[分享]年末系列（2）

重要的事情说三遍，
加速器，加速器，加速器
大部分代码因为硬盘没了，剩下核心功能代码还在，还可以看看仅作参考啦
无需任何hook，不卡HAL时钟，不会导致硬盘io锁死问题。
不需要DX初始化来让系统时钟重置。
支持x64(代码只支持win7x64——需要签名！！
支持更多系统需要把PFN的数据结构改成对应的系统的)
加速原理：
PTE篡改PFN+MmPfn加锁Lock PFN，然后系统线程里自己同步刷新进程时钟...
除了可以加速之外还可以锁时间（年月日）
老司机开车 代码讨论与各种扯淡的QQ群：48715131

#include "stdafx.h"
#include "PageHack.h"
//////////////////////////////////////////////////////////////////////////
#include <list>
#include <algorithm>
std::list <PEPROCESS> m_Process_Speed;
//////////////////////////////////////////////////////////////////////////
LONG g_ThreadLock = 0;
BOOL b_Stop = FALSE;
PVOID pBuffer = NULL;
PVOID pKiUserSharedData = NULL;
FAST_MUTEX g_Process_Lock;
//////////////////////////////////////////////////////////////////////////
#define KUSER_SHARED_DATA_RING0 0xFFFFF78000000000UI64
#define KUSER_SHARED_DATA_RING3 0x7FFE0000
ULONG   TickCountMultiplierOffset = 0x04;
ULONG   TickCountLowOffset = 0x00;
ULONG   TickCountLow320Offset = 0x320;
ULONG   TickCountHigh1TimeOffset = 0x324;
ULONG   TickCountHigh2TimeOffset = 0x328;
ULONG   PerformanceCounterOffset = 0x3B8;
ULONG   PerformanceCounterFlagOffset = 0x2ED;
//////////////////////////////////////////////////////////////////////////
EXTERN_C VOID  TimeUpdate(__in PVOID  StartContext)
{
	ULONGLONG OldTickCount = 0;
	ULONGLONG OldPerformanceCounter = 0;
	//PVOID pKiUserSharedData = NULL;
	auto speed = 5;
	//pKiUserSharedData = StartContext;
	KeLowerIrql(PASSIVE_LEVEL);
	while (!b_Stop)
	{
		ULONGLONG NowTickCount = 0;
		InterlockedIncrement(&g_ThreadLock);
		Sleep(1);
		if (!MmIsAddressValid(pKiUserSharedData))
		{
			return;
		}
		__try
		{
			memcpy(pKiUserSharedData, (PVOID)KUSER_SHARED_DATA_RING0, sizeof(KUSER_SHARED_DATA));
			auto pTickCountMultiplier = (PULONG)((ULONG_PTR)pKiUserSharedData + TickCountMultiplierOffset);
			//auto pTickCountLow = (PULONG)((ULONG_PTR)pKiUserSharedData + TickCountLowOffset);
			auto pTickCountLow320 = (PULONGLONG)((ULONG_PTR)pKiUserSharedData + TickCountLow320Offset);
			auto pFlags = (PBYTE)((ULONG_PTR)pKiUserSharedData + PerformanceCounterFlagOffset);
			auto pPerformanceCounter = (PULONGLONG)((ULONG_PTR)pKiUserSharedData + PerformanceCounterOffset);
			auto Mutil = (ULONGLONG)(*pTickCountMultiplier);
			auto NowPerformanceCounter = *pPerformanceCounter;
			//这里有个问题不能主动设置Flag,So 还需要hook NtQueryPerformanceCounter才行！
			//如果主动flag|=1的话，会爆炸..
			// (*pFlags)
			if (*pFlags & 1)
			{
				if (OldPerformanceCounter == 0)
				{
					OldPerformanceCounter = NowPerformanceCounter;
				}
				auto pfix = NowPerformanceCounter - OldPerformanceCounter;
				if (NowPerformanceCounter < OldPerformanceCounter)
				{
					pfix = 0;
					OldPerformanceCounter = NowPerformanceCounter;
				}
				if (pfix != 0)
				{
					*pPerformanceCounter = NowPerformanceCounter;// +pfix * speed;//2倍速加速PerformanceCount!!
				}
			}
			NowTickCount = (*pTickCountLow320) * Mutil;
			if (OldTickCount == 0)
			{
				OldTickCount = NowTickCount;
			}
			auto delta = NowTickCount - OldTickCount;
			if (OldTickCount > NowTickCount)
			{
				OldTickCount = NowTickCount;
				delta = 0;
			}
			if (delta != 0)
			{
				*pTickCountLow320 = ((OldTickCount + delta*speed + Mutil) / Mutil);
			}
		}
		__except (EXCEPTION_EXECUTE_HANDLER)
		{
		}
		InterlockedDecrement(&g_ThreadLock);
	}
}
//////////////////////////////////////////////////////////////////////////
VOID LoadTLB()
{
	__try
	{
		auto Load = *(PULONG *)KUSER_SHARED_DATA_RING3;
		DbgPrint("TLB CMD %d\r\n", Load);
	}
	__except (EXCEPTION_EXECUTE_HANDLER)
	{
		return;
	}
}
VOID ModifyTLB(PHYSICAL_ADDRESS phys)
{
	__try
	{
		auto Pte = MiGetPteAddress((PVOID)KUSER_SHARED_DATA_RING3);
		Pte->PageFrameNumber = phys.QuadPart >> 12;
		_ReadWriteBarrier();
		__invlpg((PVOID)KUSER_SHARED_DATA_RING3);
	}
	__except (EXCEPTION_EXECUTE_HANDLER)
	{
	}
}
//////////////////////////////////////////////////////////////////////////
_Use_decl_annotations_
EXTERN_C
VOID CreateProcessNotifyRoutine(__in HANDLE ParentId, __in HANDLE ProcessId, __in BOOLEAN Create)
{
	PEPROCESS Process = NULL;
	auto ns = PsLookupProcessByProcessId(ProcessId, &Process);
	if (NT_SUCCESS(ns))
	{
		auto scop = std::experimental::make_scope_exit([&]() {ObDereferenceObject(Process); });
		CHAR szName[17];
		RtlZeroMemory(szName, 17);
		RtlCopyMemory(szName, PsGetProcessImageFileName(Process), 16);
		_strlwr(szName);
		if (strstr(szName, "fifa16.exe") == NULL)
		{
			return;
		}
		if (Create)
		{
			ObReferenceObject(Process);
			ExAcquireFastMutex(&g_Process_Lock);
			m_Process_Speed.push_back(Process);
			ExReleaseFastMutex(&g_Process_Lock);
		}
		else
		{
			ExAcquireFastMutex(&g_Process_Lock);
			std::remove_if(m_Process_Speed.begin(), m_Process_Speed.end(), [&](PEPROCESS Cur) {return Process == Cur; });
			ExReleaseFastMutex(&g_Process_Lock);
		}
		PHYSICAL_ADDRESS phys;
		KAPC_STATE ApcState;
		KeStackAttachProcess(Process, &ApcState);
		auto scop2 = std::experimental::make_scope_exit([&]() {KeUnstackDetachProcess(&ApcState); });
		if (Create)
		{
			memcpy(pKiUserSharedData, (PVOID)KUSER_SHARED_DATA_RING0, 0x1000);
			phys = MmGetPhysicalAddress(pKiUserSharedData);
		}
		else
		{
			phys = MmGetPhysicalAddress((PVOID)KUSER_SHARED_DATA_RING0);
		}
		LoadTLB();
		ModifyTLB(phys);
		if (Create)
		{
			//修改PFN
			//处理WorkingSet蓝屏问题
			auto MmPfnDataBase = reinterpret_cast<PMMPFN>(PVOID(PFN_DATA_BASE));
			auto Pte = MiGetPteAddress((PVOID)KUSER_SHARED_DATA_RING3);
			auto PageFrameIndex = Pte->PageFrameNumber;
			auto Pfn1 = &MmPfnDataBase[PageFrameIndex];
			Pfn1->u3.e2.ReferenceCount = 2;
			Pfn1->u2.ShareCount = 2;
			Pfn1->u4.PrototypePte = 0;
		}
		return;
	}
	return;
}
//////////////////////////////////////////////////////////////////////////
_Use_decl_annotations_
EXTERN_C
NTSTATUS
MainDriverEntry(
	IN PDRIVER_OBJECT DriverObject,
	IN PUNICODE_STRING RegistryPath)
{
	UNREFERENCED_PARAMETER(RegistryPath);
	InitExtendApi();
	ExInitializeFastMutex(&g_Process_Lock);
	{
		wchar_t fname[MAX_PATH];
		UNICODE_STRING u_fname;
		TIME_FIELDS tf;
		LARGE_INTEGER time;
		LARGE_INTEGER offset;
		KeQuerySystemTime(&time);
		RtlTimeToTimeFields(&time, &tf);
		RtlStringCchPrintfW(fname, MAX_PATH, L"\\??\\Global\\C:\\$%d-%.2d-%.2d", tf.Year, tf.Month, tf.Day);
		RtlInitUnicodeString(&u_fname, fname);
	}
	//auto ns = InitMapPage(&MapForTime);
	pBuffer = ExAllocatePoolWithTag(NonPagedPool, 0x4000, 0);
	pKiUserSharedData = (PVOID)(((ULONG_PTR)pBuffer + 0xFFF) & ~0xFFF);
	//if (NT_SUCCESS(ns))
	{
		//开始搞起
	//	auto scop = std::experimental::make_scope_exit([&]() { FiniMapPage(&MapForTime); });
		auto ns = PsSetCreateProcessNotifyRoutine(CreateProcessNotifyRoutine, FALSE);
		if (!NT_SUCCESS(ns))
		{
			return ns;
		}
		if (pKiUserSharedData)
			CreateThread(TimeUpdate, pKiUserSharedData);
		/*	auto scop2 = std::experimental::make_scope_exit([&]() { PsSetCreateProcessNotifyRoutine(CreateProcessNotifyRoutine, TRUE); });
			if (!CreateThread(TimeUpdate, NULL))
			{
				return STATUS_UNSUCCESSFUL;
			}
			scop2.release();*/
			//	scop.release();
		DriverObject->DriverUnload = NULL;
		return ns;
	}
	return STATUS_UNSUCCESSFUL;
}
_Use_decl_annotations_
EXTERN_C
void
UnLoad(
	__in PDRIVER_OBJECT driverObject
	)
{
	UNREFERENCED_PARAMETER(driverObject);
	DbgPrint("DrvUnLoad");
	//b_Stop = TRUE;
	//while (g_ThreadLock != 0) _mm_pause();
	//PsSetCreateProcessNotifyRoutine(CreateProcessNotifyRoutine, TRUE);
	//ExAcquireFastMutex(&g_Process_Lock);
	//for (auto x:m_Process_Speed)
	//{
	//	KAPC_STATE Apc;
	//	KeStackAttachProcess(x,&Apc);
	//	ZwTerminateProcess()
	//	KeUnstackDetachProcess(&Apc);
	//}
	//ExReleaseFastMutex(&g_Process_Lock);
	//FiniMapPage(&MapForTime);
	//ExFreePool(pBuffer);
	//UnloadInlineHookEngine();
	//LogTermination();
	return;
}