From 8facb7c6e92048254ddb626ebc82e733095f4ac2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E6=9D=8E=E9=80=9A=E6=B4=B2?= Date: Mon, 23 Mar 2026 16:01:29 +0800 Subject: [PATCH] Uptime (Windows): improves comments --- src/common/windows/nt.h | 4 +++- src/detection/uptime/uptime_windows.c | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/src/common/windows/nt.h b/src/common/windows/nt.h index 2b1f0543d..bec8dd345 100644 --- a/src/common/windows/nt.h +++ b/src/common/windows/nt.h @@ -634,7 +634,9 @@ static inline uint64_t ffKSystemTimeToUInt64(const volatile KSYSTEM_TIME* pTime) { #if _WIN64 - return *(uint64_t*) pTime; + // This is safe even if pTime is not 8-byte aligned + // See https://learn.microsoft.com/en-us/windows/win32/winprog64/fault-alignments + return *(const volatile uint64_t*) pTime; #else diff --git a/src/detection/uptime/uptime_windows.c b/src/detection/uptime/uptime_windows.c index c5a4d423f..8ac7b3dc5 100644 --- a/src/detection/uptime/uptime_windows.c +++ b/src/detection/uptime/uptime_windows.c @@ -4,7 +4,7 @@ const char* ffDetectUptime(FFUptimeResult* result) { - // GetInterruptTime with Win7 support + // QueryInterruptTime with Win7 support uint64_t interruptTime = ffKSystemTimeToUInt64(&SharedUserData->InterruptTime); result->uptime = interruptTime / 10000; // Convert from 100-nanosecond intervals to milliseconds