The KeQueryRuntimeThread routine reports the accumulated kernel-mode and user-mode run time of a thread, in clock ticks.
NTKERNELAPI
ULONG
KeQueryRuntimeThread (
IN PKTHREAD Thread,
OUT PULONG UserTime
);
KeQueryRuntimeThread returns the accumulated kernel-mode run time of the current thread, in clock ticks.
Declared in wdm.h and ntddk.h. Include wdm.h or ntddk.h.