Uninformed: Informative Information for the Uninformed

Vol 2» 2005.Sept


The TickCountLow attribute is used, in combination with the TickCountMultiplier, to convey the number of milliseconds that have occurred since system boot. To calculate the number of milliseconds since system boot, the following equation is used:

T = shr(TickCountLow * TickCountMultiplier, 24)

This attribute is representative of a temporal address that has a counter scale. It starts an unknown time and increments at constant intervals. The biggest problem with this attribute are the intervals that it increases at. It's possible that two machines in the same room with different hardware will have different update periods for the TickCountLow attribute. This makes it less feasible to use as a temporal address because the update period cannot be readily predicted. On the other hand, it may be possible to determine the current uptime of the machine through TCP timestamps or some alternative mechanism, but without the ability to determine the update period, the TickCountLow attribute seems unusable.

This attribute is located at 0x7ffe0000 on all versions of Windows NT+.