Locating Temporal Addresses

As seen previously in this document, using the telescope program on any Windows application will result in the same two (or three) timers being displayed:

C:\>telescope 2620
[*] Attaching to process 2620 (5 polling cycles)...
[*] Polling address space........

Temporal address locations:

0x7FFE0000 [Size=4, Scale=Counter, Period=600 msec]
0x7FFE0014 [Size=8, Scale=Epoch (1601), Period=100 nsec]

Referring to the structure definition described at the beginning of this chapter, it is possible for one to determine which attribute each of these addresses is referring to. Each of these three attributes will be discussed in detail in the following sub-sections.

• TickCountLow
• InterruptTime
• SystemTime