timeGetTime versus KeQueryInterruptTime

Discussion in 'Windows Vista Drivers' started by Matt Gonzalez, Dec 12, 2007.

  1. Is KeQueryInterruptTime equivalent to timeGetTime?

    By "equivalent" I don't mean that they return the same value or the
    same units; I am asking if they are derived from the same physical
    clock. To put it another way, if you made repeated calls to both
    functions over time, would you see drift between the two or would they
    remain in sync?

    I found an entry in Larry Osterman's blog where he states that
    "timeGetTime() reads a field called the "interrupt time", which is
    updated periodically by the kernel". While this is not quite
    definitive documentation, it does strongly suggest that the two are
    equivalent.
     
    Matt Gonzalez, Dec 12, 2007
    #1
    1. Advertising

  2. Matt Gonzalez

    Tim Roberts Guest

    Matt Gonzalez <> wrote:
    >
    >Is KeQueryInterruptTime equivalent to timeGetTime?
    >
    >By "equivalent" I don't mean that they return the same value or the
    >same units; I am asking if they are derived from the same physical
    >clock. To put it another way, if you made repeated calls to both
    >functions over time, would you see drift between the two or would they
    >remain in sync?
    >
    >I found an entry in Larry Osterman's blog where he states that
    >"timeGetTime() reads a field called the "interrupt time", which is
    >updated periodically by the kernel". While this is not quite
    >definitive documentation, it does strongly suggest that the two are
    >equivalent.


    Disassembly reveals the answer. timeGetTime() returns the qword at
    0x7FFE0008. KeQueryInterruptTime() returns the qword at 0xFFDF0008.

    Both addresses point to the same physical address.
    --
    Tim Roberts,
    Providenza & Boekelheide, Inc.
     
    Tim Roberts, Dec 13, 2007
    #2
    1. Advertising

  3. Tim Roberts wrote:
    > Matt Gonzalez <> wrote:
    >> Is KeQueryInterruptTime equivalent to timeGetTime?
    >>
    >> By "equivalent" I don't mean that they return the same value or the
    >> same units; I am asking if they are derived from the same physical
    >> clock. To put it another way, if you made repeated calls to both
    >> functions over time, would you see drift between the two or would they
    >> remain in sync?
    >>
    >> I found an entry in Larry Osterman's blog where he states that
    >> "timeGetTime() reads a field called the "interrupt time", which is
    >> updated periodically by the kernel". While this is not quite
    >> definitive documentation, it does strongly suggest that the two are
    >> equivalent.

    >
    > Disassembly reveals the answer. timeGetTime() returns the qword at
    > 0x7FFE0008. KeQueryInterruptTime() returns the qword at 0xFFDF0008.
    >
    > Both addresses point to the same physical address.


    Thank you, Tim, for taking the time to look into that. That's just what
    I need.
     
    Matt Gonzalez, Dec 13, 2007
    #3
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Elliott
    Replies:
    0
    Views:
    446
    Elliott
    Oct 3, 2003
  2. Steve

    KeQueryInterruptTime doesn't seem to work properly!

    Steve, Feb 6, 2004, in forum: Windows Vista Drivers
    Replies:
    1
    Views:
    601
    Maxim S. Shatskih
    Feb 8, 2004
  3. GrahamH

    KeQueryInterruptTime or KeQueryPerformanceCounter

    GrahamH, Sep 13, 2005, in forum: Windows Vista Drivers
    Replies:
    6
    Views:
    898
    Doron Holan [MS]
    Sep 16, 2005
  4. KeQueryInterruptTime() issue

    , Dec 21, 2007, in forum: Windows Vista Drivers
    Replies:
    2
    Views:
    472
    Tim Roberts
    Dec 23, 2007
  5. mc

    8.5 versus 2008 versus 9

    mc, Feb 4, 2008, in forum: Windows Live Messenger
    Replies:
    3
    Views:
    310
    Jonathan Kay [MVP]
    Feb 11, 2008
Loading...

Share This Page