import os
import sys
import ctypes
from ctypes import *
import struct

BYTE      = c_ubyte
USHORT    = c_ushort
WORD      = c_ushort
DWORD     = c_uint
DWORDLONG = c_ulonglong
LONG      = c_int
ULONG     = c_uint
UINT64    = c_ulonglong
LPBYTE    = POINTER(c_ubyte)
LPTSTR    = POINTER(c_char)
HANDLE    = c_void_p
PVOID     = c_void_p
LPVOID    = c_void_p
UINT_PTR  = c_void_p
ULONG_PTR = c_void_p
SIZE_T    = c_void_p
HMODULE   = c_void_p
PWCHAR    = c_wchar_p
DOUBLE    = c_double
LARGE_INTEGER = c_longlong


class UNICODE_STRING(Structure):
    _fields_ = [
        ("Length", USHORT),
        ("MaximumLength", USHORT),
        ("Buffer", PWCHAR)
    ]

'''
class UNICODE_STRING(Structure):
    _pack_ = 1
    _fields_ = [
        ("Length", USHORT),
        ("MaximumLength", USHORT),
        ("Buffer", PWCHAR),
]
'''

class SYSTEM_PROCESS_INFORMATION(Structure):
    _fields_ = [
        ("NextEntryOffset", ULONG),
        ("NumberOfThreads", ULONG),
        ("Reserved", UINT64 * 3),
        ("CreateTime", LARGE_INTEGER),
        ("UserTime", LARGE_INTEGER),
        ("KernelTime", LARGE_INTEGER),
        ("ImageName", UNICODE_STRING),
        ("BasePriority", ULONG),
        ("ProcessId", PVOID),
        ("InheritedFromProcessId", PVOID)
]

NTDLL = windll.ntdll
libc = cdll.msvcrt

proclist = []
pidlist = []
buf = create_string_buffer(1024 * 1024)
p = cast(buf, c_void_p)

retlen = c_ulong(0)
retval = NTDLL.NtQuerySystemInformation(5, p, 1024*1024, byref(retlen))

if retval:
    sys.exit(-1)

proc = cast(p, POINTER(SYSTEM_PROCESS_INFORMATION)).contents

while proc.NextEntryOffset:
    p.value += proc.NextEntryOffset
    proc = cast(p, POINTER(SYSTEM_PROCESS_INFORMATION)).contents

    print "NextEntryOffset: %x" % (proc.NextEntryOffset)
    print "NumberOfThreads: %x" % (proc.NumberOfThreads)
    print "CreateTime: %x" % (proc.CreateTime)
    print "UserTime: %x" % (proc.UserTime)
    print "KernelTime: %x" % (proc.KernelTime)
    print "ProcessID: %x" % (int(proc.ProcessId))
    print "ImageName.Length: %x" % (proc.ImageName.Length)

    if (proc.ImageName.Length):
        a = proc.ImageName.Buffer
        b = a.encode('ascii', 'ignore')
        print b

raw_input()