SYSTEM_CALL_COUNT_INFORMATION

The SYSTEM_CALL_COUNT_INFORMATION structure is a fixed-size header for the variable amount of data that a successful call to ZwQuerySystemInformation or NtQuerySystemInformation produces in its output buffer when given the information class SystemCallCountInformation (0x06).

This information class is nowadays not supported.

Documentation Status

The SYSTEM_CALL_COUNT_INFORMATION structure is not documented.

Layout

The SYSTEM_CALL_COUNT_INFORMATION is 0x08 bytes in both 32-bit and 64-bit Windows in all versions starting from 3.51 but 0x04 bytes in version 3.50.

Offset Definition Versions
0x00
ULONG Length;
3.50 and higher
0x04
ULONG NumberOfTables;
3.51 and higher

The fixed-size header is followed by an array of dwords, one per table, and then by the tables. Each of the dwords is in turn the number of 32-bit counts in the corresponding table. Version 3.50 has only the only one table. That there can be more starts with version 3.51 and the KeAddSystemServiceTable function.