-2

In my driver I need it to wait for about 30 seconds. I want to use KeQueryTickCount to do that. Right now all I want to do is get a proper return value from the function which I cannot do. Here is what I've tried:

// this causes bsod
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject,PUNICODE_STRING pRegistryPath)
{
    PLARGE_INTEGER TickCount1 = NULL;
    KeQueryTickCount(TickCount1);
}

And then...

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject,PUNICODE_STRING pRegistryPath)
{
    PLARGE_INTEGER TickCount1 = NULL;
    KeQueryTickCount(&TickCount1);
}
// this generates compiler error:
//Left of '->HighPart' must point to struct/union

The only other similar question I could find is : Windows Driver Timestamp function

So I tried this:

#if defined(MIDL_PASS)
typedef struct _LARGE_INTEGER {
#else // MIDL_PASS
typedef union _LARGE_INTEGER {
    struct {
        ULONG LowPart;
        LONG HighPart;
    } DUMMYSTRUCTNAME;
struct {
    ULONG LowPart;
    LONG HighPart;
} u;
#endif //MIDL_PASS
    LONGLONG QuadPart;
} LARGE_INTEGER;
// This generates this error
//'_LARGE_INTEGER' : 'union' type redefinition

My compiler is MS DDK 7600.16385.1 x86 free build environment win 7

Can anyone show me a full working code sample for this function, or what full working code should look like to call this API? Thank you for your help.

EDIT - Here is the proper answer to this:

for (i = 0; i < 30*1000*20; i++)
{
    KeStallExecutionProcessor(50);
}
7
  • 1
    You want to wait for 30 seconds in a driver? Dec 8, 2013 at 0:46
  • 1
    If you can't work out how to call this function from the msdn docs, then I suggest that you might be out of your depth working in kernel mode. I'd recommend doing some user mode Windows programming first.
    – Stewart
    Dec 9, 2013 at 14:04
  • @MartinJames: "You want to wait for 30 seconds in a driver?" That must have been the funniest quote I've read in a while. :-)
    – Damon
    Dec 9, 2013 at 17:06
  • Stewart, before commenting again you should understand that many of these kernel functions have no reliable documentation. Dec 13, 2013 at 15:23
  • Um - this one does. It is linked in my answer. If a kernel mode function is not reliably documented on MSDN (which is very good by the way) then it is probably not meant to be called.
    – Stewart
    Dec 16, 2013 at 11:05

1 Answer 1

1

The right way to call it is as follows:-

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject,PUNICODE_STRING pRegistryPath)
{
    LARGE_INTEGER TickCount1 = {};
    KeQueryTickCount(&TickCount1);
}

@Martin James is quite right however - waiting 30 seconds in a driver by spinning on the tick count is a bad idea.

http://msdn.microsoft.com/en-us/library/windows/hardware/ff553071(v=vs.85).aspx is the documentation for the function

7
  • 1
    To be fair, the OP doesn't say he's planning to spin. He may just mean that he's going to record the tick count at some point, and later on compare it to see whether 30 seconds have passed. Dec 10, 2013 at 20:58
  • @HarryJohnston - quite true.
    – Stewart
    Dec 11, 2013 at 10:14
  • This still causes a crash Dec 13, 2013 at 15:22
  • Stewart, in every full program I've seen using this function, there are dependent structs which you seem to not include. I've included a way that actually works and not just copy/pasted from some where in my main question, but thanks for trying ; ) Dec 13, 2013 at 15:26
  • Sorry, I'm not at all clear what you're saying here. I did copy and paste the code from your question - then I fixed it. There is nothing wrong with the code above. Your question was "How do I call KeQueryTickCount" if I'm not mistaken. What you've added is some unrelated code about how to spin in a driver, which is a terrible terrible terrible idea by the way.
    – Stewart
    Dec 16, 2013 at 11:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.