Disclosure Windows Kernel - Kernel time

To get kernel time, the easy way is to call KeGetCurrentPrcb routine. That's undocument native API.

Using below code segment:PKPRCB Prcb;

ULONG ulKeTime = 0;

Prcb = KeGetCurrentPrcb();

ulKeTime = Prcb->KernelTime;

The prototype of KeGetCurrentPrcb is
KPRCB* KeGetCurrentPrcb ( VOID )

Now, let's take a look at its code. It mainly has three rows instruction.

{

ULONG Value;

__asm mov eax, fs:[20h] //

__asm mov [Value], eax

return (struct _KPRCB *) Value;

}