Edit

PsGetProcessCreateTimeQuadPart function (ntddk.h)

  • Article

The PsGetProcessCreateTimeQuadPart routine returns a LONGLONG value that represents the time at which the process was created.

Syntax

LONGLONG PsGetProcessCreateTimeQuadPart(
  [in] PEPROCESS Process
);

Parameters

[in] Process

A pointer to the EPROCESS structure that represents the process. Drivers can use the PsGetCurrentProcess and ObReferenceObjectByHandle routines to obtain a pointer to the EPROCESS structure for a process.

Return value

PsGetProcessCreateTimeQuadPart returns the process creation time, in 100-nanosecond intervals, since January 1, 1601. The return value is the same as the value that the KeQuerySystemTime routine returns when the process was created. (Note that if the system time is changed, the value that PsGetProcessCreateTimeQuadPart returns is unaffected.)

Requirements

Requirement Value
Minimum supported client Available in Windows XP and later versions of Windows.
Target Platform Universal
Header ntddk.h (include Wdm.h, Ntddk.h, Ntifs.h)
Library Ntoskrnl.lib
DLL Ntoskrnl.exe
IRQL Any level

See also

KeQuerySystemTime

ObReferenceObjectByHandle

PsGetCurrentProcess