| 925 | CloseHandle(pipe); |
| 926 | } |
| 927 | static BOOL GetProcessHiddenTimes(PLARGE_INTEGER hiddenKernelTime, PLARGE_INTEGER hiddenUserTime, PLONGLONG hiddenCycleTime) |
| 928 | { |
| 929 | // Count hidden CPU usage explicitly instead of waiting for a call to NtQuerySystemInformation(SystemProcessInformation). |
| 930 | // Task managers call NtQuerySystemInformation(SystemProcessInformation) also, but not necessarily in a matching frequency. |
| 931 | |
| 932 | BOOL result = FALSE; |
| 933 | LPBYTE systemInformation = NEW_ARRAY(BYTE, 1024 * 1024 * 2); |
| 934 | ULONG returnLength; |
| 935 | |
| 936 | if (NT_SUCCESS(OriginalNtQuerySystemInformation(SystemProcessInformation, systemInformation, 1024 * 1024 * 2, &returnLength))) |
| 937 | { |
| 938 | if (hiddenKernelTime) hiddenKernelTime->QuadPart = 0; |
| 939 | if (hiddenUserTime) hiddenUserTime->QuadPart = 0; |
| 940 | if (hiddenCycleTime) *hiddenCycleTime = 0; |
| 941 | |
| 942 | for (PNT_SYSTEM_PROCESS_INFORMATION current = (PNT_SYSTEM_PROCESS_INFORMATION)systemInformation, previous = NULL; current;) |
| 943 | { |
| 944 | if (HasPrefixU(current->ImageName) || IsProcessIdHidden((DWORD)(DWORD_PTR)current->ProcessId) || IsProcessNameHiddenU(current->ImageName)) |
| 945 | { |
| 946 | if (hiddenKernelTime) hiddenKernelTime->QuadPart += current->KernelTime.QuadPart; |
| 947 | if (hiddenUserTime) hiddenUserTime->QuadPart += current->UserTime.QuadPart; |
| 948 | if (hiddenCycleTime) *hiddenCycleTime += current->CycleTime; |
| 949 | } |
| 950 | |
| 951 | previous = current; |
| 952 | |
| 953 | if (current->NextEntryOffset) current = (PNT_SYSTEM_PROCESS_INFORMATION)((LPBYTE)current + current->NextEntryOffset); |
| 954 | else current = NULL; |
| 955 | } |
| 956 | |
| 957 | result = TRUE; |
| 958 | } |
| 959 | |
| 960 | FREE(systemInformation); |
| 961 | return result; |
| 962 | } |
| 963 | static LPWSTR CreatePath(LPWSTR result, LPCWSTR directoryName, LPCWSTR fileName) |
| 964 | { |
| 965 | // PathCombineW cannot be used with the directory name "\\.\pipe\". |
no test coverage detected