Re: [PATCH v3 0/1] MR6007: ntdll: Don't use CLOCK_REALTIME_COARSE

[Tatsuyuki Ishi (＠ishitatsuyuki)]

On Thu Jul 11 16:27:08 2024 +0000, Grigory Vasilyev wrote:
> @ishitatsuyuki I'll quote youPaul Gofman:
> We didn't yet encounter an app which is confirmed depending on Windows
> sleep granularity
>
> Provide code examples, or are you hiding secret malware developments?
> NtDelayExecution is used to suspend execution, similiar to the Sleep()
> API function. This function can be used by malware for evasion purposes.

I've already resolved this offline with Gofman because having a productive discussion with a confrontational, overconfident and unprofessional "academic" is just impossible.

Just leave it to Huw for review, the description already says it all.