1

Currently Sleep takes a single DWORD (32bit) for time. Is there any alternative which takes DWORDLONG (64bit)?

I'm using RNG in which with every additional byte added the overall wait time increases. With 32bit integer the overall time is 5 minutes and I want to increase it.

12
  • 8
    No, but why would you want to sleep longer than 49.7 days? Feb 7, 2019 at 21:06
  • 3
    well, it's restful, for starters Feb 7, 2019 at 21:06
  • 2
    I didn't get the connection to random.org.
    – Eugene Sh.
    Feb 7, 2019 at 21:10
  • 1
    NtDelayExecution take PLARGE_INTEGER DelayInterval so 64 bit value. which also can be absolute or relative (from current time)
    – RbMm
    Feb 7, 2019 at 21:12
  • 3
    It sounds more and more like some crazy XY-problem.
    – Eugene Sh.
    Feb 7, 2019 at 21:21

3 Answers 3

8

Sleep[Ex] internal call NtDelayExecution - undocumented but exist in all windows nt versions (from nt 4 to win 10) - exported by ntdll.dll - use ntdll.lib or ntdllp.lib from wdk. as result of this call in kernel will be called documented function KeDelayExecutionThread

//extern "C"
NTSYSAPI 
NTSTATUS
NTAPI
NtDelayExecution(
  IN BOOLEAN              Alertable,
  IN PLARGE_INTEGER       Interval );
  • Alertable

Specifies TRUE if the wait is alertable. Lower-level drivers should specify FALSE.

  • Interval

Specifies the absolute or relative time, in units of 100 nanoseconds, for which the wait is to occur. A negative value indicates relative time. Absolute expiration times track any changes in system time; relative expiration times are not affected by system time changes.

Sleep[Ex] is win32 shell, over this native api, which restrict interval value (from 64 to 32 bit) can not set absolute time (possible with NtDelayExecution) and ignore alerts (we can exit from NtDelayExecution via alert thread if wait alertable)

so you can direct call this api instead indirect via Sleep[Ex]

so Sleep(dwMilliseconds) is call SleepEx(dwMilliseconds, false)

SleepEx(dwMilliseconds, bAlertable) 

call

LARGE_INTEGER  Interval;
Interval.QuadPart = -(dwMilliseconds * 10000);
NtDelayExecution(bALertable, &Interval);

note that in case alertable wait it can be broken via apc (api return STATUS_USER_APC) or via alert ( STATUS_ALERTED will be returned. we can alert thread via NtAlertThread). the SleepEx check returned status and in case STATUS_ALERTED - again begin wait with updated interval. so SleepEx wait can not be broken via alert (NtAlertThread) but NtDelayExecution can

5
  • What does negative value means again? Feb 7, 2019 at 21:35
  • @AnArrayOfFunctions - negative value means relative time. so exactly which Sleep use only 64 bit. say if you want wait 1 second - set DelayInterval.QuadPart = -10000000 if want wait infinite - DelayInterval.QuadPart = 0x8000000000000000
    – RbMm
    Feb 7, 2019 at 21:37
  • 1
    @AnArrayOfFunctions - in any case in kernel finally called documented function KeDelayExecutionThread - read here about Interval parameter
    – RbMm
    Feb 7, 2019 at 22:28
  • Btw what are you saying about APC - I'm specifying bAlertable to be false. Also what's the difference between KeDelayExecutionThread and ZwDelayExecution? Feb 12, 2019 at 21:11
  • @AnArrayOfFunctions - if you set bAlertable to false - your wait can not be broken by apc or alert (this is not apc). NtDelayExecution in user mode - this is stub for NtDelayExecution in kernel mode. this api call KeDelayExecutionThread. look github.com/Zer0Mem0ry/ntoskrnl/blob/master/Ex/delay.c
    – RbMm
    Feb 12, 2019 at 21:20
2

Sleep() takes milliseconds. The max DWORD value, 4294967295, will result in a timeout period of 49.7 days. For most purposes, that's a good enough maximum value, but if you're that determined to have a 64-bit sleep parameter, you can chain multiple Sleep() calls together. This will change the maximum number of milliseconds that you can Sleep() for to 18446744073709551615, which is roughly 600 million years:

VOID WINAPI Sleep64(DWORDLONG dwlMilliseconds)
{
    while (dwlMilliseconds)
    {
        DWORD dwSleepTime = min(0xFFFFFFFE, dwlMilliseconds);
        Sleep(dwSleepTime);
        dwlMilliseconds -= dwSleepTime;
    }
}

I have tested this and can verify that it works.

2
1

Is there any alternative which takes DWORDLONG (64bit)?

No. You'll need multiple calls to Sleep, in a loop.

Have fun testing and debugging multi-month sleep.

5
  • or call NtDelayExecution
    – RbMm
    Feb 7, 2019 at 21:11
  • Argh, there's always an undocumented API that you know about, @RbMm ;-) Feb 7, 2019 at 21:12
  • but Sleep[Ex] internal call NtDelayExecution. this is win32 shell over this native api which restrict interval value (from 64 to 32 bit) can not set absolute time (possible with NtDelayExecution) and ignore alerts (we can exit from NtDelayExecution via alert thread if wait alertable)
    – RbMm
    Feb 7, 2019 at 21:14
  • 1
    @RbMm I guess you didn't appreciate my humour. Oh well. Feb 7, 2019 at 22:58
  • sorry. simply dont know what need say here :)
    – RbMm
    Feb 7, 2019 at 23:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.