Skip to content

Instantly share code, notes, and snippets.

Show Gist options
  • Save bionicbeagle/882c7e8079686617a7b1f0bdb6970c17 to your computer and use it in GitHub Desktop.
Save bionicbeagle/882c7e8079686617a7b1f0bdb6970c17 to your computer and use it in GitHub Desktop.
QueryPerformanceCounter from Windows 10 v1903
00007FFE496CBBB0 mov qword ptr [rsp+8],rbx
00007FFE496CBBB5 push rdi
00007FFE496CBBB6 sub rsp,20h
00007FFE496CBBBA mov r8b,byte ptr [7FFE03C6h]
00007FFE496CBBC2 mov rbx,rcx
00007FFE496CBBC5 test r8b,1
00007FFE496CBBC9 je 00007FFE496CBC3B
00007FFE496CBBCB mov r11,qword ptr [7FFE03B8h]
00007FFE496CBBD3 test r8b,2
00007FFE496CBBD7 je 00007FFE497698FF
00007FFE496CBBDD mov r9,qword ptr [7FFE49823EC8h]
00007FFE496CBBE4 test r9,r9
00007FFE496CBBE7 je 00007FFE496CBC3B
00007FFE496CBBE9 mov r10d,dword ptr [r9]
00007FFE496CBBEC test r10d,r10d
00007FFE496CBBEF je 00007FFE496CBC3B
00007FFE496CBBF1 test r8b,r8b
00007FFE496CBBF4 jns 00007FFE497698E4
00007FFE496CBBFA rdtscp
00007FFE496CBBFD shl rdx,20h
00007FFE496CBC01 or rdx,rax
00007FFE496CBC04 mov rax,qword ptr [r9+8]
00007FFE496CBC08 mov rcx,qword ptr [r9+10h]
00007FFE496CBC0C mul rax,rdx
00007FFE496CBC0F mov eax,dword ptr [r9]
00007FFE496CBC12 add rdx,rcx
00007FFE496CBC15 cmp eax,r10d
00007FFE496CBC18 jne 00007FFE496CBBE9
00007FFE496CBC1A mov cl,byte ptr [7FFE03C7h]
00007FFE496CBC21 lea rax,[rdx+r11]
00007FFE496CBC25 shr rax,cl
00007FFE496CBC28 mov qword ptr [rbx],rax
00007FFE496CBC2B mov eax,1
00007FFE496CBC30 mov rbx,qword ptr [rsp+30h]
00007FFE496CBC35 add rsp,20h
00007FFE496CBC39 pop rdi
00007FFE496CBC3A ret
@bionicbeagle
Copy link
Author

Previous version (v1809)

00007FF869889362  sub         rsp,20h  
00007FF869889366  mov         al,byte ptr [7FFE03C6h]  
00007FF86988936D  mov         rbx,rcx  
00007FF869889370  test        al,1  
00007FF869889372  je          00007FF8698893A9  
00007FF869889374  mov         r8,qword ptr [7FFE03B8h]  
00007FF86988937C  test        al,al  
00007FF86988937E  jns         00007FF869921020  
00007FF869889384  rdtscp  
00007FF869889387  mov         cl,byte ptr [7FFE03C7h]  
00007FF86988938E  shl         rdx,20h  
00007FF869889392  or          rax,rdx  
00007FF869889395  add         rax,r8  
00007FF869889398  shr         rax,cl  
00007FF86988939B  mov         qword ptr [rbx],rax  
00007FF86988939E  mov         eax,1  
00007FF8698893A3  add         rsp,20h  
00007FF8698893A7  pop         rbx  
00007FF8698893A8  ret

@bionicbeagle
Copy link
Author

bionicbeagle commented Jun 17, 2019

v1903 with symbols from MS symbol store:

RtlQueryPerformanceCounter:
00007FFE7CD6BBB0  mov         qword ptr [rsp+8],rbx  
00007FFE7CD6BBB5  push        rdi  
00007FFE7CD6BBB6  sub         rsp,20h  
00007FFE7CD6BBBA  mov         r8b,byte ptr [7FFE03C6h]  
00007FFE7CD6BBC2  mov         rbx,rcx  
00007FFE7CD6BBC5  test        r8b,1  
00007FFE7CD6BBC9  je          RtlQueryPerformanceCounter+8Bh (07FFE7CD6BC3Bh)  
00007FFE7CD6BBCB  mov         r11,qword ptr [7FFE03B8h]  
00007FFE7CD6BBD3  test        r8b,2  
00007FFE7CD6BBD7  je          memset+697Fh (07FFE7CE098FFh)  
00007FFE7CD6BBDD  mov         r9,qword ptr [RtlpHypervisorSharedUserVa (07FFE7CEC3EC8h)]  
00007FFE7CD6BBE4  test        r9,r9  
00007FFE7CD6BBE7  je          RtlQueryPerformanceCounter+8Bh (07FFE7CD6BC3Bh)  
00007FFE7CD6BBE9  mov         r10d,dword ptr [r9]  
00007FFE7CD6BBEC  test        r10d,r10d  
00007FFE7CD6BBEF  je          RtlQueryPerformanceCounter+8Bh (07FFE7CD6BC3Bh)  
00007FFE7CD6BBF1  test        r8b,r8b  
00007FFE7CD6BBF4  jns         memset+6964h (07FFE7CE098E4h)  
00007FFE7CD6BBFA  rdtscp  
00007FFE7CD6BBFD  shl         rdx,20h  
00007FFE7CD6BC01  or          rdx,rax  
00007FFE7CD6BC04  mov         rax,qword ptr [r9+8]  
00007FFE7CD6BC08  mov         rcx,qword ptr [r9+10h]  
00007FFE7CD6BC0C  mul         rax,rdx  
00007FFE7CD6BC0F  mov         eax,dword ptr [r9]  
00007FFE7CD6BC12  add         rdx,rcx  
00007FFE7CD6BC15  cmp         eax,r10d  
00007FFE7CD6BC18  jne         RtlQueryPerformanceCounter+39h (07FFE7CD6BBE9h)  
00007FFE7CD6BC1A  mov         cl,byte ptr [7FFE03C7h]  
00007FFE7CD6BC21  lea         rax,[rdx+r11]  
00007FFE7CD6BC25  shr         rax,cl  
00007FFE7CD6BC28  mov         qword ptr [rbx],rax  
00007FFE7CD6BC2B  mov         eax,1  
00007FFE7CD6BC30  mov         rbx,qword ptr [rsp+30h]  
00007FFE7CD6BC35  add         rsp,20h  
00007FFE7CD6BC39  pop         rdi  
00007FFE7CD6BC3A  ret  
00007FFE7CD6BC3B  xor         edx,edx  
00007FFE7CD6BC3D  lea         rcx,[rsp+40h]  
00007FFE7CD6BC42  call        NtQueryPerformanceCounter (07FFE7CDFC670h)  
00007FFE7CD6BC47  mov         rax,qword ptr [rsp+40h]  
00007FFE7CD6BC4C  jmp         RtlQueryPerformanceCounter+78h (07FFE7CD6BC28h) 

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment