How to retrieve CPU time of a thread inside kernel?

NTFSD
1

From my legacy driver, I’m calling PsCreateSystemThread API to create few threads. Since this call is happening from inside the kernel, these new created threads will run in the context of System process.

My question is given the handle to these threads, is there any API using which I can fetch their CPU time? I’m interested in the pure CPU time for which thread was actually doing something(it shouldn’t include thread’s wait time, similar to kerneltime that we get by calling GetProcessTimes). I know there’s an API called GetThreadTimes but that is from User mode, I want CPU time inside the kernel i.e. in my driver.

Thanks

2

struct THREAD_TIMES_INFORMATION {
LARGE_INTEGER CreationTime, ExitTime, KernelTime, UserTime;
};

THREAD_TIMES_INFORMATION tt;

if (0 <= ZwQueryInformationThread(NtCurrentThread(), ThreadTimes, &tt, sizeof(tt), 0))
{
}

3

I couldn’t find any official documentation for this functions.
https://www.google.co.in/search?q=ZwQueryInformationThread+msdn&oq=ZwQUery&aqs=chrome.2.69i59j69i57j69i59j0l3.4421j0j7&sourceid=chrome&es_sm=122&ie=UTF-8

and Visual Studio 2012 also did not find recognize it.
Is there any other way? Something that is genuine.

Thanks

4

No, this is the only way.

Undocumented.

No other ways.

BTW - MS recommends to use work items instead of PsCreateSystemThread where possible.

–
Maxim S. Shatskih
Microsoft MVP on File System And Storage
xxxxx@storagecraft.com
http://www.storagecraft.com

wrote in message news:xxxxx@ntfsd…
>
> I couldn’t find any official documentation for this functions.
> https://www.google.co.in/search?q=ZwQueryInformationThread+msdn&amp;oq=ZwQUery&amp;aqs=chrome.2.69i59j69i57j69i59j0l3.4421j0j7&amp;sourceid=chrome&amp;es_sm=122&amp;ie=UTF-8
>
> and Visual Studio 2012 also did not find recognize it.
> Is there any other way? Something that is genuine.
>
> Thanks
>

5

From inside the thread itself, I can call KeQueryRuntimeThread to get the kernel time right?
KeQueryRuntimeThread() - Gives kernel run time of the current thread in terms of clock ticks.
KeQueryTimeIncrement() - This gives the length of each clock tick.
Got this from following osronline post,

http://www.osronline.com/ShowThread.cfm?link=107408