vc NtQuerySystemInformation

根据提供的引用[1]，NtQuerySystemInformation是一个用于获取Windows系统信息的API函数，它位于NTDLL.DLL中。使用该函数可以获取系统启动时间等本地系统信息。在VC中使用该函数需要先定义函数原型并加载NTDLL.DLL库文件。以下是一个使用NtQuerySystemInformation获取系统启动时间的示例代码：

#include <windows.h>
#include <stdio.h>

typedef struct _SYSTEM_TIME_INFORMATION {
    LARGE_INTEGER BootTime;
    LARGE_INTEGER CurrentTime;
    LARGE_INTEGER TimeZoneBias;
    ULONG TimeZoneId;
    ULONG Reserved;
    ULONGLONG BootTimeBias;
    ULONGLONG SleepTimeBias;
} SYSTEM_TIME_INFORMATION, *PSYSTEM_TIME_INFORMATION;

typedef NTSTATUS (WINAPI *PNT_QUERY_SYSTEM_INFORMATION)(
    SYSTEM_INFORMATION_CLASS SystemInformationClass,
    PVOID SystemInformation,
    ULONG SystemInformationLength,
    PULONG ReturnLength
);

int main() {
    HMODULE hNtDll = LoadLibrary("ntdll.dll");
    if (hNtDll == NULL) {
        printf("Failed to load ntdll.dll\n");
        return 1;
    }

    PNT_QUERY_SYSTEM_INFORMATION NtQuerySystemInformation = (PNT_QUERY_SYSTEM_INFORMATION)GetProcAddress(hNtDll, "NtQuerySystemInformation");
    if (NtQuerySystemInformation == NULL) {
        printf("Failed to get NtQuerySystemInformation address\n");
        return 1;
    }

    SYSTEM_TIME_INFORMATION sti;
    ULONG ReturnLength;
    NTSTATUS status = NtQuerySystemInformation(SystemTimeInformation, &sti, sizeof(sti), &ReturnLength);
    if (status != STATUS_SUCCESS) {
        printf("NtQuerySystemInformation failed with status 0x%08X\n", status);
        return 1;
    }

    printf("System boot time: %lld\n", sti.BootTime.QuadPart);

    FreeLibrary(hNtDll);
    return 0;
}