Help to find memory I/O functionality inside code

[HackingAllYT]

@dmex I have a question for u.
I'm studying the code of process hacker to develop a tool to know the use of i/o in my disk, without GUI. Something like the panel of 'Disk' but just with two or three processes that my computer is using because i need the information to find bugs in my program. How can i do it?

I cannnot understand how do u get this information and how does it work. I'm block trying to understand what does PhQueryPerformanceCounter in 'util.c' file does to get the information. I've realized that u are using another function to get the information and this function is just to know the timing that the ProcessHacker is being reload.

Any help that u can provide will be very useful. Function to research or any documentation that u have from microsoft apis or even your api tool.

Thank u a lot,
XXX

[jxy-s]

@HackingAllYT I assume you're reviewing the information in etwdisk.c? That is using information provided by the ETW ("Event Tracing for Windows") "Kernel Logger" for "File I/O" to track and measure disk activity. Have a look in etwmon.c to see how the project creates and starts a session for consuming ETW information.

Here are some Microsoft resources on the topic: https://docs.microsoft.com/en-us/windows/win32/etw/about-event-tracing