I don't know much about kernel32/ntdll, but I'm pretty sure that you could get this to work through ntdll. NtQuerySystemInformation with SystemProcessorInformation/SystemLogicalProcessorInformation (see http://undocumented.ntinternals.net/UserMode/Undocumented%20Functions/System...) should help. http://native-nt-toolkit.googlecode.com/svn/trunk/ndk/extypes.h (read, don't copy) seems to have a pretty exhaustive set of definitions, but even that's not complete. Some tests for the NT version would be useful.
Mike.
SystemLogicalProcessorInformation seems to be the right SystemClass for NtQuerySystemInformation. But here's the Problem. I don't have any idea how i could any information about the struct returned by calling NtQuerySystemInformation with SystemLogicalProcessorInformation (= 73).
The only windows machine i have access to a the moment keeps throwing status 0xC0000005 (ACCESS_VIOLATION) at me which doesn't help at all and i'm pretty much stuck right now. If i could get my hands on the struct returned by NtQuerySystemInformation it should be easy to change the patch to do the parsing in ntdll and just call that from kernel32.