timeGetTime versus KeQueryInterruptTime

Discussion in 'Windows Vista Drivers' started by Matt Gonzalez, Dec 12, 2007.

  1. Is KeQueryInterruptTime equivalent to timeGetTime?

    By "equivalent" I don't mean that they return the same value or the
    same units; I am asking if they are derived from the same physical
    clock. To put it another way, if you made repeated calls to both
    functions over time, would you see drift between the two or would they
    remain in sync?

    I found an entry in Larry Osterman's blog where he states that
    "timeGetTime() reads a field called the "interrupt time", which is
    updated periodically by the kernel". While this is not quite
    definitive documentation, it does strongly suggest that the two are
    equivalent.
     
    Matt Gonzalez, Dec 12, 2007
    #1
    1. Advertisements

  2. Matt Gonzalez

    Tim Roberts Guest

    Matt Gonzalez <> wrote:
    >
    >Is KeQueryInterruptTime equivalent to timeGetTime?
    >
    >By "equivalent" I don't mean that they return the same value or the
    >same units; I am asking if they are derived from the same physical
    >clock. To put it another way, if you made repeated calls to both
    >functions over time, would you see drift between the two or would they
    >remain in sync?
    >
    >I found an entry in Larry Osterman's blog where he states that
    >"timeGetTime() reads a field called the "interrupt time", which is
    >updated periodically by the kernel". While this is not quite
    >definitive documentation, it does strongly suggest that the two are
    >equivalent.


    Disassembly reveals the answer. timeGetTime() returns the qword at
    0x7FFE0008. KeQueryInterruptTime() returns the qword at 0xFFDF0008.

    Both addresses point to the same physical address.
    --
    Tim Roberts,
    Providenza & Boekelheide, Inc.
     
    Tim Roberts, Dec 13, 2007
    #2
    1. Advertisements

  3. Tim Roberts wrote:
    > Matt Gonzalez <> wrote:
    >> Is KeQueryInterruptTime equivalent to timeGetTime?
    >>
    >> By "equivalent" I don't mean that they return the same value or the
    >> same units; I am asking if they are derived from the same physical
    >> clock. To put it another way, if you made repeated calls to both
    >> functions over time, would you see drift between the two or would they
    >> remain in sync?
    >>
    >> I found an entry in Larry Osterman's blog where he states that
    >> "timeGetTime() reads a field called the "interrupt time", which is
    >> updated periodically by the kernel". While this is not quite
    >> definitive documentation, it does strongly suggest that the two are
    >> equivalent.

    >
    > Disassembly reveals the answer. timeGetTime() returns the qword at
    > 0x7FFE0008. KeQueryInterruptTime() returns the qword at 0xFFDF0008.
    >
    > Both addresses point to the same physical address.


    Thank you, Tim, for taking the time to look into that. That's just what
    I need.
     
    Matt Gonzalez, Dec 13, 2007
    #3
    1. Advertisements

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.
Similar Threads
  1. sibrecat

    STALKER on XP versus Vista

    sibrecat, Apr 7, 2007, in forum: Windows Vista Games
    Replies:
    6
    Views:
    445
    sibrecat
    Apr 8, 2007
  2. Elliott
    Replies:
    0
    Views:
    745
    Elliott
    Oct 3, 2003
  3. Steve

    KeQueryInterruptTime doesn't seem to work properly!

    Steve, Feb 6, 2004, in forum: Windows Vista Drivers
    Replies:
    1
    Views:
    714
    Maxim S. Shatskih
    Feb 8, 2004
  4. GrahamH

    KeQueryInterruptTime or KeQueryPerformanceCounter

    GrahamH, Sep 13, 2005, in forum: Windows Vista Drivers
    Replies:
    6
    Views:
    1,296
    Doron Holan [MS]
    Sep 16, 2005
  5. KeQueryInterruptTime() issue

    , Dec 21, 2007, in forum: Windows Vista Drivers
    Replies:
    2
    Views:
    779
    Tim Roberts
    Dec 23, 2007
  6. mc

    8.5 versus 2008 versus 9

    mc, Feb 4, 2008, in forum: Windows Live Messenger
    Replies:
    3
    Views:
    592
    Jonathan Kay [MVP]
    Feb 11, 2008
  7. Joe Murphy
    Replies:
    0
    Views:
    1,248
    Joe Murphy
    Oct 1, 2007
  8. Werner De Kuyffer

    Enterprise Admins versus Domain Admins versus Schema Admins

    Werner De Kuyffer, Nov 26, 2009, in forum: Server Security
    Replies:
    1
    Views:
    7,701
    Meinolf Weber [MVP-DS]
    Nov 26, 2009
Loading...