First, I’m trying to eliminate some code that is essentially trying to
figure out how long a process has been executing by directly reading
KPROCESS.UserTime+KPROCESS.KernelTime. I’m not so interested in the actual
values or units as being able to avoid doing work in the context of a Ob
callback that is nested within NtCreateUserProcess(). So basically this
stack context:
8d439184 8196d23b 8d439218 8d439580 00000000
nt!ObpCallPreOperationCallbacks+0x136
8d4391d0 818ec49f 8d43920c 8d439218 00000000
nt!ObpPreInterceptHandleCreate+0x75
8d439224 818ffae9 00000000 8d439580 00000000 nt!ObpCreateHandle+0x2ff
8d4393a8 81979ae5 aad6b040 00000000 8d439580 nt!ObOpenObjectByPointer+0xc1
8d4393d8 818e4cb6 8025eb30 21891f0f 911ff800 nt!PspCreateObjectHandle+0x2b
8d4394b4 818d701f 8d4394ec 8d439544 02000000 nt!PspInsertThread+0x3c8
8d439be0 81774c67 0493e28c 0493e238 02000000 nt!NtCreateUserProcess+0x64d
8d439be0 77b9ca70 0493e28c 0493e238 02000000 nt!KiSystemServicePostCall
0493e4c0 00000000 00000000 00000000 00000000 ntdll!KiFastSystemCallRet
The problem appears to be that PsQueryTotalCycleTImeProcess() appears to
entirely ignore the EPROCESS parameter passed to it. From the debugger I
can clearly see that (as expected since the process hasn’t started
executing yet) KPROCESS.CycleTIme == 0 and the only thread in the process
also has KTHREAD.CycleTime == 0. How PsQueryTotalCycleTimeProcess()
appears to be returning values based on the current thread, and quite
possibly from adding up individual KTHREAD.CycleTime values by following
the current thread’s list entry. My ability to interpret dis-assembly is
somewhat limited, but as far as I can tell it the EPROCESS parameter is
eclipsed by the routine without ever being referenced. As a cross-check I
did try attaching to the target EPROCESS object before calling
PsQueryTotalCycleTimeProcess() with no obvious change in behavior.
I’m looking at Win8.1 x86/x64 here.
So. Is PsQueryTotalCycleTimeProcess() just a lie?
Is there a better mechanism to determine if Ob callbacks are within the
context of NtCreateUserProcess() that somebody can suggest?
t.