重要的事情说三遍，
加速器，加速器，加速器
大部分代码因为硬盘没了，剩下核心功能代码还在，还可以看看仅作参考啦
无需任何hook，不卡HAL时钟，不会导致硬盘io锁死问题。
不需要DX初始化来让系统时钟重置。
支持x64(代码只支持win7x64——需要签名！！
支持更多系统需要把PFN的数据结构改成对应的系统的)
加速原理：
PTE篡改PFN+MmPfn加锁Lock PFN，然后系统线程里自己同步刷新进程时钟...
除了可以加速之外还可以锁时间（年月日）
老司机开车 代码讨论与各种扯淡的QQ群：48715131
#include "stdafx.h"
#include "PageHack.h"
//////////////////////////////////////////////////////////////////////////
#include <list>
#include <algorithm>
std::list <PEPROCESS> m_Process_Speed;
//////////////////////////////////////////////////////////////////////////
LONG g_ThreadLock = 0;
BOOL b_Stop = FALSE;
PVOID pBuffer = NULL;
PVOID pKiUserSharedData = NULL;
FAST_MUTEX g_Process_Lock;
//////////////////////////////////////////////////////////////////////////
#define KUSER_SHARED_DATA_RING0 0xFFFFF78000000000UI64
#define KUSER_SHARED_DATA_RING3 0x7FFE0000
ULONG TickCountMultiplierOffset = 0x04;
ULONG TickCountLowOffset = 0x00;
ULONG TickCountLow320Offset = 0x320;
ULONG TickCountHigh1TimeOffset = 0x324;
ULONG TickCountHigh2TimeOffset = 0x328;
ULONG PerformanceCounterOffset = 0x3B8;
ULONG PerformanceCounterFlagOffset = 0x2ED;
//////////////////////////////////////////////////////////////////////////
EXTERN_C VOID TimeUpdate(__in PVOID StartContext)
{
ULONGLONG OldTickCount = 0;
ULONGLONG OldPerformanceCounter = 0;
//PVOID pKiUserSharedData = NULL;
auto speed = 5;
//pKiUserSharedData = StartContext;
KeLowerIrql(PASSIVE_LEVEL);
while (!b_Stop)
{
ULONGLONG NowTickCount = 0;
InterlockedIncrement(&g_ThreadLock);
Sleep(1);
if (!MmIsAddressValid(pKiUserSharedData))
{
return;
}
__try
{
memcpy(pKiUserSharedData, (PVOID)KUSER_SHARED_DATA_RING0, sizeof(KUSER_SHARED_DATA));
auto pTickCountMultiplier = (PULONG)((ULONG_PTR)pKiUserSharedData + TickCountMultiplierOffset);
//auto pTickCountLow = (PULONG)((ULONG_PTR)pKiUserSharedData + TickCountLowOffset);
auto pTickCountLow320 = (PULONGLONG)((ULONG_PTR)pKiUserSharedData + TickCountLow320Offset);
auto pFlags = (PBYTE)((ULONG_PTR)pKiUserSharedData + PerformanceCounterFlagOffset);
auto pPerformanceCounter = (PULONGLONG)((ULONG_PTR)pKiUserSharedData + PerformanceCounterOffset);
auto Mutil = (ULONGLONG)(*pTickCountMultiplier);
auto NowPerformanceCounter = *pPerformanceCounter;
//这里有个问题不能主动设置Flag,So 还需要hook NtQueryPerformanceCounter才行！
//如果主动flag|=1的话，会爆炸..
// (*pFlags)
if (*pFlags & 1)
{
if (OldPerformanceCounter == 0)
{
OldPerformanceCounter = NowPerformanceCounter;
}
auto pfix = NowPerformanceCounter - OldPerformanceCounter;
if (NowPerformanceCounter < OldPerformanceCounter)
{
pfix = 0;
OldPerformanceCounter = NowPerformanceCounter;
}
if (pfix != 0)
{
*pPerformanceCounter = NowPerformanceCounter;// +pfix * speed;//2倍速加速PerformanceCount!!
}
}
NowTickCount = (*pTickCountLow320) * Mutil;
if (OldTickCount == 0)
{
OldTickCount = NowTickCount;
}
auto delta = NowTickCount - OldTickCount;
if (OldTickCount > NowTickCount)
{
OldTickCount = NowTickCount;
delta = 0;
}
if (delta != 0)
{
*pTickCountLow320 = ((OldTickCount + delta*speed + Mutil) / Mutil);
}
}
__except (EXCEPTION_EXECUTE_HANDLER)
{
}
InterlockedDecrement(&g_ThreadLock);
}
}
//////////////////////////////////////////////////////////////////////////
VOID LoadTLB()
{
__try
{
auto Load = *(PULONG *)KUSER_SHARED_DATA_RING3;
DbgPrint("TLB CMD %d\r\n", Load);
}
__except (EXCEPTION_EXECUTE_HANDLER)
{
return;
}
}
VOID ModifyTLB(PHYSICAL_ADDRESS phys)
{
__try
{
auto Pte = MiGetPteAddress((PVOID)KUSER_SHARED_DATA_RING3);
Pte->PageFrameNumber = phys.QuadPart >> 12;
_ReadWriteBarrier();
__invlpg((PVOID)KUSER_SHARED_DATA_RING3);
}
__except (EXCEPTION_EXECUTE_HANDLER)
{
}
}
//////////////////////////////////////////////////////////////////////////
_Use_decl_annotations_
EXTERN_C
VOID CreateProcessNotifyRoutine(__in HANDLE ParentId, __in HANDLE ProcessId, __in BOOLEAN Create)
{
PEPROCESS Process = NULL;
auto ns = PsLookupProcessByProcessId(ProcessId, &Process);
if (NT_SUCCESS(ns))
{
auto scop = std::experimental::make_scope_exit([&]() {ObDereferenceObject(Process); });
CHAR szName[17];
RtlZeroMemory(szName, 17);
RtlCopyMemory(szName, PsGetProcessImageFileName(Process), 16);
_strlwr(szName);
if (strstr(szName, "fifa16.exe") == NULL)
{
return;
}
if (Create)
{
ObReferenceObject(Process);
ExAcquireFastMutex(&g_Process_Lock);
m_Process_Speed.push_back(Process);
ExReleaseFastMutex(&g_Process_Lock);
}
else
{
ExAcquireFastMutex(&g_Process_Lock);
std::remove_if(m_Process_Speed.begin(), m_Process_Speed.end(), [&](PEPROCESS Cur) {return Process == Cur; });
ExReleaseFastMutex(&g_Process_Lock);
}
PHYSICAL_ADDRESS phys;
KAPC_STATE ApcState;
KeStackAttachProcess(Process, &ApcState);
auto scop2 = std::experimental::make_scope_exit([&]() {KeUnstackDetachProcess(&ApcState); });
if (Create)
{
memcpy(pKiUserSharedData, (PVOID)KUSER_SHARED_DATA_RING0, 0x1000);
phys = MmGetPhysicalAddress(pKiUserSharedData);
}
else
{
phys = MmGetPhysicalAddress((PVOID)KUSER_SHARED_DATA_RING0);
}
LoadTLB();
ModifyTLB(phys);
if (Create)
{
//修改PFN
//处理WorkingSet蓝屏问题
auto MmPfnDataBase = reinterpret_cast<PMMPFN>(PVOID(PFN_DATA_BASE));
auto Pte = MiGetPteAddress((PVOID)KUSER_SHARED_DATA_RING3);
auto PageFrameIndex = Pte->PageFrameNumber;
auto Pfn1 = &MmPfnDataBase[PageFrameIndex];
Pfn1->u3.e2.ReferenceCount = 2;
Pfn1->u2.ShareCount = 2;
Pfn1->u4.PrototypePte = 0;
}
return;
}
return;
}
//////////////////////////////////////////////////////////////////////////
_Use_decl_annotations_
EXTERN_C
NTSTATUS
MainDriverEntry(
IN PDRIVER_OBJECT DriverObject,
IN PUNICODE_STRING RegistryPath)
{
UNREFERENCED_PARAMETER(RegistryPath);
InitExtendApi();
ExInitializeFastMutex(&g_Process_Lock);
{
wchar_t fname[MAX_PATH];
UNICODE_STRING u_fname;
TIME_FIELDS tf;
LARGE_INTEGER time;
LARGE_INTEGER offset;
KeQuerySystemTime(&time);
RtlTimeToTimeFields(&time, &tf);
RtlStringCchPrintfW(fname, MAX_PATH, L"\\??\\Global\\C:\\$%d-%.2d-%.2d", tf.Year, tf.Month, tf.Day);
RtlInitUnicodeString(&u_fname, fname);
}
//auto ns = InitMapPage(&MapForTime);
pBuffer = ExAllocatePoolWithTag(NonPagedPool, 0x4000, 0);
pKiUserSharedData = (PVOID)(((ULONG_PTR)pBuffer + 0xFFF) & ~0xFFF);
//if (NT_SUCCESS(ns))
{
//开始搞起
// auto scop = std::experimental::make_scope_exit([&]() { FiniMapPage(&MapForTime); });
auto ns = PsSetCreateProcessNotifyRoutine(CreateProcessNotifyRoutine, FALSE);
if (!NT_SUCCESS(ns))
{
return ns;
}
if (pKiUserSharedData)
CreateThread(TimeUpdate, pKiUserSharedData);
/* auto scop2 = std::experimental::make_scope_exit([&]() { PsSetCreateProcessNotifyRoutine(CreateProcessNotifyRoutine, TRUE); });
if (!CreateThread(TimeUpdate, NULL))
{
return STATUS_UNSUCCESSFUL;
}
scop2.release();*/
// scop.release();
DriverObject->DriverUnload = NULL;
return ns;
}
return STATUS_UNSUCCESSFUL;
}
_Use_decl_annotations_
EXTERN_C
void
UnLoad(
__in PDRIVER_OBJECT driverObject
)
{
UNREFERENCED_PARAMETER(driverObject);
DbgPrint("DrvUnLoad");
//b_Stop = TRUE;
//while (g_ThreadLock != 0) _mm_pause();
//PsSetCreateProcessNotifyRoutine(CreateProcessNotifyRoutine, TRUE);
//ExAcquireFastMutex(&g_Process_Lock);
//for (auto x:m_Process_Speed)
//{
// KAPC_STATE Apc;
// KeStackAttachProcess(x,&Apc);
// ZwTerminateProcess()
// KeUnstackDetachProcess(&Apc);
//}
//ExReleaseFastMutex(&g_Process_Lock);
//FiniMapPage(&MapForTime);
//ExFreePool(pBuffer);
//UnloadInlineHookEngine();
//LogTermination();
return;
}
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
求科普原理
