PsGetProcessCreateTimeQuadPart routine

The PsGetProcessCreateTimeQuadPart routine returns a LONGLONG value that represents the time at which the process was created.

Syntax


LONGLONG PsGetProcessCreateTimeQuadPart(
  _In_  PEPROCESS Process
);

Parameters

Process [in]

A pointer to the EPROCESS structure that represents the process. Drivers can use the PsGetCurrentProcess and ObReferenceObjectByHandle routines to obtain a pointer to the EPROCESS structure for a process.

Return value

PsGetProcessCreateTimeQuadPart returns the process creation time, in 100-nanosecond intervals, since January 1, 1601. The return value is the same as the value that the KeQuerySystemTime routine returns when the process was created. (Note that if the system time is changed, the value that PsGetProcessCreateTimeQuadPart returns is unaffected.)

Requirements

Version

Available in Windows XP and later versions of Windows.

Header

Ntddk.h (include Wdm.h, Ntddk.h, or Ntifs.h)

Library

Ntoskrnl.lib

IRQL

Any level

See also

KeQuerySystemTime
ObReferenceObjectByHandle
PsGetCurrentProcess

 

 

Send comments about this topic to Microsoft

表示:
© 2014 Microsoft