Collectives™ on Stack Overflow

Find centralized, trusted content and collaborate around the technologies you use most.

Teams

Q&A for work

Connect and share knowledge within a single location that is structured and easy to search.

Currently Sleep takes a single DWORD (32bit) for time. Is there any alternative which takes DWORDLONG (64bit)?

I'm using RNG in which with every additional byte added the overall wait time increases. With 32bit integer the overall time is 5 minutes and I want to increase it.

Sleep[Ex] internal call NtDelayExecution - undocumented but exist in all windows nt versions (from nt 4 to win 10) - exported by ntdll.dll - use ntdll.lib or ntdllp.lib from wdk. as result of this call in kernel will be called documented function KeDelayExecutionThread

//extern "C"
NTSYSAPI 
NTSTATUS
NTAPI
NtDelayExecution(
  IN BOOLEAN              Alertable,
  IN PLARGE_INTEGER       Interval );
Alertable
Specifies TRUE if the wait is alertable. Lower-level drivers should
specify FALSE.
Interval
Specifies the absolute or relative time, in units of 100 nanoseconds,
for which the wait is to occur. A negative value indicates relative
time. Absolute expiration times track any changes in system time;
relative expiration times are not affected by system time changes.
Sleep[Ex] is win32 shell, over this native api, which restrict interval value (from 64 to 32 bit) can not set absolute time (possible with NtDelayExecution) and ignore alerts (we can exit from NtDelayExecution via alert thread if wait alertable)
so you can direct call this api instead indirect via Sleep[Ex]
so Sleep(dwMilliseconds) is call SleepEx(dwMilliseconds, false)
SleepEx(dwMilliseconds, bAlertable) 
LARGE_INTEGER  Interval;
Interval.QuadPart = -(dwMilliseconds * 10000);
NtDelayExecution(bALertable, &Interval);
note that in case alertable wait it can be broken via apc (api return STATUS_USER_APC) or via alert ( STATUS_ALERTED will be returned. we can alert thread via NtAlertThread). the SleepEx check returned status and in case STATUS_ALERTED - again begin wait with updated interval. so SleepEx wait can not be broken via alert (NtAlertThread) but NtDelayExecution can
                @AnArrayOfFunctions - negative value means relative time. so exactly which Sleep use only 64 bit. say if you want wait 1 second - set DelayInterval.QuadPart = -10000000 if want wait infinite - DelayInterval.QuadPart = 0x8000000000000000
– RbMm
                Feb 7, 2019 at 21:37
                @AnArrayOfFunctions - in any case in kernel finally called documented function KeDelayExecutionThread - read here about Interval parameter
– RbMm
                Feb 7, 2019 at 22:28
                Btw what are you saying about APC - I'm specifying bAlertable to be false. Also what's the difference between KeDelayExecutionThread and ZwDelayExecution?
– AnArrayOfFunctions
                Feb 12, 2019 at 21:11
                @AnArrayOfFunctions - if you set bAlertable to false - your wait can not be broken by apc or alert (this is not apc). NtDelayExecution in user mode - this is stub for  NtDelayExecution in kernel mode. this api call KeDelayExecutionThread. look github.com/Zer0Mem0ry/ntoskrnl/blob/master/Ex/delay.c
– RbMm
                Feb 12, 2019 at 21:20
Sleep() takes milliseconds. The max DWORD value, 4294967295, will result in a timeout period of 49.7 days. For most purposes, that's a good enough maximum value, but if you're that determined to have a 64-bit sleep parameter, you can chain multiple Sleep() calls together. This will change the maximum number of milliseconds that you can Sleep() for to 18446744073709551615, which is roughly 600 million years:
VOID WINAPI Sleep64(DWORDLONG dwlMilliseconds)
    while (dwlMilliseconds)
        DWORD dwSleepTime = min(0xFFFFFFFE, dwlMilliseconds);
        Sleep(dwSleepTime);
        dwlMilliseconds -= dwSleepTime;
I have tested this and can verify that it works.
                but Sleep[Ex] internal call NtDelayExecution. this is win32 shell over this native api which restrict interval value (from 64 to 32 bit) can not set absolute time (possible with NtDelayExecution) and ignore alerts (we can exit from NtDelayExecution via alert thread if wait alertable)
– RbMm
                Feb 7, 2019 at 21:14
        
Thanks for contributing an answer to Stack Overflow!
Please be sure to answer the question. Provide details and share your research!
But avoid …
Asking for help, clarification, or responding to other answers.
Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.