an operating system.
36///
37/// <https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-process>
38#[derive(Default, Deserialize, Serialize, Debug, Clone)]
39#[allow(non_snake_case)]
40#[allow(non_camel_case_types)]
41pub struct Win32_Process {
42 /// Name of the class or subclass used in the creation of an instance. When used with other key
43 /// properties of the class, this property allows all instances of the class and its subclasses
44 /// to be uniquely identified.
45 pub CreationClassName: Option<String>,
46 /// Short description of an object—a one-line string.
47 pub Caption: Option<String>,
48 /// Command line used to start a specific process, if applicable.
49 pub CommandLine: Option<String>,
50 /// Date the process begins executing.
51 pub CreationDate: Option<WMIDateTime>,
52 /// Creation class name of the scoping computer system.
53 pub CSCreationClassName: Option<String>,
54 /// Name of the scoping computer system.
55 pub CSName: Option<String>,
56 /// Description of an object.
57 pub Description: Option<String>,
58 /// Path to the executable file of the process.
59 ///
60 /// Example: "C:\Windows\System\Explorer.Exe"
61 pub ExecutablePath: Option<String>,
62 /// Current operating condition of the process.
63 ///
64 /// - Unknown (0)
65 /// - Other (1)
66 /// - Ready (2)
67 /// - Running (3)
68 /// - Blocked (4)
69 /// - Suspended Blocked (5)
70 /// - Suspended Ready (6)
71 /// - Terminated (7)
72 /// - Stopped (8)
73 /// - Growing (9)
74 pub ExecutionState: Option<u16>,
75 /// Process identifier.
76 pub Handle: Option<String>,
77 /// Total number of open handles owned by the process. HandleCount is the sum of the handles
78 /// currently open by each thread in this process. A handle is used to examine or modify the
79 /// system resources. Each handle has an entry in a table that is maintained internally. Entries
80 /// contain the addresses of the resources and data to identify the resource type.
81 pub HandleCount: Option<u32>,
82 /// Date an object is installed. The object may be installed without a value being written to
83 /// this property.
84 pub InstallDate: Option<WMIDateTime>,
85 /// Time in kernel mode, in milliseconds. If this information is not available, use a value of 0
86 /// (zero).
87 pub KernelModeTime: Option<u64>,
88 /// Maximum working set size of the process. The working set of a process is the set of memory
89 /// pages visible to the process in physical RAM. These pages are resident, and available for an
90 /// application to use without triggering a page fault.
91 ///
92 /// Example: 1413120
93 pub MaximumWorkingSetSize: Option<u32>,
94 /// Minimum working set size of the process. The working set of a process is the set of memory
95 /// pages visible to the process in physical RAM. These pages are resident and available for an
96 /// application to use without triggering a page fault.
97 ///
98 /// Example: 20480
99 pub MinimumWorkingSetSize: Option<u32>,
100 /// Name of the executable file responsible for the process, equivalent to the Image Name
101 /// property in Task Manager.
102 ///
103 /// When inherited by a subclass, the property can be overridden to be a key property. The name
104 /// is hard-coded into the application itself and is not affected by changing the file name.
105 /// For example, even if you rename Calc.exe, the name Calc.exe will still appear in Task
106 /// Manager and in any WMI scripts that retrieve the process name.
107 pub Name: Option<String>,
108 /// Creation class name of the scoping operating system.
109 pub OSCreationClassName: Option<String>,
110 /// Name of the scoping operating system.
111 pub OSName: Option<String>,
112 /// Number of I/O operations performed that are not read or write operations.
113 pub OtherOperationCount: Option<u64>,
114 /// Amount of data transferred during operations that are not read or write operations.
115 pub OtherTransferCount: Option<u64>,
116 /// Number of page faults that a process generates.
117 ///
118 /// Example: 10
119 pub PageFaults: Option<u32>,
120 /// Amount of page file space that a process is using currently. This value is consistent with
121 /// the VMSize value in TaskMgr.exe.
122 ///
123 /// Example: 102435
124 pub PageFileUsage: Option<u32>,
125 /// Unique identifier of the process that creates a process. Process identifier numbers are
126 /// reused, so they only identify a process for the lifetime of that process. It is possible
127 /// that the process identified by ParentProcessId is terminated, so `ParentProcessId` may not
128 /// refer to a running process. It is also possible that ParentProcessId incorrectly refers to
129 /// a process that reuses a process identifier. You can use the `CreationDate` property to
130 /// determine whether the specified parent was created after the process represented by this
131 /// `Win32_Process` instance was created.
132 pub ParentProcessId: Option<u32>,
133 /// Maximum amount of page file space used during the life of a process.
134 ///
135 /// Example: 102367
136 pub PeakPageFileUsage: Option<u32>,
137 /// Maximum virtual address space a process uses at any one time. Using virtual address space
138 /// does not necessarily imply corresponding use of either disk or main memory pages. However,
139 /// virtual space is finite, and by using too much the process might not be able to load
140 /// libraries.
141 pub PeakVirtualSize: Option<u64>,
142 /// Peak working set size of a process.
143 ///
144 /// Example: 1413120
145 pub PeakWorkingSetSize: Option<u32>,
146 /// Scheduling priority of a process within an operating system. The higher the value, the
147 /// higher priority a process receives. Priority values can range from 0 (zero), which is the
148 /// lowest priority to 31, which is highest priority.
149 ///
150 /// Example: 7
151 pub Priority: Option<u32>,
152 /// Current number of pages allocated that are only accessible to the process represented by
153 /// this `Win32_Process` instance.
154 pub PrivatePageCount: Option<u64>,
155 /// Numeric identifier used to distinguish one process from another. ProcessIDs are valid from
156 /// process creation time to process termination. Upon termination, that same numeric identifier
157 /// can be applied to a new process.
158 ///
159 /// This means that you cannot use ProcessID alone to monitor a particular process. For example,
160 /// an application could have a ProcessID of 7, and then fail. When a new process is started,
161 /// the new process could be assigned ProcessID 7. A script that checked only for a specified
162 /// `ProcessID` could thus be "fooled" into thinking that the original application was still
163 /// running.
164 pub ProcessId: Option<u32>,
165 /// Quota amount of nonpaged pool usage for a process.
166 ///
167 /// Example: 15
168 pub QuotaNonPagedPoolUsage: Option<u32>,
169 /// Quota amount of paged pool usage for a process.
170 ///
171 /// Example: 22
172 pub QuotaPagedPoolUsage: Option<u32>,
173 /// Peak quota amount of nonpaged pool usage for a process.
174 ///
175 /// Example: 31
176 pub QuotaPeakNonPagedPoolUsage: Option<u32>,
177 /// Peak quota amount of paged pool usage for a process.
178 ///
179 /// Example: 31
180 pub QuotaPeakPagedPoolUsage: Option<u32>,
181 /// Number of read operations performed.
182 pub ReadOperationCount: Option<u64>,
183 /// Amount of data read.
184 pub ReadTransferCount: Option<u64>,
185 /// Unique identifier that an operating system generates when a session is created. A session
186 /// spans a period of time from logon until logoff from a specific system.
187 pub SessionId: Option<u32>,
188 /// This property is not implemented and does not get populated for any instance of this class.
189 /// It is always NULL.
190 pub Status: Option<String>,
191 /// Process was stopped or terminated.
192 /// To get the termination time, a handle to the process must be held open.
193 /// Otherwise, this property returns NULL.
194 pub TerminationDate: Option<WMIDateTime>,
195 /// Number of active threads in a process.
196 /// An instruction is the basic unit of execution in a processor,
197 /// and a thread is the object that executes an instruction.
198 /// Each running process has at least one thread.
199 pub ThreadCount: Option<u32>,
200 /// Time in user mode, in 100 nanosecond units. If this information is not available, use a
201 /// value of 0 (zero).
202 pub UserModeTime: Option<u64>,
203 /// Current size of the virtual address space that a process is using,
204 /// not the physical or virtual memory actually used by the process.
205 /// Using virtual address space does not necessarily imply corresponding use of either disk or main memory pages.
206 /// Virtual space is finite, and by using too much, the process might not be able to load libraries.
207 /// This value is consistent with what you see in Perfmon.exe.
208 pub VirtualSize: Option<u64>,
209 /// Version of Windows in which the process is running.
210 ///
211 /// Example: 4.0
212 pub WindowsVersion: Option<String>,
213 /// Amount of memory in bytes
214 /// that a process needs
215 /// to execute efficiently—for an operating system that uses page-based memory management.
216 /// If the system does not have enough memory (less than the working set size), thrashing occurs.
217 /// If the size of the working set is not known, use NULL or 0 (zero).
218 /// If working set data is provided,
219 /// you can monitor the information to understand the changing memory requirements of a process.
220 pub WorkingSetSize: Option<u64>,
221 /// Number of write operations performed.
222 pub WriteOperationCount: Option<u64>,
223 /// Amount of data written.
224 pub WriteTransferCount: Option<u64>,
225}
226
227/// The `Win32_Thread` WMI class represents a thread of execution. While a process must have one
228/// thread of execution, the process can create other threads to execute tasks in parallel. Threads
229/// share the process environment, thus multiple threads under the same process use less memory than
230/// the same number of processes.
231///
232/// <https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-thread>
233#[derive(Default, Deserialize, Serialize, Debug, Clone)]
234#[allow(non_snake_case)]
235#[allow(non_camel_case_types)]
236pub struct Win32_Thread {
237 /// Short description of the object.
238 pub Caption: Option<String>,
239 /// Name of the first concrete class to appear in the inheritance chain used in the creation of
240 /// an instance. When used with the other key properties of the class, this property allows all
241 /// instances of this class and its subclasses to be uniquely identified.
242 pub CreationClassName: Option<String>,
243 /// Creation class name of the scoping computer system.
244 pub CSCreationClassName: Option<String>,
245 /// Name of the scoping computer system.
246 pub CSName: Option<String>,
247 /// Description of the object.
248 pub Description: Option<String>,
249 /// Total execution time, in milliseconds, given to this thread since its creation.
250 pub ElapsedTime: Option<u64>,
251 /// Current operating condition of the thread.
252 ///
253 /// - Unknown (0)
254 /// - Other (1)
255 /// - Ready (2)
256 /// - Running (3)
257 /// - Blocked (4)
258 /// - Suspended Blocked (5)
259 /// - Suspended Ready (6)
260 pub ExecutionState: Option<u16>,
261 /// Handle to a thread. The handle has full access rights by default. With the correct security
262 /// access, the handle can be used in any function that accepts a thread handle. Depending on
263 /// the inheritance flag specified when it is created, this handle can be inherited by child
264 /// processes.
265 pub Handle: Option<String>,
266 /// Object was installed. This property does not need a value to indicate that the object is
267 /// installed.
268 pub InstallDate: Option<WMIDateTime>,
269 /// Time in kernel mode, in 100 nanosecond units. If this information is not available, a value
270 /// of 0 (zero) should be used.
271 pub KernelModeTime: Option<u64>,
272 /// Label by which the object is known. When subclassed, the property can be overridden to be a
273 /// key property.
274 pub Name: Option<String>,
275 /// Creation class name of the scoping operating system.
276 pub OSCreationClassName: Option<String>,
277 /// Name of the scoping operating system.
278 pub OSName: Option<String>,
279 /// Dynamic priority of the thread. Each thread has a dynamic priority that the scheduler uses
280 /// to determine which thread to execute. Initially, a thread's dynamic priority is the same as
281 /// its base priority. The system can raise and lower the dynamic priority, to ensure that it is
282 /// responsive (guaranteeing that no threads are starved for processor time). The system does
283 /// not boost the priority of threads with a base priority level between 16 and 31. Only threads
284 /// with a base priority between 0 and 15 receive dynamic priority boosts. Higher numbers
285 /// indicate higher priorities.
286 pub Priority: Option<u32>,
287 /// Current base priority of a thread. The operating system may raise the thread's dynamic
288 /// priority above the base priority if the thread is handling user input, or lower it toward
289 /// the base priority if the thread becomes compute-bound. The PriorityBase property can have a
290 /// value between 0 and 31.
291 pub PriorityBase: Option<u32>,
292 /// Value of the scoping process `CreationClassName` property.
293 pub ProcessCreationClassName: Option<String>,
294 /// Process that created the thread. The contents of this property can be used by Windows
295 /// application programming interface (API) elements.
296 pub ProcessHandle: Option<String>,
297 /// Starting address of the thread. Because any application with appropriate access to the
298 /// thread can change the thread's context, this value may only be an approximation of the
299 /// thread's starting address.
300 pub StartAddress: Option<u32>,
301 /// Current status of the object. Various operational and nonoperational statuses can be
302 /// defined. Operational statuses include: "OK", "Degraded", and "Pred Fail" (an element, such
303 /// as a SMART-enabled hard disk drive, may be functioning properly but predicting a failure in
304 /// the near future). Nonoperational statuses include: "Error", "Starting", "Stopping", and
305 /// "Service". The latter, "Service", could apply during mirror-resilvering of a disk, reload of
306 /// a user permissions list, or other administrative work. Not all such work is online, yet the
307 /// managed element is neither "OK" nor in one of the other states.
308 ///
309 /// The values are:
310 ///
311 /// - OK ("OK")
312 /// - Error ("Error")
313 /// - Degraded ("Degraded")
314 /// - Unknown ("Unknown")
315 /// - Pred Fail ("Pred Fail")
316 /// - Starting ("Starting")
317 /// - Stopping ("Stopping")
318 /// - Service ("Service")
319 /// - Stressed ("Stressed")
320 /// - NonRecover ("NonRecover")
321 /// - No Contact ("No Contact")
322 /// - Lost Comm ("Lost Comm")
323 pub Status: Option<String>,
324 /// Current execution state for the thread.
325 ///
326 /// - Initialized (0) — It is recognized by the microkernel.
327 /// - Ready (1) — It is prepared to run on the next available processor.
328 /// - Running (2) — It is executing.
329 /// - Standby (3) — It is about to run, only one thread may be in this state at a time.
330 /// - Terminated (4) — It is finished executing.
331 /// - Waiting (5) — It is not ready for the processor, when ready, it will be rescheduled.
332 /// - Transition (6) — The thread is waiting for resources other than the processor,
333 /// - Unknown (7) — The thread state is unknown.
334 pub ThreadState: Option<u32>,
335 /// Reason why the thread is waiting. This value is only valid if the `ThreadState` member is set
336 /// to Transition (6). Event pairs allow communication with protected subsystems.
337 ///
338 /// - Executive (0)
339 /// - FreePage (1)
340 /// - PageIn (2)
341 /// - PoolAllocation (3)
342 /// - ExecutionDelay (4)
343 /// - FreePage (5)
344 /// - PageIn (6)
345 /// - Executive (7)
346 /// - FreePage (8)
347 /// - PageIn (9)
348 /// - PoolAllocation (10)
349 /// - ExecutionDelay (11)
350 /// - FreePage (12)
351 /// - PageIn (13)
352 /// - EventPairHigh (14)
353 /// - EventPairLow (15)
354 /// - LPCReceive (16)
355 /// - LPCReply (17)
356 /// - VirtualMemory (18)
357 /// - PageOut (19)
358 /// - Unknown (20)
359 pub ThreadWaitReason: Option<u32>,
360 /// Time in user mode, in 100 nanoseconds units. If this information is not available, a value
361 /// of 0 (zero) should be used.
362 pub UserModeTime: Option<u64>,
363}