windows kernel 时间

获取系统时间

  LARGE_INTEGER system_time = { 0 };
  LARGE_INTEGER local_time = { 0 };
  TIME_FIELDS local_time_fields = { 0 };

  KeQuerySystemTime(&system_time);
  ExSystemTimeToLocalTime(&system_time, &local_time);
  RtlTimeToTimeFields(&local_time, &local_time_fields);

  DbgPrintEx(0, 0, "%4d-%2d-%2d %2d:%2d:%2d\n", 
    local_time_fields.Year, local_time_fields.Month, local_time_fields.Day,
    local_time_fields.Hour, local_time_fields.Minute, local_time_fields.Second);

暂停线程

#define DELAY_ONE_MICROSEC (-10) // 负值表示相对时间
#define DELAY_ONE_MILLISEC (DELAY_ONE_MICROSEC*1000)

  LARGE_INTEGER interval = { 0 };
  interval.QuadPart = 2 * 1000 * DELAY_ONE_MILLISEC;
  KeDelayExecutionThread(KernelMode, FALSE, &interval);
  DbgPrintEx(0, 0, "hello..\n"); // 暂停2s后打印