From 8c72792e31772b4311956fd656a5539306347e85 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9D=8E=E9=80=9A=E6=B4=B2?= <zhangsongcui3371@sina.com>
Date: Mon, 16 Mar 2026 13:49:49 +0800
Subject: [PATCH] Common (Windows): adds a universal function
 `ffFileTimeToUnixMs` and use it

---
 src/common/time.h                   | 11 ++++++++++-
 src/detection/disk/disk_windows.c   |  3 ++-
 src/detection/packages/packages.c   |  5 ++---
 src/detection/users/users_windows.c |  9 ++-------
 4 files changed, 16 insertions(+), 12 deletions(-)

diff --git a/src/common/time.h b/src/common/time.h
index b4e0587d7..998c8f58a 100644
--- a/src/common/time.h
+++ b/src/common/time.h
@@ -29,11 +29,20 @@ static inline double ffTimeGetTick(void) //In msec
     #endif
 }
 
+#if _WIN32
+static inline uint64_t ffFileTimeToUnixMs(uint64_t value)
+{
+    if (__builtin_expect(__builtin_usubll_overflow(value, 116444736000000000ull, &value), false))
+        return 0;
+    return value / 10000ull;
+}
+#endif
+
 static inline uint64_t ffTimeGetNow(void)
 {
     #ifdef _WIN32
         uint64_t timeNow = ffKSystemTimeToUInt64(&SharedUserData->SystemTime);
-        return (timeNow - 116444736000000000ull) / 10000ull;
+        return ffFileTimeToUnixMs((uint64_t) timeNow);
     #elif defined(__HAIKU__)
         return (uint64_t) real_time_clock_usecs() / 1000u;
     #else
diff --git a/src/detection/disk/disk_windows.c b/src/detection/disk/disk_windows.c
index 50545338e..08217be44 100644
--- a/src/detection/disk/disk_windows.c
+++ b/src/detection/disk/disk_windows.c
@@ -1,5 +1,6 @@
 #include "disk.h"
 #include "common/io.h"
+#include "common/time.h"
 #include "common/windows/unicode.h"
 #include "common/windows/nt.h"
 
@@ -101,7 +102,7 @@ const char* ffDetectDisksImpl(FFDiskOptions* options, FFlist* disks)
             if (fsVolume->VolumeLabelLength > 0)
                 ffStrbufSetNWS(&disk->name, fsVolume->VolumeLabelLength / sizeof(WCHAR), fsVolume->VolumeLabel);
             if (fsVolume->VolumeCreationTime.QuadPart)
-                disk->createTime = ((uint64_t) fsVolume->VolumeCreationTime.QuadPart - 116444736000000000ull) / 10000ull;
+                disk->createTime = ffFileTimeToUnixMs((uint64_t) fsVolume->VolumeCreationTime.QuadPart);
         }
 
         if (fsAttr)
diff --git a/src/detection/packages/packages.c b/src/detection/packages/packages.c
index 9e7074b2a..96497c16a 100644
--- a/src/detection/packages/packages.c
+++ b/src/detection/packages/packages.c
@@ -1,5 +1,6 @@
 #include "packages.h"
 #include "common/io.h"
+#include "common/time.h"
 
 #include <inttypes.h>
 #include <stddef.h>
@@ -52,9 +53,7 @@ bool ffPackagesReadCache(FFstrbuf* cacheDir, FFstrbuf* cacheContent, const char*
     if (!NT_SUCCESS(NtQueryInformationFile(handle, &iosb, &fileInfo, sizeof(fileInfo), FileBasicInformation)))
         return false;
 
-    if (fileInfo.LastWriteTime.QuadPart <= 116444736000000000ull) return false;
-
-    mtime_current = (fileInfo.LastWriteTime.QuadPart - 116444736000000000ull) / 10000ull;
+    mtime_current = ffFileTimeToUnixMs((uint64_t) fileInfo.LastWriteTime.QuadPart);
     #endif
 
     ffStrbufSet(cacheDir, &instance.state.platform.cacheDir);
diff --git a/src/detection/users/users_windows.c b/src/detection/users/users_windows.c
index f8b117b3d..cbd8a764f 100644
--- a/src/detection/users/users_windows.c
+++ b/src/detection/users/users_windows.c
@@ -1,16 +1,11 @@
 #include "users.h"
 #include "common/windows/unicode.h"
+#include "common/time.h"
 
 #include <windows.h>
 #include <wtsapi32.h>
 #include <ws2tcpip.h>
 
-static inline uint64_t to_ms(uint64_t ret)
-{
-    ret -= 116444736000000000ull;
-    return ret / 10000ull;
-}
-
 const char* ffDetectUsers(FFUsersOptions* options, FFlist* users)
 {
     WTS_SESSION_INFO_1W* sessionInfo;
@@ -57,7 +52,7 @@ const char* ffDetectUsers(FFUsersOptions* options, FFlist* users)
         PWTSINFOW wtsInfo = NULL;
         if (WTSQuerySessionInformationW(WTS_CURRENT_SERVER_HANDLE, session->SessionId, WTSSessionInfo, (LPWSTR *) &wtsInfo, &bytes))
         {
-            user->loginTime = to_ms(*(uint64_t*) &wtsInfo->LogonTime);
+            user->loginTime = ffFileTimeToUnixMs((uint64_t) wtsInfo->LogonTime.QuadPart);
             WTSFreeMemory(wtsInfo);
         }
     }