From c640ddbff75193252bb18ac66119fcdae9b809b4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9D=8E=E9=80=9A=E6=B4=B2?= <zhangsongcui3371@sina.com>
Date: Tue, 6 Jan 2026 22:41:00 +0800
Subject: [PATCH] Uptime (Windows): uses QueryInterruptTime on WoA
 unconditionally

---
 src/detection/uptime/uptime_windows.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/detection/uptime/uptime_windows.c b/src/detection/uptime/uptime_windows.c
index 0554348ec..fb6a78727 100644
--- a/src/detection/uptime/uptime_windows.c
+++ b/src/detection/uptime/uptime_windows.c
@@ -7,6 +7,7 @@
 
 const char* ffDetectUptime(FFUptimeResult* result)
 {
+    #ifndef __aarch64__
     HMODULE hKernelBase = GetModuleHandleW(L"KernelBase.dll");
     if (__builtin_expect(!!hKernelBase, true))
     {
@@ -21,6 +22,11 @@ const char* ffDetectUptime(FFUptimeResult* result)
     }
 
     result->uptime = GetTickCount64();
+    #else
+    uint64_t uptime;
+    QueryInterruptTime(&uptime);
+    result->uptime = uptime / 10000; // Convert from 100-nanosecond intervals to milliseconds
+    #endif
 
 ok:
     result->bootTime = ffTimeGetNow() - result->uptime;