Uptime: reads (System|Interrupt)Time directly from SharedUserData

src/detection/uptime/uptime_windows.c

@@ -1,34 +1,18 @@
 #include "uptime.h"
 #include "common/time.h"
-#include "common/library.h"
-
-#include <realtimeapiset.h>
-#include <sysinfoapi.h>
+#include "common/windows/nt.h"
 
 const char* ffDetectUptime(FFUptimeResult* result)
 {
-    #if FF_WIN7_COMPAT
-    HMODULE hKernelBase = GetModuleHandleW(L"KernelBase.dll");
-    if (__builtin_expect(!!hKernelBase, true))
-    {
-        FF_LIBRARY_LOAD_SYMBOL_LAZY(hKernelBase, QueryInterruptTime);
-        if (ffQueryInterruptTime) // Windows 10 and later
-        {
-            uint64_t uptime;
-            ffQueryInterruptTime(&uptime);
-            result->uptime = uptime / 10000; // Convert from 100-nanosecond intervals to milliseconds
-            goto ok;
-        }
-    }
+    // GetInterruptTime with Win7 support
+    uint64_t interruptTime = ffKSystemTimeToUInt64(&SharedUserData->InterruptTime);
 
-    result->uptime = GetTickCount64();
-ok:
-
-    #else
-    uint64_t uptime;
-    QueryInterruptTime(&uptime);
-    result->uptime = uptime / 10000; // Convert from 100-nanosecond intervals to milliseconds
-    #endif
+    result->uptime = interruptTime / 10000; // Convert from 100-nanosecond intervals to milliseconds
     result->bootTime = ffTimeGetNow() - result->uptime;
+
+    // Alternatively, `NtQuerySystemInformation(SystemTimeOfDayInformation)` reports the boot time directly,
+    // whose result exactly equals what WMI `Win32_OperatingSystem` reports
+    // with much lower accuracy (0.5 seconds)
+
     return NULL;
 }