static PPH_PROCESS_RECORD PhSipReferenceMaxCpuRecord( _In_ LONG Index ) { LARGE_INTEGER time; ULONG maxProcessId; // Find the process record for the max. CPU process for the particular time. maxProcessId = PhGetItemCircularBuffer_ULONG(SystemStatistics.MaxCpuHistory, Index); if (!maxProcessId) return NULL; // Note that the time we get has its components beyond seconds cleared. // For example: // * At 2.5 seconds a process is started. // * At 2.75 seconds our process provider is fired, and the process is determined // to have 75% CPU usage, which happens to be the maximum CPU usage. // * However the 2.75 seconds is recorded as 2 seconds due to // RtlTimeToSecondsSince1980. // * If we call PhFindProcessRecord, it cannot find the process because it was // started at 2.5 seconds, not 2 seconds or older. // // This mean we must add one second minus one tick (100ns) to the time, giving us // 2.9999999 seconds. This will then make sure we find the process. PhGetStatisticsTime(NULL, Index, &time); time.QuadPart += PH_TICKS_PER_SEC - 1; return PhFindProcessRecord(UlongToHandle(maxProcessId), &time); }
PPH_PROCESS_RECORD EtpReferenceMaxNodeRecord( __in LONG Index ) { LARGE_INTEGER time; ULONG maxProcessId; maxProcessId = PhGetItemCircularBuffer_ULONG(&EtMaxGpuNodeHistory, Index); if (!maxProcessId) return NULL; PhGetStatisticsTime(NULL, Index, &time); time.QuadPart += PH_TICKS_PER_SEC - 1; return PhFindProcessRecord((HANDLE)maxProcessId, &time); }
static PPH_PROCESS_RECORD PhSipReferenceMaxIoRecord( _In_ LONG Index ) { LARGE_INTEGER time; ULONG maxProcessId; // Find the process record for the max. I/O process for the particular time. maxProcessId = PhGetItemCircularBuffer_ULONG(SystemStatistics.MaxIoHistory, Index); if (!maxProcessId) return NULL; // See above for the explanation. PhGetStatisticsTime(NULL, Index, &time); time.QuadPart += PH_TICKS_PER_SEC - 1; return PhFindProcessRecord(UlongToHandle(maxProcessId), &time); }