public void AddChildJob(JobObject job) { if (_childJobs == null) { _childJobs = new List <JobObject>(2); } _childJobs.Add(job); }
public unsafe void BuildJobTree() { foreach (var job in _jobs.Values) { job.Dispose(); } _rootJobs.Clear(); _jobs.Clear(); if (_ejobDescription == null) { BuildEjobDescription(); } var jobs = _driver.EnumJobs(); var bytes = stackalloc byte[512]; var pString = (UnicodeString *)bytes; int status; int processCount; int jobIdOffset = _ejobDescription.GetOffsetOf("JobId"); int jobParentOffset = _ejobDescription.GetOffsetOf("ParentJob"); var jobIdBuffer = new byte[4]; foreach (var jobObject in jobs) { var handle = jobObject.Handle; status = NtQueryObject(handle, ObjectInformationClass.ObjectNameInformation, pString, 512); processCount = GetJobProcessCount(handle); var job = new JobObject(handle, jobObject.Address, status == 0 ? new string(pString->Buffer) : null, processCount); if (jobIdOffset >= 0 && _driver.ReadMemory(UIntPtr.Add(jobObject.Address, jobIdOffset), jobIdBuffer)) { job.JobId = BitConverter.ToInt32(jobIdBuffer, 0); } _jobs.Add(jobObject.Address, job); } if (jobParentOffset >= 0) { // nested jobs supported (Windows 8+) foreach (var jobObject in jobs) { // get parent job var parentJobAddress = UIntPtr.Add(jobObject.Address, jobParentOffset); var parentPointer = new byte[IntPtr.Size]; _driver.ReadMemory(parentJobAddress, parentPointer); var parentAddress = new UIntPtr(BitConverter.ToUInt64(parentPointer, 0)); var job = _jobs[jobObject.Address]; if (parentAddress != UIntPtr.Zero) { var parentJob = _jobs[parentAddress]; job.Parent = parentJob; parentJob.AddChildJob(job); } else { _rootJobs.Add(job); } } } }