诺基亚9900概念手机
2008年8月4日星期一
2008年6月23日星期一
Disclosure Windows Kernel - Kernel time
To get kernel time, the easy way is to call KeGetCurrentPrcb routine. That's undocument native API.
Using below code segment:PKPRCB Prcb;
ULONG ulKeTime = 0;
Prcb = KeGetCurrentPrcb();
ulKeTime = Prcb->KernelTime;
The prototype of KeGetCurrentPrcb is
KPRCB* KeGetCurrentPrcb ( VOID )
Now, let's take a look at its code. It mainly has three rows instruction.
{
ULONG Value;
__asm mov eax, fs:[20h] //
__asm mov [Value], eax
return (struct _KPRCB *) Value;
}
订阅:
博文 (Atom)
