获取开机时间

1、用当前时间减去从开机到现在经过了的时间：

	DWORD dwStartTicks = GetTickCount() / 1000 / 60;	// 分钟

	SYSTEMTIME sysTime;
	GetSystemTime(&sysTime);

	FILETIME fileTime;
	ULARGE_INTEGER ulTime;
	SystemTimeToFileTime(&sysTime, &fileTime);
	ulTime.HighPart = fileTime.dwHighDateTime;
	ulTime.LowPart = fileTime.dwLowDateTime;

	DWORD dwCurTime = ulTime.QuadPart / (10 * 1000 * 1000 * 60);	// 分钟

这种方法不太精确。

2、利用系统函数 NtQuerySystemInformation：

此函数在NTDLL.DLL中导出。

	typedef struct
	{
		LARGE_INTEGER liKeBootTime;
		LARGE_INTEGER liKeSystemTime;
		LARGE_INTEGER liExpTimeZoneBias;
		ULONG uCurrentTimeZoneId;
		DWORD dwReserved;
	} SYSTEM_TIME_INFORMATION; 

	LONG status;
	SYSTEM_TIME_INFORMATION Sti;

	HMODULE hMod = LoadLibraryW(L"NTDLL.DLL");
	if(hMod)
	{
		typedef NTSTATUS (__stdcall * PFNtQuerySystemInformation)(IN UINT SystemInformationClass,OUT PVOID SystemInformation,IN ULONG SystemInformationLength, OUT PULONG ReturnLength OPTIONAL);

		PFNtQuerySystemInformation pfnNtQuerySystemInformation = (PFNtQuerySystemInformation)GetProcAddress(hMod, "NtQuerySystemInformation");

		if(pfnNtQuerySystemInformation)
			pfnNtQuerySystemInformation(3, &Sti, sizeof(Sti), 0);

		FreeLibrary(hMod);
	}
	DWORD dwCurTime = Sti.liKeBootTime.QuadPart / (1000 * 60); // 分钟