What is PsGetProcessExitTime() doing?

NTDEV
1

Just came across this odd function PsGetProcessExitTime(). And according to msdn doc :

https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-psgetprocessexittime

The PsGetProcessExitTime() routine returns the exit time for the current process.

Just out of curiosity, how could an exited process call this function to retrieve its exit time? Since this function only returns the exit time of the current process!

2

The value will be non-zero if you’re being called as part of the last cleanup by the final thread in a process (e.g. process exit notify and IRP_MJ_CLEANUP/CLOSE).

Not saying this is super useful (I’ve never used it)