驱动中打印系统时间

在驱动中打印本地时间三个步骤：

1、在驱动中调用KeQuerySystemTime获取GMT系统时间

2、调用ExSystemTimeToLocalTime将GMT系统时间转换为本地系统时间

3、调用RtlTimeToTimeFields将本地时间转换为TIME_FIELDS结构体

TIME_FIELDS结构体定义如下：

typedef struct _TIME_FIELDS {
    CSHORT Year;        // range [1601...]
    CSHORT Month;       // range [1..12]
    CSHORT Day;         // range [1..31]
    CSHORT Hour;        // range [0..23]
    CSHORT Minute;      // range [0..59]
    CSHORT Second;      // range [0..59]
    CSHORT Milliseconds;// range [0..999]
    CSHORT Weekday;     // range [0..6] == [Sunday..Saturday]
} TIME_FIELDS;
typedef TIME_FIELDS *PTIME_FIELDS;

实现如下：

CHAR szTime[128];

LARGE_INTEGER systemTime, localTime;

TIME_FIELDS timeField;

KeQuerySystemTime(&systemTime)；

ExSystemTimeToLocalTime（&systemTime, &localTime);

RtlTimeToTimeFields（&localTime, &timeField);

sprintf("%d-%02d-%02d %02d:%02d:%02d:%03d",timeField.Year, timeField.Month, timeField.Day, timeField.Hour, timeField.Minute, timeField.Second, timeField.Milliseconds);