驱动中打印系统时间

在驱动中打印本地时间三个步骤：
1、在驱动中调用KeQuerySystemTime获取GMT系统时间

2、调用ExSystemTimeToLocalTime将GMT系统时间转换为本地系统时间

3、调用RtlTimeToTimeFields将本地时间转换为TIME_FIELDS结构体

TIME_FIELDS结构体定义如下：

typedef struct _TIME_FIELDS {
    CSHORT Year; // range [1601...]
    CSHORT Month; // range [1..12]
    CSHORT Day; // range [1..31]
    CSHORT Hour; // range [0..23]
    CSHORT Minute; // range [0..59]
    CSHORT Second; // range [0..59]
    CSHORT Milliseconds;// range [0..999]
    CSHORT Weekday; // range [0..6] == [Sunday..Saturday]
} TIME_FIELDS;
typedef TIME_FIELDS *PTIME_FIELDS;


实现如下：

CHAR szTime[128];
LARGE_INTEGER systemTime, localTime;

TIME_FIELDS timeField;
KeQuerySystemTime(&systemTime)；

ExSystemTimeToLocalTime（&systemTime, &localTime);

RtlTimeToTimeFields（&localTime, &timeField);

sprintf("%d-%02d-%02d %02d:%02d:%02d:%03d",timeField.Year, timeField.Month, timeField.Day, timeField.Hour, timeField.Minute, timeField.Second, timeField.Milliseconds)

http://blog.csdn.net/eric_zl_zhang/article/details/6780786