A forum for reverse engineering, OS internals and malware analysis 

Forum for discussion about kernel-mode development.
 #23282  by fsdhook
 Fri Jul 04, 2014 1:08 pm
Hi, everyone.

I want to make the system time go faster. So I hook KeQueryPerformanceCounter & KeUpdateSystemTime.

But when I hook these two functions, the system become very disfluency, it means that you cannot use WINDOWS smoothly(XP and WIN7-32).

If I hook KeQueryPerformanceCounter in WIN8-32 and WIN8.1-32, the system time go faster, without any side effect (KeUpdateSystemTime is not exist on WIN8 and WIN8.1, so we don't need to hook them).

Who can tell me the reason? :D
Code: Select all
ULONG dwSpeed = 1000, dwSpeedBase = 100; //10x faster speed
LARGE_INTEGER liLastRealTime, liLastReturnTime, liTest;

NTSTATUS __fastcall Proxy_KeUpdateSystemTime(int a1, unsigned int a2, char a3)
{
	NTSTATUS st;
	a2=a2*(dwSpeed/dwSpeedBase);
	st=Ori_KeUpdateSystemTime(a1,a2,a3);
	return st;
}

LARGE_INTEGER __stdcall Proxy_KeQueryPerformanceCounter(PLARGE_INTEGER PerformanceFrequency)
{
	LARGE_INTEGER liRealTime;
	LARGE_INTEGER liReturnTime;
	LONGLONG llMid;
	liRealTime = Ori_KeQueryPerformanceCounter(PerformanceFrequency);
	llMid = (liRealTime.QuadPart - liLastRealTime.QuadPart) * dwSpeed / dwSpeedBase;
	liReturnTime.QuadPart = liLastReturnTime.QuadPart + llMid;
	liLastRealTime.QuadPart = liRealTime.QuadPart;
	liLastReturnTime.QuadPart = liReturnTime.QuadPart;
	return liReturnTime;
}
 #23284  by TETYYSs
 Fri Jul 04, 2014 1:52 pm
Well, I guess it is similar to "Speed hack" functionality in CE. When enabled in game, of course, not only game clock speeds up, but whole game goes faster, because some of functions depends on current clock (timed events). So Windows also haves functions that depends on current time, and when time goes not as usual, of course system goes not as usual.

Not sure about different versions, guess those functions doesn't depend on time, or uses something else to get time. I'm sure you will see some side effects using Windows programs, when time is not stable.
 #23286  by fsdhook
 Fri Jul 04, 2014 10:38 pm
TETYYSs wrote:Well, I guess it is similar to "Speed hack" functionality in CE. When enabled in game, of course, not only game clock speeds up, but whole game goes faster, because some of functions depends on current clock (timed events). So Windows also haves functions that depends on current time, and when time goes not as usual, of course system goes not as usual.

Not sure about different versions, guess those functions doesn't depend on time, or uses something else to get time. I'm sure you will see some side effects using Windows programs, when time is not stable.
Hello, I don't find this function in CE 6.4 source code.
Could you tell me some open source projects with the same function? I want to learn how to realize it. :D
 #23289  by fsdhook
 Sat Jul 05, 2014 6:09 am
TETYYSs wrote:Well it is there in 6.2 Image, it just hooks time functions to speed them up.

It is in speedhack\speedhackmain.pas .
Holy shit! I don't know PASCAL language... :o
I think CE is realize this function in kernel mode before.
 #23295  by TETYYSs
 Sat Jul 05, 2014 5:15 pm
fsdhook wrote: I think CE is realize this function in kernel mode before.
I didn't understand a work in this, but CE uses user-mode hooks to speed up time in certain process, so if you need just to speed up your time clock in Explorer, use user-mode hook.
 #23473  by myid
 Wed Jul 30, 2014 1:56 pm
TETYYSs wrote:
fsdhook wrote: I think CE is realize this function in kernel mode before.
I didn't understand a work in this, but CE uses user-mode hooks to speed up time in certain process, so if you need just to speed up your time clock in Explorer, use user-mode hook.
OK, thanks.