Skip to content

Commit 0237f3b

Browse files
NevermindExpressNevermindExpress
committed
1.5.2
- Searching now starts from PAGELK and includes next 4 sections, instead of starting from PAGE and searching next 3 sections. (a.k.a. search now starts from 1 section prior.), solves #1 (comment) - Service startup mode is now set to demand start, permanently solves #4 and other problems with signature enforcement.
1 parent f6a5b4a commit 0237f3b

6 files changed

Lines changed: 75 additions & 64 deletions

File tree

‎Driver.c‎

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
88
unsigned long long* KernelBase = NULL; // Kernel Base address
99
ULONG KernelSize = 0; // Kernel image size
1010
unsigned int KernelSize2 = 0; // Var used in loops as a max value
11-
PAGESections ps[4] = { 0 }; // PE sections that name starts with "PAGE"
11+
PAGESections ps[5] = { 0 }; // PE sections that name starts with "PAGE"
1212
unsigned char* PotentialTimestamp; // Potential address of ExNtExpirationDate/a
1313

1414
// Unrefence unused variables.
@@ -100,21 +100,18 @@ NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
100100
break;
101101
}
102102

103-
const __int64 sectNamePAGELK = 0x0000000045474150; // "PAGE\0\0\0\0"
104-
105-
106103
// Search for PAGE section at PE sections. This section or one of the next three sections is where the
107104
// "ExpTimeRefreshWork" function is located at, which later calls a function named "ExGetExpirationDate".
108105
// Due to it's variable being, we will search the PAGE section and next three sections.
109106

110107
for (size_t i = 0; i < 768; i++) {
111-
if (KernelBase[i] == sectNamePAGE) { // Check if we found the PAGE\0\0\0\0 section name.
112-
TDPrint("[+] TimeDefuser: PAGE Section found at 0x%p with size %d\n", &KernelBase[i], *(int*)&KernelBase[i + 1]);
108+
if (KernelBase[i] == sectNamePAGELK) { // Check if we found the PAGELK\0\0 section name.
109+
TDPrint("[+] TimeDefuser: PAGELK Section found at 0x%p with size %d\n", &KernelBase[i], *(int*)&KernelBase[i + 1]);
113110
int* temp = (int*)&KernelBase[i + 1];
114111
ps[0].size = temp[0]; // Get the section size
115112
ps[0].RVA = temp[1]; // and RVA
116113
// Get the RVA and size of next three sections.
117-
for (char j = 1; j < 4; j++) {
114+
for (char j = 1; j < 5; j++) {
118115
temp += 10;
119116
ps[j].size = temp[0]; // Get the section size
120117
ps[j].RVA = temp[1]; // and RVA
@@ -124,7 +121,7 @@ NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
124121
}
125122

126123
if (!ps[0].size) {
127-
TDPrint("[X] TimeDefuser: PAGE Section not found!\n");
124+
TDPrint("[X] TimeDefuser: PAGELK Section not found!\n");
128125
goto patchFail;
129126
}
130127

‎README.md‎

Lines changed: 22 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
TimeDefuser is a kernel-mode Windows driver that patches the kernel to neutralize the expiration date (a.k.a. timebomb),
33
which is seen on most prerelease builds that has been ever compiled.
44

5-
This patch patches the timebomb code itself in the kernel so it is the most effective and versatile way to neutralize it, instead of activation patching which is not available in many builds.
5+
This patch patches the timebomb code itself in the kernel so it is the most effective and versatile way to neutralize it, instead of activation patching (i.e. policy files or registry editing) which is not available in many builds.
66

77
All builds are theoretically supported but not all builds are tested, see the notes for more info, or the end of this readme for screenshots.
88

@@ -34,11 +34,14 @@ It will not remove the expiration date of
3434
- Certain builds such as aforementioned are also subject to crashes by PatchGuard, while others such as the ones with the screenshots below are not. See https://github.com/NevermindExpress/TimeDefuser/issues/5#issuecomment-3369399950
3535
- Few builds can be patched with policy/spp files replacement. **Again, I KNOW 'THEY' CAN BE PATCHED**. "MUH FBL builds can be patched by doing X/can be used at current date without doing anything" well, my thing can patch **ALL** versions (except ones that have superior PatchGuard) while your method can only fix a few builds.
3636
### Windows 10/11
37-
- Untested. Likely same as 8 unless KASLR is enabled, which is not supported by this driver.
37+
> [!IMPORTANT]
38+
> Windows 10 builds are also subject to flight signing, which are code signatures that gets invalid after expiration date, thus preventing system from booting or to be used properly.
39+
> Getting over this requires additional work (resigning all binaries and disabling integrity checks, or patching bootloader & ci.dll) which is not covered by this project.
40+
- Works on pre-RTM, post-RTM ("insider") builds are untested but they likely are same as pre-RTM unless KASLR is enabled, which is not supported by this driver.
3841

3942
# Usage
40-
1. Enable test-signing (and also disable driver signature enforcement at boot if you end up with boot recovery or signature error at boot)
41-
2. Download the latest release and obtain "devcon" utility (available in WDK).
43+
1. Enable test-signing (disabling driver signature enforcement might also be necessary.)
44+
2. Download the latest release and obtain "devcon" utility (available in WDK and also in some .cab files).
4245
3. Execute `devcon install C:\Path\to\TimeDefuser.inf Root\TimeDefuser`
4346
4. Allow the installition and wait for "Driver Installition Complete" message
4447
5. If your system didn't crash so far, check expiration date from "winver", if it's not there that means that it worked.
@@ -50,18 +53,21 @@ In all cases the usage of kernel debugger is required to tell which one of those
5053

5154
Driver logs will look like this when it works:
5255
```
53-
[*] TimeDefuser: version 1.5 loaded | Compiled on Oct 13 2025 01:44:57 | https://github.com/NevermindExpress/TimeDefuser
54-
[+] TimeDefuser: SystemExpirationDate is 0x10B72980
55-
[+] TimeDefuser: Kernel Base address is 0x81090000 and size is 5038080
56-
[+] TimeDefuser: PAGE Section found at 0x81090478 with size 2164706
57-
[+] TimeDefuser: searching at 0x8123C000 in 2164706 bytes
58-
[+] TimeDefuser: searching at 0x8144D000 in 18976 bytes
59-
[+] TimeDefuser: searching at 0x81452000 in 77340 bytes
60-
[+] TimeDefuser: Potential TimeRef found at 0x81463037
61-
[+] TimeDefuser: ExGetExpirationDate found at 0x813DE8F9
56+
[*] TimeDefuser: version 1.5.2 loaded | Compiled on Nov 10 2025 12:13:16 | https://github.com/NevermindExpress/TimeDefuser
57+
[+] TimeDefuser: SystemExpirationDate is 0x1d0fca547506980
58+
[+] TimeDefuser: Kernel Base address is 0xFFFFF802D388C000 and size is 8658944
59+
[+] TimeDefuser: PAGEDATA Section found at 0xFFFFF802D388C488 with size 62464
60+
[+] TimeDefuser: searching for stamp at 0xFFFFF802D3FF5000 in 62464 bytes
61+
[+] TimeDefuser: Timebomb stamp found at 0xFFFFF802D3FF5A10
62+
[+] TimeDefuser: ExpNtExpirationDate address is 0xFFFFF802D3FF5A10 (first occurrance)
63+
[+] TimeDefuser: PAGELK Section found at 0xFFFFF802D388C348 with size 98932
64+
[+] TimeDefuser: searching at 0xFFFFF802D3C62000 in 98932 bytes
65+
[+] TimeDefuser: Potential TimeRef found at 0xFFFFF802D3C63638
66+
[+] TimeDefuser: ExGetExpirationDate found at 0xFFFFF802D3E02BB4
6267
[*] TimeDefuser: Patch completed successfully.
6368
```
64-
[(same thing as an image)](https://github.com/user-attachments/assets/cc475da5-e624-45e3-aaf2-cd22a7e65a8b)
69+
[(same thing as an image)](https://github.com/user-attachments/assets/7e48a48e-a2dc-4872-8825-6aa98df641e3)
70+
6571

6672
Builds with debug symbols are recommended to try, due to symbols making debugging much easier.
6773

@@ -89,10 +95,11 @@ Builds with debug symbols are recommended to try, due to symbols making debuggin
8995

9096

9197
# Screenshots
92-
![Windows 8175 x64-2025-05-04-16-05-34](https://github.com/user-attachments/assets/380167b9-e24a-458a-b5ba-597313c6bbd3)
9398
![Windows 7973 x64-2025-05-04-16-08-40](https://github.com/user-attachments/assets/f3d3a116-5b67-4b8f-bd4c-d907485a435b)
99+
![Windows 10072 x64-2025-11-10-12-53-19](https://github.com/user-attachments/assets/02bb0087-762a-4a2b-98c9-16b3bf850a0d)
94100
![Windows 2526-2025-05-08-17-39-56](https://github.com/user-attachments/assets/24e4f5c9-5cdc-4eae-b91f-dc13bb93a22c)
95101

102+
96103
# Thanks to
97104
- **Microsoft** for Windows, Windbg and all else.
98105
- **archive.org and BetaArchive** for preserving beta builds and debug symbols.

‎TimeDefuser-vs13.sln‎

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -3,28 +3,28 @@ Microsoft Visual Studio Solution File, Format Version 12.00
33
# Visual Studio 2013
44
VisualStudioVersion = 12.0.21005.1
55
MinimumVisualStudioVersion = 10.0.40219.1
6-
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "TimeDefuser", "TimeDefuser-vs13.vcxproj", "{D2AF6553-1794-482F-9A99-94166BDCBAA0}"
6+
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "TimeDefuser", "TimeDefuser-vs13.vcxproj", "{485FBB3F-2675-431D-A4D1-54A7294C76A2}"
77
EndProject
88
Global
99
GlobalSection(SolutionConfigurationPlatforms) = preSolution
10-
Win7 Debug|Win32 = Win7 Debug|Win32
11-
Win7 Debug|x64 = Win7 Debug|x64
12-
Win7 Release|Win32 = Win7 Release|Win32
13-
Win7 Release|x64 = Win7 Release|x64
10+
Debug|Win32 = Debug|Win32
11+
Debug|x64 = Debug|x64
12+
Release|Win32 = Release|Win32
13+
Release|x64 = Release|x64
1414
EndGlobalSection
1515
GlobalSection(ProjectConfigurationPlatforms) = postSolution
16-
{D2AF6553-1794-482F-9A99-94166BDCBAA0}.Win7 Debug|Win32.ActiveCfg = Win7 Debug|Win32
17-
{D2AF6553-1794-482F-9A99-94166BDCBAA0}.Win7 Debug|Win32.Build.0 = Win7 Debug|Win32
18-
{D2AF6553-1794-482F-9A99-94166BDCBAA0}.Win7 Debug|Win32.Deploy.0 = Win7 Debug|Win32
19-
{D2AF6553-1794-482F-9A99-94166BDCBAA0}.Win7 Debug|x64.ActiveCfg = Win7 Debug|x64
20-
{D2AF6553-1794-482F-9A99-94166BDCBAA0}.Win7 Debug|x64.Build.0 = Win7 Debug|x64
21-
{D2AF6553-1794-482F-9A99-94166BDCBAA0}.Win7 Debug|x64.Deploy.0 = Win7 Debug|x64
22-
{D2AF6553-1794-482F-9A99-94166BDCBAA0}.Win7 Release|Win32.ActiveCfg = Win7 Release|Win32
23-
{D2AF6553-1794-482F-9A99-94166BDCBAA0}.Win7 Release|Win32.Build.0 = Win7 Release|Win32
24-
{D2AF6553-1794-482F-9A99-94166BDCBAA0}.Win7 Release|Win32.Deploy.0 = Win7 Release|Win32
25-
{D2AF6553-1794-482F-9A99-94166BDCBAA0}.Win7 Release|x64.ActiveCfg = Win7 Release|x64
26-
{D2AF6553-1794-482F-9A99-94166BDCBAA0}.Win7 Release|x64.Build.0 = Win7 Release|x64
27-
{D2AF6553-1794-482F-9A99-94166BDCBAA0}.Win7 Release|x64.Deploy.0 = Win7 Release|x64
16+
{485FBB3F-2675-431D-A4D1-54A7294C76A2}.Debug|Win32.ActiveCfg = Debug|Win32
17+
{485FBB3F-2675-431D-A4D1-54A7294C76A2}.Debug|Win32.Build.0 = Debug|Win32
18+
{485FBB3F-2675-431D-A4D1-54A7294C76A2}.Debug|Win32.Deploy.0 = Debug|Win32
19+
{485FBB3F-2675-431D-A4D1-54A7294C76A2}.Debug|x64.ActiveCfg = Debug|x64
20+
{485FBB3F-2675-431D-A4D1-54A7294C76A2}.Debug|x64.Build.0 = Debug|x64
21+
{485FBB3F-2675-431D-A4D1-54A7294C76A2}.Debug|x64.Deploy.0 = Debug|x64
22+
{485FBB3F-2675-431D-A4D1-54A7294C76A2}.Release|Win32.ActiveCfg = Win7 Release|Win32
23+
{485FBB3F-2675-431D-A4D1-54A7294C76A2}.Release|Win32.Build.0 = Win7 Release|Win32
24+
{485FBB3F-2675-431D-A4D1-54A7294C76A2}.Release|Win32.Deploy.0 = Win7 Release|Win32
25+
{485FBB3F-2675-431D-A4D1-54A7294C76A2}.Release|x64.ActiveCfg = Release|x64
26+
{485FBB3F-2675-431D-A4D1-54A7294C76A2}.Release|x64.Build.0 = Release|x64
27+
{485FBB3F-2675-431D-A4D1-54A7294C76A2}.Release|x64.Deploy.0 = Release|x64
2828
EndGlobalSection
2929
GlobalSection(SolutionProperties) = preSolution
3030
HideSolutionNode = FALSE

‎TimeDefuser-vs13.vcxproj‎

Lines changed: 28 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,20 @@
11
<?xml version="1.0" encoding="utf-8"?>
22
<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
33
<ItemGroup Label="ProjectConfigurations">
4-
<ProjectConfiguration Include="Win7 Debug|Win32">
5-
<Configuration>Win7 Debug</Configuration>
4+
<ProjectConfiguration Include="Debug|Win32">
5+
<Configuration>Debug</Configuration>
66
<Platform>Win32</Platform>
77
</ProjectConfiguration>
8-
<ProjectConfiguration Include="Win7 Release|Win32">
9-
<Configuration>Win7 Release</Configuration>
8+
<ProjectConfiguration Include="Release|Win32">
9+
<Configuration>Release</Configuration>
1010
<Platform>Win32</Platform>
1111
</ProjectConfiguration>
12-
<ProjectConfiguration Include="Win7 Debug|x64">
13-
<Configuration>Win7 Debug</Configuration>
12+
<ProjectConfiguration Include="Debug|x64">
13+
<Configuration>Debug</Configuration>
1414
<Platform>x64</Platform>
1515
</ProjectConfiguration>
16-
<ProjectConfiguration Include="Win7 Release|x64">
17-
<Configuration>Win7 Release</Configuration>
16+
<ProjectConfiguration Include="Release|x64">
17+
<Configuration>Release</Configuration>
1818
<Platform>x64</Platform>
1919
</ProjectConfiguration>
2020
</ItemGroup>
@@ -29,28 +29,28 @@
2929
<ProjectName>TimeDefuser</ProjectName>
3030
</PropertyGroup>
3131
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
32-
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win7 Debug|Win32'" Label="Configuration">
32+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
3333
<TargetVersion>Windows7</TargetVersion>
3434
<UseDebugLibraries>true</UseDebugLibraries>
3535
<PlatformToolset>WindowsKernelModeDriver8.1</PlatformToolset>
3636
<ConfigurationType>Driver</ConfigurationType>
3737
<DriverType>WDM</DriverType>
3838
</PropertyGroup>
39-
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win7 Release|Win32'" Label="Configuration">
39+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
4040
<TargetVersion>Windows7</TargetVersion>
4141
<UseDebugLibraries>false</UseDebugLibraries>
4242
<PlatformToolset>WindowsKernelModeDriver8.1</PlatformToolset>
4343
<ConfigurationType>Driver</ConfigurationType>
4444
<DriverType>WDM</DriverType>
4545
</PropertyGroup>
46-
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win7 Debug|x64'" Label="Configuration">
46+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
4747
<TargetVersion>Windows7</TargetVersion>
4848
<UseDebugLibraries>true</UseDebugLibraries>
4949
<PlatformToolset>WindowsKernelModeDriver8.1</PlatformToolset>
5050
<ConfigurationType>Driver</ConfigurationType>
5151
<DriverType>WDM</DriverType>
5252
</PropertyGroup>
53-
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win7 Release|x64'" Label="Configuration">
53+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
5454
<TargetVersion>Windows7</TargetVersion>
5555
<UseDebugLibraries>false</UseDebugLibraries>
5656
<PlatformToolset>WindowsKernelModeDriver8.1</PlatformToolset>
@@ -65,24 +65,30 @@
6565
</ImportGroup>
6666
<PropertyGroup Label="UserMacros" />
6767
<PropertyGroup />
68-
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win7 Debug|Win32'">
68+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
6969
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
70+
<TargetName>$(TargetName.Replace(' ',''))-x86</TargetName>
7071
</PropertyGroup>
71-
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win7 Release|Win32'">
72+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
7273
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
74+
<TargetName>$(TargetName.Replace(' ',''))-x86</TargetName>
7375
</PropertyGroup>
74-
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win7 Debug|x64'">
76+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
7577
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
78+
<TargetName>$(TargetName.Replace(' ',''))-amd64</TargetName>
79+
<OutDir>$(SolutionDir)\$(ConfigurationName)\</OutDir>
7680
</PropertyGroup>
77-
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Win7 Release|x64'">
81+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
7882
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
83+
<TargetName>$(TargetName.Replace(' ',''))-amd64</TargetName>
84+
<OutDir>$(SolutionDir)\$(ConfigurationName)\</OutDir>
7985
</PropertyGroup>
80-
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Win7 Debug|Win32'">
86+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
8187
<Link>
8288
<Version>6.0</Version>
8389
</Link>
8490
</ItemDefinitionGroup>
85-
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Win7 Release|Win32'">
91+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
8692
<Link>
8793
<Version>6.0</Version>
8894
</Link>
@@ -91,18 +97,19 @@
9197
<FilesToPackage Include="$(TargetPath)" />
9298
<FilesToPackage Include="@(Inf->'%(CopyOutput)')" Condition="'@(Inf)'!=''" />
9399
</ItemGroup>
94-
<ItemGroup>
95-
<ClCompile Include="Driver.cpp" />
96-
</ItemGroup>
97100
<ItemGroup>
98101
<ClInclude Include="resource.h" />
102+
<ClInclude Include="TimeDefuser.h" />
99103
</ItemGroup>
100104
<ItemGroup>
101105
<ResourceCompile Include="TimeDefuser.rc" />
102106
</ItemGroup>
103107
<ItemGroup>
104108
<None Include="TimeDefuser.inf" />
105109
</ItemGroup>
110+
<ItemGroup>
111+
<ClCompile Include="Driver.c" />
112+
</ItemGroup>
106113
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
107114
<ImportGroup Label="ExtensionTargets">
108115
</ImportGroup>

‎TimeDefuser.inf‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ Class = System
88
ClassGuid = {4d36e97d-e325-11ce-bfc1-08002be10318}
99
Provider = %ManufacturerName%
1010
CatalogFile = TimeDefuser.cat
11-
DriverVer = 10/15/2025,1.5.1.0
11+
DriverVer = 11/10/2025,1.5.2.0
1212
PnpLockdown = 1
1313

1414
[DestinationDirs]
@@ -45,7 +45,7 @@ TimeDefuser-x86.sys
4545
[Service_Inst_x86]
4646
DisplayName = %TimeDefuser.SVCDESC%
4747
ServiceType = 1 ; SERVICE_KERNEL_DRIVER
48-
StartType = 0 ; SERVICE_BOOT_START
48+
StartType = 3 ; SERVICE_DEMAND_START
4949
ErrorControl = 1 ; SERVICE_ERROR_NORMAL
5050
ServiceBinary = %12%\TimeDefuser-x86.sys
5151

@@ -64,7 +64,7 @@ TimeDefuser-amd64.sys
6464
[Service_Inst_amd64]
6565
DisplayName = %TimeDefuser.SVCDESC%
6666
ServiceType = 1 ; SERVICE_KERNEL_DRIVER
67-
StartType = 0 ; SERVICE_BOOT_START
67+
StartType = 3 ; SERVICE_DEMAND_START
6868
ErrorControl = 1 ; SERVICE_ERROR_NORMAL
6969
ServiceBinary = %12%\TimeDefuser-amd64.sys
7070

‎TimeDefuser.rc‎

8 Bytes
Binary file not shown.

0 commit comments

Comments
 (0)