1996 CH10 11/19/99 12:27 PM Page 1

10
Time

The system services described in this chapter are loosely concerned with time and
timing.

ZwQuerySystemTime
ZwQuerySystemTime retrieves the system time.
NTSYSAPI
NTSTATUS
NTAPI
ZwQuerySystemTime(
OUT PLARGE_INTEGER CurrentTime
);

Parameters
CurrentTime
Points to a variable that receives the current time of day in the standard time format
(that is, the number of 100-nanosecond intervals since January 1, 1601).

Return Value
Returns STATUS_SUCCESS or an error status.

Related Win32 Functions

None.

Remarks
GetSystemTime and GetSystemTimeAsFileTime read from the KUSER_SHARED_DATA page.
This page is mapped read-only into the user mode range of the virtual address and
read-write in the kernel range.The system clock tick updates the system time, which
is stored in this page directly. Reading the system time from this page is faster than
calling ZwQuerySystemTime.
The KUSER_SHARED_DATA structure is defined in the Windows 2000 versions of ntddk.h.
1996 CH10 11/19/99 12:27 PM Page 2

2 Time: ZwSetSystemTime

ZwSetSystemTime
ZwSetSystemTime sets the system time.
NTSYSAPI
NTSTATUS
NTAPI
ZwSetSystemTime(
IN PLARGE_INTEGER NewTime,
OUT PLARGE_INTEGER OldTime OPTIONAL
);

Parameters
NewTime
Points to a variable that specifies the new time of day in the standard time format (that
is, the number of 100-nanosecond intervals since January 1, 1601).

OldTime
Optionally points to a variable that receives the old time of day in the standard time
format (that is, the number of 100-nanosecond intervals since January 1, 1601).

Return Value
Returns STATUS_SUCCESS or an error status, such as STATUS_PRIVILEGE_NOT_HELD.

Related Win32 Functions

SetSystemTime.

Remarks
SeSystemtimePrivilege is required to set the system time.

ZwQueryPerformanceCounter
ZwQueryPerformanceCounter retrieves information from the high-resolution
performance counter.
NTSYSAPI
NTSTATUS
NTAPI
ZwQueryPerformanceCounter(
OUT PLARGE_INTEGER PerformanceCount,
OUT PLARGE_INTEGER PerformanceFrequency OPTIONAL
);

Parameters
PerformanceCount
Points to a variable that receives the current value of the performance counter.
1996 CH10 11/19/99 12:27 PM Page 3

Time: ZwSetTimerResolution 3

PerformanceFrequency
Optionally points to a variable that receives the frequency of the performance counter
in units of counts per second.

Return Value
Returns STATUS_SUCCESS or an error status.

Related Win32 Functions

QueryPerformanceCounter, QueryPerformanceFrequency.

Remarks
Collectively QueryPerformanceCounter and QueryPerformanceFrequency expose the full
functionality of ZwQueryPerformanceCounter.

ZwSetTimerResolution
ZwSetTimerResolution sets the resolution of the system timer.
NTSYSAPI
NTSTATUS
NTAPI
ZwSetTimerResolution(
IN ULONG RequestedResolution,
IN BOOLEAN Set,
OUT PULONG ActualResolution
);

Parameters
RequestedResolution
The requested timer resolution in units of 100-nanoseconds.

Set
Specifies whether the requested resolution should be established or revoked.

ActualResolution
Points to a variable that receives the actual timer resolution in units of
100-nanoseconds.

Return Value
Returns STATUS_SUCCESS or an error status, such as STATUS_TIMER_RESOLUTION_NOT_SET.

Related Win32 Functions

timeBeginPeriod, timeEndPeriod.

Remarks
None.
1996 CH10 11/19/99 12:27 PM Page 4

4 Time: ZwQueryTimerResolution

ZwQueryTimerResolution
ZwQueryTimerResolution retrieves information about the resolution of the system
timer.
NTSYSAPI
NTSTATUS
NTAPI
ZwQueryTimerResolution(
OUT PULONG CoarsestResolution,
OUT PULONG FinestResolution,
OUT PULONG ActualResolution
);

Parameters
CoarsestResolution
Points to a variable that receives the coarsest timer resolution, which can be set in
units of 100-nanoseconds.

FinestResolution
Points to a variable that receives the finest timer resolution, which can be set in units
of 100-nanoseconds.

ActualResolution
Points to a variable that receives the actual timer resolution in units of
100-nanoseconds.

Related Win32 Functions

None.

Remarks
None.

ZwDelayExecution
ZwDelayExecution suspends the execution of the current thread for a specified interval.
NTSYSAPI
NTSTATUS
NTAPI
ZwDelayExecution(
IN BOOLEAN Alertable,
IN PLARGE_INTEGER Interval
);

Parameters
Alertable
A boolean specifying whether the delay can be interrupted by the delivery of
a user APC.
1996 CH10 11/19/99 12:27 PM Page 5

Time: ZwGetTickCount 5

Interval
Points to a value that specifies the absolute or relative time at which the delay is to
end. A negative value specifies an interval relative to the current time.The value is
expressed in units of 100 nanoseconds. Absolute times track any changes in the system
time; relative times are not affected by system time changes.

Return Value
Returns STATUS_SUCCESS, STATUS_ALERTED, STATUS_USER_APC, or an error status.

Related Win32 Functions

Sleep, SleepEx.

Remarks
SleepEx exposes most of the functionality of ZwDelayExecution.

ZwYieldExecution
ZwYieldExecution yields the use of the processor by the current thread to any other
thread that is ready to use it.
NTSYSAPI
NTSTATUS
NTAPI
ZwYieldExecution(
VOID
);

Parameters
None

Return Value
Returns STATUS_SUCCESS or STATUS_NO_YIELD_PERFORMED.

Related Win32 Functions

SwitchToThread.

Remarks
SwitchToThread exposes the full functionality of ZwYieldExecution.

ZwGetTickCount
ZwGetTickCount retrieves the number of milliseconds that have elapsed since the system
booted.
NTSYSAPI
ULONG
NTAPI
ZwGetTickCount(
VOID
);
1996 CH10 11/19/99 12:27 PM Page 6

6 Time: ZwGetTickCount

Parameters
None.

Return Value
Returns the number of milliseconds that have elapsed since the system was booted.

Related Win32 Functions

None.

Remarks
GetTickCount reads from the KUSER_SHARED_DATA page.This page is mapped read-only
into the user mode range of the virtual address and read-write in the kernel range.The
system clock tick updates the system tick count, which is stored in this page directly.
Reading the tick count from this page is faster than calling ZwGetTickCount.
The KUSER_SHARED_DATA structure is defined in the Windows 2000 versions of ntddk.h.