Computer Source

(rough notes that need expanding)

Assumes Eve can't watch.

Time Sources

SystemTIME a structure of words with current date-time to milliseconds,

timer a 8 byte floating point number with the count of hundredths of seconds since midnight.

GETTICKCOUNT function dword (32 bits) with count of milliseconds since system start. Changes in step with real time, but eve should not know closely when startup/reboot was; else see Rule 3.

GETSYSTEMTIMES count of 100nS in 8bytes since system start for idle time, kernal time and user time. Win XP SP1 and later. If Eve knows this Rule 3.


Disk Usage As A Source

CPU usage As A Source