diff --git a/src/detection/uptime/uptime_windows.c b/src/detection/uptime/uptime_windows.c index 6978a1163..775b428e9 100644 --- a/src/detection/uptime/uptime_windows.c +++ b/src/detection/uptime/uptime_windows.c @@ -1,11 +1,13 @@ #include "uptime.h" #include "common/time.h" -#include +#include const char* ffDetectUptime(FFUptimeResult* result) { - result->uptime = GetTickCount64(); + // According to MSDN, this function only fails if it's called with NULL + QueryUnbiasedInterruptTime(&result->uptime); + result->uptime /= 10000; // Convert from 100-nanosecond intervals to milliseconds result->bootTime = ffTimeGetNow() - result->uptime; return NULL; }