From cace1a7156b5c19b16c0847798e15d17b233c9f9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9D=8E=E9=80=9A=E6=B4=B2?= <zhangsongcui3371@sina.com>
Date: Thu, 28 Aug 2025 18:22:06 +0800
Subject: [PATCH] Revert "Uptime (Windows): use `QueryUnbiasedInterruptTime`"

Fixes #1935

This reverts commit b812f3ccde4f231385cbecf6046e77fa281813b4.
---
 src/detection/uptime/uptime_windows.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/src/detection/uptime/uptime_windows.c b/src/detection/uptime/uptime_windows.c
index 775b428e9..6978a1163 100644
--- a/src/detection/uptime/uptime_windows.c
+++ b/src/detection/uptime/uptime_windows.c
@@ -1,13 +1,11 @@
 #include "uptime.h"
 #include "common/time.h"
 
-#include <realtimeapiset.h>
+#include <sysinfoapi.h>
 
 const char* ffDetectUptime(FFUptimeResult* result)
 {
-    // According to MSDN, this function only fails if it's called with NULL
-    QueryUnbiasedInterruptTime(&result->uptime);
-    result->uptime /= 10000; // Convert from 100-nanosecond intervals to milliseconds
+    result->uptime = GetTickCount64();
     result->bootTime = ffTimeGetNow() - result->uptime;
     return NULL;
 }