#ifndef _NTEXAPI_H
#if (PHNT_MODE != PHNT_MODE_KERNEL)

/**
 * The NtQueryTimer routine retrieves a snapshot of an ordinary timer's signal state and remaining time.
 * Querying neither consumes the signal nor arms or cancels the timer.
 *
 * \param TimerHandle Handle with TIMER_QUERY_STATE (0x1).
 * \param TimerInformationClass TimerBasicInformation (0), the supported class.
 * \param TimerInformation Writable TIMER_BASIC_INFORMATION, 4-byte aligned for
 * user-mode callers on native x64 and WoW64.
 * \param TimerInformationLength Exactly 16 bytes on x64 and x86/WoW64.
 * \param ReturnLength Optional ULONG receiving 16 on success. Invalid class/size
 * checks leave it unchanged; NULL/zero-size discovery is
 * not a supported sizing protocol.
 * \return STATUS_INVALID_INFO_CLASS for an unsupported class,
 * STATUS_INFO_LENGTH_MISMATCH for an incorrect size, or the query's NTSTATUS.
 * \remarks Only 9 member bytes are written; 7 trailing padding bytes are untouched.
 * RemainingTime is a signed 100-nanosecond difference, not clamped to zero when
 * inactive. The state and due time are sampled separately and can change concurrently;
 * this information is diagnostic, not a substitute for waiting on the timer.
 */
_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryTimer(
    _In_ HANDLE TimerHandle,
    _In_ TIMER_INFORMATION_CLASS TimerInformationClass,
    _Out_writes_bytes_(TimerInformationLength) PVOID TimerInformation,
    _In_ ULONG TimerInformationLength,
    _Out_opt_ PULONG ReturnLength
    );

#endif
#endif
View code on GitHub

#ifndef _NTZWAPI_H

_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwQueryTimer(
    _In_ HANDLE TimerHandle,
    _In_ TIMER_INFORMATION_CLASS TimerInformationClass,
    _Out_writes_bytes_(TimerInformationLength) PVOID TimerInformation,
    _In_ ULONG TimerInformationLength,
    _Out_opt_ PULONG ReturnLength
    );

#endif
View code on GitHub