Почему Process.TotalProcessorTime не работает для удаленных процессов.

?????? ?? ?????:

??????? ??????????. ???? ??? ????? ?????, ?????? ????????? ???? ?? ??? ??????? https://msdn.microsoft.com/en-us/library/system.diagnostics.process.totalprocessortime.aspx. ???????, ??? ??? ????? ???????? ?????? ????????. ? ??????? ??-?? ?????, ??????, ?? ???????? ????????? ????????? get-process, ????? ?? ????????? ????????? ???????? ????????? ??????. ?????? ????????, ?? ????????. ??????? CPU(s) ? ??? ????? ??????.

???????? ?????: ?? ???? ?????????, ??????, ??? ?????? ??????? ?? ???????? ????? HKEY_PERFORMANCE_DATA.

??????? ?????: ? .NET ? ??????????? ?? ????? ?????. ?????? ?????, ??? ???????? ????? ???????????? ??? IL (intermediate language) ? ?????????? ?? ???, ??? ? ?????? ?? ??????. Ildasm.exe ?????? ? ?????? SDK, ?? ???? ? ?????? ????????, - ???????? ReSharper.

 Ildasm.exe c:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll

IL ?????????? ?????, ????? ??????, ?? ?????????? ? ????????????. ???????? ??????? ??????? ? ???, ? ??????????? ? ???????? ??? ???-?? ??? ?? ???????????. ???????????? ??? ????? ????? ?????:

 .method public hidebysig specialname instance valuetype [mscorlib]System.TimeSpan
get_TotalProcessorTime() cil managed
{
 // Code size 19 (0x13)
 .maxstack 8
 IL_0000: ldarg.0
 IL_0001: ldc.i4.4
 IL_0002: call instance void System.Diagnostics.Process::EnsureState(valuetype System.Diagnostics.Process/State)
 IL_0007: ldarg.0
 IL_0008: call instance class System.Diagnostics.ProcessThreadTimes System.Diagnostics.Process::GetProcessTimes()
 IL_000d: callvirt instance valuetype [mscorlib]System.TimeSpan System.Diagnostics.ProcessThreadTimes::get_TotalProcessorTime()
 IL_0012: ret
} // end of method Process::get_TotalProcessorTime

????? Process::GetProcessTimes() ?????????? ??????????? ????????? ProcessThreadTimes, ??????????, ????? ????? ???????, ??? ??????????? ???????? user time ? kernel time. ??????????? ????? ProcessThreadTimes::get_TotalProcessorTime() ?????? ?????????? ??? ??? ???????? ? ?????????? ?????????? ?????????.

???? ????????? ?? Process::GetProcessTimes(), ?? ?????, ??? ??? ?????? ???????? Win32 ??????? GetProcessTimes() ? ?????????? ?????????? ???????? kernel ? user time ? ???????????? ?????????:

 ...
IL_0059: ldflda int64 System.Diagnostics.ProcessThreadTimes::create
IL_005e: ldloc.0
IL_005f: ldflda int64 System.Diagnostics.ProcessThreadTimes::exit
IL_0064: ldloc.0
IL_0065: ldflda int64 System.Diagnostics.ProcessThreadTimes::kernel
IL_006a: ldloc.0
IL_006b: ldflda int64 System.Diagnostics.ProcessThreadTimes::user
IL_0070: call bool Microsoft.Win32.NativeMethods::GetProcessTimes(class Microsoft.Win32.SafeHandles.SafeProcessHandle,
  int64&,
  int64&,
  int64&,
  int64&)
...

??????? GetProcessTimes() ???????? ?????? ??? ????????? ?????????, ??? ??? ?????????????? ??????? ?? ??????????? NT handle. ????????? ?????? ?? ?????-?????? ?????? ????????, ??????? ????????, ? ??? ?????, ? ??? ????????? ?????????. ? ???????, ?? Process.HandleCount:

 .method public hidebysig specialname instance int32
get_HandleCount() cil managed
{
 // Code size 19 (0x13)
 .maxstack 8
 IL_0000: ldarg.0
 IL_0001: ldc.i4.8
 IL_0002: call instance void System.Diagnostics.Process::EnsureState(valuetype System.Diagnostics.Process/State)
 IL_0007: ldarg.0
 IL_0008: ldfld class System.Diagnostics.ProcessInfo System.Diagnostics.Process::processInfo
 IL_000d: ldfld int32 System.Diagnostics.ProcessInfo::handleCount
 IL_0012: ret
} // end of method Process::get_HandleCount

? ???? ?????? ???????? ??????? ?? ????????? ProcessInfo, ???????, ?? ???? ?????????, ??????????? ??????? EnsureState(). ?????????, ? ???? ???????, ?????? ????????? ?? ??????????? ? ???? ???????? ? ???????? ProcessManager::GetProcessInfos(), ????? ???????? ???????? ?????????. ??? ????? ???? ??????? ??????????? ?????????? ???????, ??? ?????????? ?? ????????? ????????? ?????????? ????? ????? NtProcessManager, ??????? ?????? ???????? ?? HKEY_PERFORMANCE_DATA ????????? ??????. ????????? ? ????, ??????? ? ????? ?????????? ???????? ??? ???:

 .method private hidebysig static class System.Diagnostics.ProcessInfo[]
GetProcessInfos(class System.Diagnostics.PerformanceCounterLib 'library') cil managed
{
 ...
 IL_000e: ldstr "230 232"
 IL_0013: callvirt instance uint8[] System.Diagnostics.PerformanceCounterLib::GetPerformanceData(string)
 IL_0018: stloc.1

??? PerformanceCounterLib ??????? ???? ?? ????. ? ????????? 230 – ??? ????????????? ??????? Process ?? HKEY_PERFORMANCE_DATA.

  .locals init (class [mscorlib]System.Collections.Hashtable V_0,
 class [mscorlib]System.Collections.ArrayList V_1,
 valuetype [mscorlib]System.Runtime.InteropServices.GCHandle V_2,
 native int V_3,
 class Microsoft.Win32.NativeMethods/PERF_DATA_BLOCK V_4,
 native int V_5,
 class Microsoft.Win32.NativeMethods/PERF_INSTANCE_DEFINITION V_6,
 class Microsoft.Win32.NativeMethods/PERF_COUNTER_BLOCK V_7,
 int32 V_8,
 class Microsoft.Win32.NativeMethods/PERF_OBJECT_TYPE V_9,
 native int V_10,
 native int V_11,
 class [mscorlib]System.Collections.ArrayList V_12,
 int32 V_13,
 class Microsoft.Win32.NativeMethods/PERF_COUNTER_DEFINITION V_14,
 string V_15,
 class Microsoft.Win32.NativeMethods/PERF_COUNTER_DEFINITION[] V_16,

????????? PERF_DATA_BLOCK, PERF_INSTANCE_DEFINITION ? ?.?. ????? ????????? ?????????? winperf.h
??????????, ??? ?????????? ?? ????????? ????????? ???????? ?? HKEY_PERFORMANCE_DATA ????????? ??????. ?????? ?? ?????? ????? ????? ????????? ?????, ??????????? ????????? ? user ? kernel mode? ?????? ??????, ??? ??? ???????? ?? ???????? ????? HKEY_PERFORMANCE_DATA. ??? ????? ???????? ???????? ??? ????????:

 230 Process
 144 % Privileged Time
 6 % Processor Time
 142 % User Time
 1410 Creating Process ID
 684 Elapsed Time
 952 Handle Count
 784 ID Process
 1424 IO Data Bytes/sec
 1416 IO Data Operations/sec
 1426 IO Other Bytes/sec
 1418 IO Other Operations/sec
 1420 IO Read Bytes/sec
 1412 IO Read Operations/sec
 1422 IO Write Bytes/sec
 1414 IO Write Operations/sec
 28 Page Faults/sec
 182 Page File Bytes Peak
 184 Page File Bytes
 58 Pool Nonpaged Bytes
 56 Pool Paged Bytes
 682 Priority Base

???????? ????????, ??? “Privileged Time” ? “User Time” ?????????? ?????????. ?.?. ????????? ??????? ????????????? ????????? CPU, ? ?? ????? ?????, ??????????? ????????? ? ????? ???????.

Cross-posted from blog.not-a-kernel-guy.com.