NtDelayExecution - NtDoc

Native API online documentation, based on the System Informer (formerly Process Hacker) phnt headers
#ifndef _NTEXAPI_H
#if (PHNT_MODE != PHNT_MODE_KERNEL)

//
// Thread execution
//

/**
 * The NtDelayExecution routine delays the calling thread until a deadline or an allowed interruption. 
 * This is a scheduling delay, not a wait for an object's signal and not a precision clock.
 *
 * \param Alertable TRUE permits an alert or ordinary user APC to interrupt the
 * delay; the APC runs on this thread. Retrying after an interruption is the caller's
 * responsibility, including recomputing remaining time for a relative interval.
 * \param DelayInterval Required readable LARGE_INTEGER; NULL does not mean an
 * infinite delay. Units are 100 nanoseconds: negative values are relative intervals,
 * positive values are absolute times since January 1, 1601 (UTC), and zero requests
 * a scheduling yield. User input must be 4-byte aligned on x64 and its WoW64 forwarding path. 
 * The captured input is not updated with remaining time.
 * \return STATUS_SUCCESS (0) on elapsed nonzero delay, STATUS_USER_APC (0xC0) or
 * STATUS_ALERTED (0x101) for interruption. A zero interval can return either
 * STATUS_SUCCESS or STATUS_NO_YIELD_PERFORMED (0x40000024). This also applies to
 * an alertable zero interval when no APC or alert terminates it first.
 * \remarks Expiration makes execution eligible, not necessarily immediate; other
 * scheduling work can delay return. A yield does not prove another thread ran or
 * completed useful work, and is not a replacement for synchronization. Do not
 * treat STATUS_NO_YIELD_PERFORMED as failure or as a count of ready threads.
 * \see https://learn.microsoft.com/en-us/windows/win32/api/synchapi/nf-synchapi-sleepex
 * \see RtlDelayExecution
 */
_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
NtDelayExecution(
    _In_ BOOLEAN Alertable,
    _In_ PLARGE_INTEGER DelayInterval
    );

#endif
#endif

View code on GitHub
#ifndef _NTZWAPI_H

_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwDelayExecution(
    _In_ BOOLEAN Alertable,
    _In_ PLARGE_INTEGER DelayInterval
    );

#endif

View code on GitHub

NtDoc

Initiates a sleep on the current thread.

Parameters

Notable return values

Remarks

Despite the name, NtAlertThreadByThreadId is unrelated to alertable sleeps and cannot interrupt them.

Related Win32 API

See also

NTinternals.net (undocumented.ntinternals.net)

Alertable

If set, execution can break in a result of NtAlertThread call.

DelayInterval

Delay in 100-ns units. Negative value means delay relative to current.

Documented by

See also