RtlGetSystemTimePrecise
INT64 __fastcall RtlGetSystemTimePrecise(){
unsigned __int64 TimeUpdateLock;
INT64 v1;
unsigned __int64 BaselineSystemTimeQpc;
unsigned __int64 QpcSystemTimeIncrement;
unsigned __int8 QpcSystemTimeIncrementShift;
LARGE_INTEGER PerformanceCounter;
__int64 v6;
while( 1 )
{
TimeUpdateLock = KUSER_SHARED_DATA.TimeUpdateLock;
if( (KUSER_SHARED_DATA.TimeUpdateLock & 1) == 0 )
{
v1 = *(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart;
BaselineSystemTimeQpc = KUSER_SHARED_DATA.BaselineSystemTimeQpc;
QpcSystemTimeIncrement = KUSER_SHARED_DATA.QpcSystemTimeIncrement;
QpcSystemTimeIncrementShift = KUSER_SHARED_DATA.QpcSystemTimeIncrementShift;
PerformanceCounter = KeQueryPerformanceCounter(0i64);
if( KUSER_SHARED_DATA.TimeUpdateLock == TimeUpdateLock )
break;
}
_mm_pause();
}
if( PerformanceCounter.QuadPart <= BaselineSystemTimeQpc )
return v1;
v6 = PerformanceCounter.QuadPart - BaselineSystemTimeQpc - 1;
if( QpcSystemTimeIncrementShift )
v6 <<= QpcSystemTimeIncrementShift;
return(((unsigned __int64)v6 * (unsigned __int128)QpcSystemTimeIncrement) >> 64) + v1;
}Referenced by:
EtwGetKernelTraceTimestamp
EtwGetKernelTraceTimestampSilo
EtwpGetLoggerTimeStamp
EtwpReserveTraceBuffer
EtwpTraceSystemInitialization
HalpSetVirtualRtc
KeQuerySystemTimePrecise
KeSetTimer2
KiExecuteAllDpcs
PspInitPhase2
WmiGetClock