Do QueryProcessCycleTime and QueryThreadCycleTime include cycles spent in kernel mode?

Do and include cycles spent in kernel mode? Yes, they do. They count cycles spent both in user mode and in kernel mode.
Do and include cycles spent in kernel mode? Yes, they do. They count cycles spent both in user mode and in kernel mode.
Commenter Francisco Moraes wonders whether there is a supported way of getting the command line of another process. Although there are certainly unsupported ways of doing it or ways that work with the assistance of a debugger, there's nothing that is supported for programmatic access to another process's command line, at least nothing provided b...
This is the blog entry that acted as the inspiration for the last topic in my 200 PDC talk. When somebody launches a second copy of your single-instance program, you usually want the second copy to send its command line to the first instance (and deal with the current directory somehow), and then you want the first instance to come to the foreg...
There are any number of bits of information you might want to query from the file system, such as the number of files in a directory or the total size of the files in a directory. Why doesn't the file system keep track of these things? Well, of course, one answer is that it certainly couldn't keep track of every possible fragment of information ...
This is sort of an extreme corollary to Don't save anything you can recalculate. Sure, it sounds like such an obvious principle, but many people fail to understand its consequences. Let's look at the principle again. Don't keep track of information you don't need. I remember being asked to look at a customer's program, and one thing that struck...
Last week, I posed a process shutdown puzzle in honor of National Puzzle Day. Let's see how we did. Part One asked us to explain why the thread no longer exists. That's easy. One of the things that happen inside is that all threads (other than the one calling ) are forcibly terminated in the nastiest way possible. This happens before the noti...
Commenter Mihai wants to know how to show or hide the Quick Launch bar programmatically. That's not something a program should be doing. Whether the Quick Launch bar is shown or hidden is an end user setting, and programs should not be overriding the user's preferences. Explorer consciously does not expose an interface for showing and hiding tas...
In honor of National Puzzle Day, I leave you today with a puzzle based on an actual customer problem. Part One: The customer explains the problem. We have this DLL, and during its startup, it creates a thread with the following thread procedure: DWORD CALLBACK ThreadFunction(void *) { HANDLE HandleArray[2]; HandleArray[0] = SetUpStuff()...
Once upon a time, a long, long time ago, there was a research team inside Microsoft who was working on alternate models for handling input. I don't know what eventually came of that project, and I don't even remember the details of the meeting, but I do remember the punch line, so I'm just going to make up the rest. The research project broke up ...
This is another manifestation of the missing marshaller problem. IContextMenu *pcm; HRESULT hr = psf->GetUIObjectOf(hwnd, 1, &pidl, IID_IContextMenu, NULL, &pcm); // fails with REGDB_E_IIDNOTREG The IContextMenu interface does not have a proxy/stub factory (as of this writing). Recall that shell objects, as a rule, a...