#ifndef _NTEXAPI_H
#if (PHNT_MODE != PHNT_MODE_KERNEL)
//
// Thread execution
//
/**
* The NtDelayExecution routine delays the calling thread until a deadline or an allowed interruption.
* This is a scheduling delay, not a wait for an object's signal and not a precision clock.
*
* \param Alertable TRUE permits an alert or ordinary user APC to interrupt the
* delay; the APC runs on this thread. Retrying after an interruption is the caller's
* responsibility, including recomputing remaining time for a relative interval.
* \param DelayInterval Required readable LARGE_INTEGER; NULL does not mean an
* infinite delay. Units are 100 nanoseconds: negative values are relative intervals,
* positive values are absolute times since January 1, 1601 (UTC), and zero requests
* a scheduling yield. User input must be 4-byte aligned on x64 and its WoW64 forwarding path.
* The captured input is not updated with remaining time.
* \return STATUS_SUCCESS (0) on elapsed nonzero delay, STATUS_USER_APC (0xC0) or
* STATUS_ALERTED (0x101) for interruption. A zero interval can return either
* STATUS_SUCCESS or STATUS_NO_YIELD_PERFORMED (0x40000024). This also applies to
* an alertable zero interval when no APC or alert terminates it first.
* \remarks Expiration makes execution eligible, not necessarily immediate; other
* scheduling work can delay return. A yield does not prove another thread ran or
* completed useful work, and is not a replacement for synchronization. Do not
* treat STATUS_NO_YIELD_PERFORMED as failure or as a count of ready threads.
* \see https://learn.microsoft.com/en-us/windows/win32/api/synchapi/nf-synchapi-sleepex
* \see RtlDelayExecution
*/
_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
NtDelayExecution(
_In_ BOOLEAN Alertable,
_In_ PLARGE_INTEGER DelayInterval
);
View code on GitHub#ifndef _NTZWAPI_H
_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwDelayExecution(
_In_ BOOLEAN Alertable,
_In_ PLARGE_INTEGER DelayInterval
);
View code on GitHubInitiates a sleep on the current thread.
Alertable - determines whether the sleep should be altertable. This allows external triggers (such as APCs or calls to NtAlertThread) to interrupt sleep prematurely.DelayInterval - a pointer to a variable that stores the wait internal. A negative value indicates relative timeout for the specified number of 100-nanosecond intervals. To sleep for a specific number of milliseconds, multiply them by -10,000. Positive values indicate an absolute time.STATUS_SUCCESS - the thread woke due to the timeout.STATUS_USER_APC - the sleep was interrupted by an APC.STATUS_ALERTED - the sleep was interrupted by a call to NtAlertThread.STATUS_NO_YIELD_PERFORMED - a zero-timeout sleep did not cause switching to other threads.Despite the name, NtAlertThreadByThreadId is unrelated to alertable sleeps and cannot interrupt them.
If set, execution can break in a result of NtAlertThread call.
Delay in 100-ns units. Negative value means delay relative to current.