#ifndef _NTEXAPI_H

/**
 * \brief A compact activity timeline encoded as a bitmap with an end-time anchor.
 *
 * \details Each bit in the Bitmap field represents a fixed-size time slot.
 * A set bit indicates the process was active during that slot.
 * Each slot is 4096 milliseconds (~4.1 seconds) in duration.
 * The 32-bit bitmap covers approximately 131 seconds of recent history.
 * EndTime is a slot index (not wall-clock seconds); multiply by 4096 to get elapsed milliseconds.
 *
 * Timeline bitmap calculations:
 * - To compute active duration from a bitmap: popcount(Bitmap) * 4096 milliseconds
 * - To convert EndTime to elapsed time: EndTime * 4096 milliseconds
 * - Total bitmap window: 32 slots * 4096 ms = 131,072 ms ~ 131 seconds
 *
 * The slot index comes from kernel timer accounting:
 * KiTimelineBitmapTime = elapsed_ms >> 12,
 * where elapsed_ms is the time since boot in milliseconds
 * (from KUSER_SHARED_DATA.TickCountQuad).
 */
typedef union _TIMELINE_BITMAP
{
    /** Raw 64-bit value combining EndTime and Bitmap. */
    ULONGLONG Value;
    struct
    {
        /**
         * The slot index of the most recent time slot represented by the bitmap.
         * Real time ~ EndTime * 4096 milliseconds.
         */
        ULONG EndTime;
        /**
         * Bit-mask of activity slots; bit 0 is the most recent slot.
         * One set bit represents approximately 4.096 seconds of activity.
         * popcount(Bitmap) * 4096 ms ~ total active duration within window.
         */
        ULONG Bitmap;
    };
} TIMELINE_BITMAP, *PTIMELINE_BITMAP;

#endif
View code on GitHub