macro readtick
 {
  mov edx,7FFE0000h
  mov eax,dword [edx]
  mul dword [edx+4]
  shrd eax,edx,24
  ;...and ticks will result in eax
 }

    

include 'win32ax.inc'

.data
title db '...',0
num1 dd ?
text db 'GetTickCount: %u',13,10,'Direct Access: %u',0
buf rb 256

.code
start:
invoke GetTickCount
mov [num1],eax

mov edx,7FFE0000h
mov eax,dword [edx]
mul dword [edx+4]
shrd eax,edx,24

cinvoke wsprintf,buf,text,[num1],eax
invoke MessageBox,NULL,buf,title,MB_OK
invoke ExitProcess,0
.end start
    

include 'win32ax.inc'

.data
DA    db 'Direct Access',0
GTT   db 'GetTickCount',0
time1 dd ? 
time2 dd ? 
title db '...',0  
num1  dd ?
text  db '100,000,000 times:',13,10,'GetTickCount: %u ms',13,10,'Direct Access: %u ms',13,10,\
         13,10,'%s is faster by about %u ms',0
buf rb 256

.code  
start: 
mov ecx,100000000 
invoke GetTickCount 
mov [time1],eax 
loop1: 
invoke GetTickCount 
loop loop1 
sub eax,[time1] 
mov [time1],eax 
mov ecx,100000000
invoke GetTickCount 
mov [time2],eax 
loop2: 
mov edx,7FFE0000h  
mov eax,dword [edx]  
mul dword [edx+4]  
shrd eax,edx,24  
loop loop2 
sub eax,[time2] 
cmp eax,[time1]
ja label1
mov ebx,DA
mov ecx,[time1]
sub ecx,eax
mov [num1],ecx
jmp end1

label1:
mov ebx,GTT
mov ecx,eax
sub ecx,[time1]
mov [num1],ecx
end1:
cinvoke wsprintf,buf,text,[time1],eax,ebx,[num1]
invoke MessageBox,NULL,buf,title,MB_OK  
invoke ExitProcess,0  
.end start    

It resides permantly at 0x7ffe0000, in every version of Windows NT+. mapped into EVERY process.

So, does this work on all windows versions?

KERNEL32.GetTickCount:
  mov ecx,[7FFE0004] ; =$0FA00000
  mov rax,[7FFE0320]
  imul rax,rcx
  shr rax,24
  ret    

I guess it doesn't matter, it's not like I'm gonna need to do millions of GetTickCount's quickly.

KERNEL32.GetSystemTimeAsFileTime:
  mov edx,[7FFE0018] ; []=01C92B44
  mov r8d,[7FFE0014] ; []=00D8D2B0
  mov eax,[7FFE001C] ; []=01C92B44
  cmp edx,eax
  jnz KERNEL32.GetSystemTimeAsFileTime
  mov [rcx],r8d
  mov [rcx+04],edx
  ret    

=========
GetTickCount
=========
:7C80929C BA0000FE7F              mov edx, 7FFE0000
:7C8092A1 8B02                    mov eax, dword[edx]
:7C8092A3 F76204                  mul dword[edx+04]
:7C8092A6 0FACD018                shrd eax, edx, 18
:7C8092AA C3                      ret  
    

Code:

KERNEL32.GetSystemTimeAsFileTime:
  mov edx,[7FFE0018] ; []=01C92B44
  mov r8d,[7FFE0014] ; []=00D8D2B0
  mov eax,[7FFE001C] ; []=01C92B44
  cmp edx,eax
  jnz KERNEL32.GetSystemTimeAsFileTime
  mov [rcx],r8d
  mov [rcx+04],edx
  ret    

...kind of interested in how long that delay could be?
Or if this is a realistic way to insure the value is correct?

Perhaps the variables located at 7FFEXXXX are marked as "volatile", so it can't transform two 32-bit copies into one 64-bit wide copy automatically, that would violate the program semantics.

Yes, an assembly programmer would spot the silliness of the 32bit reads in an instant. Unfortunately, compilers are not so smart as we might like them to be ... yet.

hopcode wrote:

It resides permantly at 0x7ffe0000, in every version of Windows NT+. mapped into EVERY process.

That is not true for all versions of Windows NT+, some versions are 3Gig aware.