Open rdbo opened 1 year ago
https://learn.microsoft.com/en-us/windows/win32/api/winreg/nf-winreg-regqueryinfokeya
LastWriteTime
is useful here
Another way would be to create a static variable in process.c
that stores the Windows boot time from the GetTickCount/GetTickCount64
functions.
Another possibility: use Unix timestamps across all platforms instead of boot-relative time
Check modified time of:
HKEY_LOCAL_MACHINE\System\ControlSet001\Control\Session Manager\Memory Management\PrefetchParameters\BootId
may be a better indicator than using the NT API