ExtendedTools: Fix bug querying network usage for exited processes
@@ -251,34 +251,43 @@ VOID NTAPI EtEtwProcessesUpdatedCallback(
!PhGetOwnTokenAttributes().Elevated
)
{
- PSYSTEM_PROCESS_INFORMATION process;
+ PVOID processesCache;
+ PLIST_ENTRY listEntry;
- if (!(process = PhGetProcessInformationCache()))
+ if (!(processesCache = PhGetProcessInformationCache()))
return;
- do
- {
- PPH_PROCESS_ITEM processItem;
-
- processItem = PhReferenceProcessItem(process->UniqueProcessId);
+ // Note: no lock is needed because we only ever modify the list on this same thread.
- if (!processItem)
- processItem = PhReferenceProcessItem(SYSTEM_PROCESS_ID);
+ listEntry = EtProcessBlockListHead.Flink;
- if (processItem)
+ while (listEntry != &EtProcessBlockListHead)
{
- PSYSTEM_PROCESS_INFORMATION_EXTENSION processExtension;
PET_PROCESS_BLOCK block;
+ PSYSTEM_PROCESS_INFORMATION processInfo;
+ PSYSTEM_PROCESS_INFORMATION_EXTENSION processExtension;
+ ULONG64 diskReadRaw = 0;
+ ULONG64 diskWriteRaw = 0;
+ ULONG64 networkReceiveRaw = 0;
- if (!(processExtension = PH_PROCESS_EXTENSION(process)))
- break;
- if (!(block = EtGetProcessBlock(processItem)))
- break;
+ block = CONTAINING_RECORD(listEntry, ET_PROCESS_BLOCK, ListEntry);
+
+ if (processInfo = PhFindProcessInformation(processesCache, block->ProcessItem->ProcessId))
+ {
+ if (processExtension = PH_PROCESS_EXTENSION(processInfo))
+ {
+ diskReadRaw = processExtension->DiskCounters.BytesRead;
+ diskWriteRaw = processExtension->DiskCounters.BytesWritten;
+ networkReceiveRaw = processExtension->EnergyValues.NetworkTxRxBytes;
+ }
+ }
- block->DiskReadRaw = processExtension->DiskCounters.BytesRead;
- block->DiskWriteRaw = processExtension->DiskCounters.BytesWritten;
- block->NetworkSendRaw = 0;
- block->NetworkReceiveRaw = processExtension->EnergyValues.NetworkTxRxBytes;
+ if (block->DiskReadRaw < diskReadRaw)
+ block->DiskReadRaw = diskReadRaw;
+ if (block->DiskWriteRaw < diskWriteRaw)
+ block->DiskWriteRaw = diskWriteRaw;
+ if (block->NetworkReceiveRaw < networkReceiveRaw)
+ block->NetworkReceiveRaw = networkReceiveRaw;
PhUpdateDelta(&block->DiskReadRawDelta, block->DiskReadRaw);
PhUpdateDelta(&block->DiskWriteRawDelta, block->DiskWriteRaw);
@@ -289,6 +298,8 @@ VOID NTAPI EtEtwProcessesUpdatedCallback(
{
block->DiskReadRawDelta.Delta = 0;
block->DiskWriteRawDelta.Delta = 0;
+ block->NetworkSendRawDelta.Delta = 0;
+ block->NetworkReceiveRawDelta.Delta = 0;
block->HaveFirstSample = TRUE;
}
@@ -317,11 +328,9 @@ VOID NTAPI EtEtwProcessesUpdatedCallback(
PhAddItemCircularBuffer_ULONG64(&block->NetworkReceiveHistory, block->CurrentNetworkReceive);
}
- PhDereferenceObject(processItem);
+ listEntry = listEntry->Flink;
}
- } while (process = PH_NEXT_PROCESS(process));
-
if (maxDiskBlock)
{
PhAddItemCircularBuffer_ULONG(&EtMaxDiskHistory, HandleToUlong(maxDiskBlock->ProcessItem->ProcessId));
