获取电脑的开机时间NtQuerySystemInformation

我们调用的函数在ntdll.dll链接库中，并且我们只能进行动态的链接

下面对ntdll.dll链接库进行简单的介绍：

ntdll.dll描述了windows本地NTAPI的接口。是重要的Windows NT内核级文件。当Windows启动时，ntdll.dll就驻留在内存中特定的写保护区域，使别的程序无法占用这个内存区域。

百度百科：http://baike.baidu.com/link?url=Q_gBg7cQ8rftv-pbzCC-zDV2moZ8fv-7hrqACnnmEk_3WZCus01Bxs6kKet9O33rgc3Q8pzWLhmzI1YcCqwvP_

可以自己查看一下详细的信息

下面直接上代码：

#include<stdio.h>
#include<windows.h>
#define NT_SUCCESS(x) ((x)>=0)
#define SystemTimeInformation 3

typedef struct {
LARGE_INTEGER liKeBootTime;
LARGE_INTEGER liKeSystemTime;
LARGE_INTEGER liExpTimeZoneBias;
ULONG uCurrentTimeZoneId;
DWORD dwReserved; } SYSTEM_TIME_INFORMATION;
typedef long (__stdcall *fnNtQuerySystemInformation)(
IN  UINT SystemInformationClass,
OUT PVOID SystemInformation,
IN  ULONG SystemInformationLength,
OUT PULONG ReturnLength OPTIONAL);

static fnNtQuerySystemInformation NtQuerySystemInformation = NULL;

int main(void)
{
NtQuerySystemInformation = (fnNtQuerySystemInformation)GetProcAddress(LoadLibrary("ntdll.dll"),
"NtQuerySystemInformation");
if(NtQuerySystemInformation == NULL)
{
printf("Get NtQuerySystemInformation Addr Failed!n");
exit(-1);
}
LONG status;
SYSTEM_TIME_INFORMATION sti;
status = NtQuerySystemInformation(SystemTimeInformation, &sti,sizeof(sti),0);
printf("boot time (ms) == %I64Xn",sti.liKeBootTime.QuadPart);

if(NO_ERROR != status)
{
printf("NtQuerySystemInformation Failed!n");
exit(-1);
}
FILETIME ft;
SYSTEMTIME st;
memcpy(&ft,&sti.liKeBootTime,sizeof(ft)); //将其转为文件时间
FileTimeToLocalFileTime(&ft,&ft);   //将一个FILETIME结构转换成本地时间
FileTimeToSystemTime(&ft,&st);   //将文件时间转为系统时间
printf("Date: %02d-%02d-%04d Time: %02d:%02d:%02d ",st.wMonth,st.wDay,st.wYear, st.wHour,st.wMinute,st.wSecond);            getchar();
return 0;
}