timeGetTime versus KeQueryInterruptTime

Is KeQueryInterruptTime equivalent to timeGetTime?

By "equivalent" I don't mean that they return the same value or the
same units; I am asking if they are derived from the same physical
clock. To put it another way, if you made repeated calls to both
functions over time, would you see drift between the two or would they
remain in sync?

I found an entry in Larry Osterman's blog where he states that
"timeGetTime() reads a field called the "interrupt time", which is
updated periodically by the kernel". While this is not quite
definitive documentation, it does strongly suggest that the two are
equivalent.

Matt Gonzalez <> wrote:
>
>Is KeQueryInterruptTime equivalent to timeGetTime?
>
>By "equivalent" I don't mean that they return the same value or the
>same units; I am asking if they are derived from the same physical
>clock. To put it another way, if you made repeated calls to both
>functions over time, would you see drift between the two or would they
>remain in sync?
>
>I found an entry in Larry Osterman's blog where he states that
>"timeGetTime() reads a field called the "interrupt time", which is
>updated periodically by the kernel". While this is not quite
>definitive documentation, it does strongly suggest that the two are
>equivalent.

Disassembly reveals the answer. timeGetTime() returns the qword at
0x7FFE0008. KeQueryInterruptTime() returns the qword at 0xFFDF0008.

Both addresses point to the same physical address.
--
Tim Roberts,
Providenza & Boekelheide, Inc.

Tim Roberts wrote:
> Matt Gonzalez <> wrote:
>> Is KeQueryInterruptTime equivalent to timeGetTime?
>>
>> By "equivalent" I don't mean that they return the same value or the
>> same units; I am asking if they are derived from the same physical
>> clock. To put it another way, if you made repeated calls to both
>> functions over time, would you see drift between the two or would they
>> remain in sync?
>>
>> I found an entry in Larry Osterman's blog where he states that
>> "timeGetTime() reads a field called the "interrupt time", which is
>> updated periodically by the kernel". While this is not quite
>> definitive documentation, it does strongly suggest that the two are
>> equivalent.
>
> Disassembly reveals the answer. timeGetTime() returns the qword at
> 0x7FFE0008. KeQueryInterruptTime() returns the qword at 0xFFDF0008.
>
> Both addresses point to the same physical address.

Thank you, Tim, for taking the time to look into that. That's just what
I need.