PsGetProcessDeepFreezeStats
VOID __stdcall PsGetProcessDeepFreezeStats(_EPROCESS *Process, _PS_DEEP_FREEZE_STATS *DeepFreezeStats){
_ETHREAD *CurrentThread;
_EX_PUSH_LOCK *p_ProcessLock;
volatile unsigned __int64 InterruptTimeBias;
unsigned __int64 FreezeUnbiasedTime;
unsigned __int64 v8;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--CurrentThread->Tcb.KernelApcDisable;
p_ProcessLock = &Process->ProcessLock;
ExAcquirePushLockSharedEx(&Process->ProcessLock, 0i64);
DeepFreezeStats->TotalFrozenUnbiasedTime = Process->TotalUnbiasedFrozenTime;
DeepFreezeStats->FreezeUnbiasedTime = Process->LastFreezeInterruptTime;
do
{
InterruptTimeBias = KUSER_SHARED_DATA.InterruptTimeBias;
DeepFreezeStats->CurrentTime = *(_QWORD *)&KUSER_SHARED_DATA.InterruptTime.LowPart;
}
while( InterruptTimeBias != KUSER_SHARED_DATA.InterruptTimeBias );
if( _InterlockedCompareExchange64(&p_ProcessLock->_bf_0, 0i64, 17i64) != 17 )
ExfReleasePushLockShared(p_ProcessLock);
KeAbPostRelease(p_ProcessLock);
KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
FreezeUnbiasedTime = DeepFreezeStats->FreezeUnbiasedTime;
v8 = DeepFreezeStats->CurrentTime - InterruptTimeBias;
DeepFreezeStats->CurrentUnbiasedTime = v8;
if( FreezeUnbiasedTime )
DeepFreezeStats->TotalFrozenUnbiasedTime += v8 - FreezeUnbiasedTime;
}Referenced by:
NtQueryInformationProcess
PfpPrivSourceEnum
PsSetProcessTelemetryAppState