From b812f3ccde4f231385cbecf6046e77fa281813b4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9D=8E=E9=80=9A=E6=B4=B2?= <carter.li@eoitek.com>
Date: Tue, 15 Apr 2025 16:41:19 +0800
Subject: [PATCH] Uptime (Windows): use `QueryUnbiasedInterruptTime`

As suggested by MSDN
---
 src/detection/uptime/uptime_windows.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/detection/uptime/uptime_windows.c b/src/detection/uptime/uptime_windows.c
index 6978a1163..775b428e9 100644
--- a/src/detection/uptime/uptime_windows.c
+++ b/src/detection/uptime/uptime_windows.c
@@ -1,11 +1,13 @@
 #include "uptime.h"
 #include "common/time.h"
 
-#include <sysinfoapi.h>
+#include <realtimeapiset.h>
 
 const char* ffDetectUptime(FFUptimeResult* result)
 {
-    result->uptime = GetTickCount64();
+    // According to MSDN, this function only fails if it's called with NULL
+    QueryUnbiasedInterruptTime(&result->uptime);
+    result->uptime /= 10000; // Convert from 100-nanosecond intervals to milliseconds
     result->bootTime = ffTimeGetNow() - result->uptime;
     return NULL;
 }