There's one symbol named KeTickCount which works in 32-bit, but when I applied that in my 64-bit dump (Windows 2008), it doesn't work anymore. Did windows change the value?
The only approach I can do is that use ".time" to get the current uptime and multiply it with ticksPerSecond, which is troublesome and inaccurate.
Run !kuser to get at that in windbg.
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With