Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTDEV

Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


What is PsGetProcessExitTime() doing?

alec_leealec_lee Member Posts: 45
edited August 16 in NTDEV

Just came across this odd function PsGetProcessExitTime(). And according to msdn doc :

https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-psgetprocessexittime

The PsGetProcessExitTime() routine returns the exit time for the current process.

Just out of curiosity, how could an exited process call this function to retrieve its exit time? Since this function only returns the exit time of the current process!

Comments

  • Scott_Noone_(OSR)Scott_Noone_(OSR) Administrator Posts: 3,514

    The value will be non-zero if you're being called as part of the last cleanup by the final thread in a process (e.g. process exit notify and IRP_MJ_CLEANUP/CLOSE).

    Not saying this is super useful (I've never used it)

    -scott
    OSR

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. Sign in or register to get started.

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Writing WDF Drivers 12 September 2022 Live, Online
Internals & Software Drivers 23 October 2022 Live, Online
Kernel Debugging 14 November 2022 Live, Online
Developing Minifilters 5 December 2022 Live, Online