Pokud potřebuješ nějaké služby z NT securities nebo NT shellservices podívej se na sourceforge.net. Jsou tam toho hromady. Podívej se na systémové rutiny uvolněné např po pádu TurboPower. Podívej se na nějaké dobré archivy Delphi, většina rutin je už většinou převedena do syntaxe ObjectPascalu (asi bych začal na www.torry.net ). Podle názvu bych si tipnul že to jsou nějaké nedokumentované ale interfaceované funkce z Win32 (seznam běžících procesů pod NT ?) tak zkus taky http://www.google.com/search?q=NtQue...at+Googlem&lr= . Určitě něco najdeš viz třeba tento callback (je to pořád ještě pascal )

type
IO_COUNTERS = record
ReadOperationCount:Int64;
WriteOperationCount:Int64;
OtherOperationCount:Int64;
ReadTransferCount:Int64;
WriteTransferCount:Int64;
OtherTransferCount:Int64;
end;
VM_COUNTERS = record
PeakVirtualSize:ULONG;
VirtualSize:ULONG;
PageFaultCount:ULONG;
PeakWorkingSetSize:ULONG;
WorkingSetSize:ULONG;
QuotaPeakedPagedPoolUsage:ULONG;
QuotaPagedPoolUsage:ULONG;
QuotaPeakNonPagedPoolUsage:ULONG;
QuotaNonPagedPoolUsage:ULONG;
PagefileUsage:ULONG;
PeakPagefileUsage:ULONG;
end;

PSYSTEM_PROCESS = ^SYSTEM_PROCESS;
SYSTEM_PROCESS = record
NextEntryDelta:ULONG;
ThreadCount:ULONG;
Reserved:array[0..5] of ULONG;

CreateTime:LARGE_INTEGER;
UserTime:LARGE_INTEGER;
KernelTime:LARGE_INTEGER;

ProcessName:PWideChar;

BasePriorityWORD;
ProcessID:ULONG;
InheritedFromProcessID:ULONG;
HandleCount:ULONG;
Reserved2:array[0..1] of ULONG;
VmCounters:VM_COUNTERS;
IoCounters:IO_COUNTERS;
Threads:Pointer;
end;

function NtQuerySystemInformationCallback(
SystemInformationClassWORD;
SystemInformation:Pointer;
SystemInformationLength:ULONG;
ReturnLength:PULONG):ULONG;
var
iChanged:Integer;
pCurrent, pLast:PSYSTEM_PROCESS;
begin
result :=
NtQuerySystemInformationNextHook(
SystemInformationClass,
SystemInformation,
SystemInformationLength,
ReturnLength);
if (result <> 0) then
exit;
if (SystemInformationClass <> 5) then
exit;
pCurrent := PSYSTEM_PROCESS(SystemInformation);
pLast := nil;

while (pCurrent <> nil) do
begin
if (WideCharToString(pCurrent.ProcessName) = 'myprocess.exe') then
begin
inc(iChanged);
if (pLast <> nil) then
begin

if (pCurrent.NextEntryDelta <> 0) then
begin
inc(pLast.NextEntryDelta, pCurrent.NextEntryDelta);
end //NextEntryDelta <> 0
else
begin
pLast.NextEntryDelta := 0;
end //NextEntryDelta = 0
end //pLast <> nil
else
begin
if (pCurrent.NextEntryDelta <> 0) then
begin
SystemInformation := Pointer(DWORD(SystemInformation) + pCurrent.NextEntryDelta);
end
else
begin
SystemInformation := nil;
end;
end; //pLast = nil
end; //found our proc
if (iChanged = 0) then
begin
pLast := pCurrent;
end;

if (pCurrent.NextEntryDelta <> 0) then
begin
pCurrent := PSYSTEM_PROCESS(
Pointer(
DWORD(pCurrent) + pCurrent.NextEntryDelta));
end
else
pCurrent := nil;
end;
end;