[NTOSKRNL] Implement KeQueryValuesProcess().

And make use of it.
This commit is contained in:
Pierre Schweitzer 2018-05-25 21:40:39 +02:00
parent b0b7437882
commit f15afdbc43
No known key found for this signature in database
GPG key ID: 7545556C3D585B0B
4 changed files with 80 additions and 17 deletions

View file

@ -82,6 +82,7 @@ NtQueryInformationProcess(IN HANDLE ProcessHandle,
PUNICODE_STRING ImageName;
ULONG Cookie, ExecuteOptions = 0;
ULONG_PTR Wow64 = 0;
PROCESS_VALUES ProcessValues;
PAGED_CODE();
/* Check for user-mode caller */
@ -251,15 +252,12 @@ NtQueryInformationProcess(IN HANDLE ProcessHandle,
NULL);
if (!NT_SUCCESS(Status)) break;
/* Query IO counters from the process */
KeQueryValuesProcess(&Process->Pcb, &ProcessValues);
_SEH2_TRY
{
/* FIXME: Call KeQueryValuesProcess */
IoCounters->ReadOperationCount = Process->ReadOperationCount.QuadPart;
IoCounters->ReadTransferCount = Process->ReadTransferCount.QuadPart;
IoCounters->WriteOperationCount = Process->WriteOperationCount.QuadPart;
IoCounters->WriteTransferCount = Process->WriteTransferCount.QuadPart;
IoCounters->OtherOperationCount = Process->OtherOperationCount.QuadPart;
IoCounters->OtherTransferCount = Process->OtherTransferCount.QuadPart;
RtlCopyMemory(IoCounters, &ProcessValues.IoInfo, sizeof(IO_COUNTERS));
}
_SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
{