You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
- Required data is now searched only on defined PE sections instead of linearly searching from beginning of kernel to the end, eliminating the page faults. (#3#6)
- Expiration date is now erased from SharedData only if patch fully succeeds, instead of erasing it as a first step, thus solving the confusion when patch fails midway.
- VS 2013 w/ WDK 8.1 build config added, which supports from NT 6.1 (and potentially 6.0, though untested) onwards. This was required because M$ killed the support for 32-bit and anything prior to NT 10.0 with latest WDK 11 update.
- Some code cleanup.
- GPLv3 license added.
////KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "TimeDefuser: ExpTimeRefreshWork found at 0x%p\n", MmGetSystemRoutineAddress(&us)));
93
-
//
94
-
//KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "TimeDefuser: Adjusted Kernel Base address is 0x%p and size is %lu\n", KernelBase, KernelSize2));
95
-
96
-
// Search for PE headers
97
-
constshort header = 0x5a4d;
75
+
// Check for PE Header existance.
76
+
constshort header = 0x5a4d; // MZ
98
77
if (*(short*)KernelBase != header) {
99
78
KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "[X] TimeDefuser: PE Header not found!\n"));
// Search for PAGELK section at PE sections. This section is where the
108
-
//ExpTimeRefreshWork function is located at, which later calls a function named "ExGetExpirationDate"
109
-
//so we are going to use its RVA and size for finding the function location.
86
+
// Search for "PAGEDATA" section at PE sections. This section is where the
87
+
//ExpNtExpirationDate timestamp variable is located at, so we are going
88
+
// to use its RVA and size for finding the function location.
110
89
111
90
for (size_t i = 0; i < 768; i++) {
112
-
if (KernelBase[i] == sectName) { // Check if we found the PAGELK\0\0 section name.
113
-
KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "[+] TimeDefuser: PAGELK Section found at 0x%p with size %d\n",&KernelBase[i], *(int*)&KernelBase[i + 1]));
91
+
if (KernelBase[i] == sectNamePAGE) { // Check if we found the PAGEDATA section name.
92
+
KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "[+] TimeDefuser: PAGEDATA Section found at 0x%p with size %d\n",&KernelBase[i], *(int*)&KernelBase[i + 1]));
114
93
KernelSize2 = *(int*)&KernelBase[i + 1]; // Get the section size
115
94
// Get the function RVA and append it to kernel base address.
116
-
int* asd = (int*)&KernelBase[i + 1];
117
-
PotentialTimeRef += asd[1];
95
+
int* asd = (int*)&KernelBase[i + 1];
96
+
PotentialTimestamp += asd[1];
118
97
break;
119
98
}
120
99
}
121
-
if (!PotentialTimeRef) {
122
-
KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "[X] TimeDefuser: PAGELK Section not found!\n"));
100
+
if (PotentialTimestamp == (unsignedchar*)KernelBase) {
101
+
KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "[X] TimeDefuser: PAGEDATA Section not found!\n"));
123
102
goto patchFail;
124
103
}
125
104
126
-
// Search for the ExpTimeRefreshWork function at the address we got from PAGELK.
127
-
// Finding it is easy because it has one of only two references to expiration date address at KUSER
128
-
KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "[+] TimeDefuser: searching at 0x%p in %d bytes\n", PotentialTimeRef, KernelSize2));
129
-
for (size_t i = 0; i < KernelSize2; i += 4096) {
130
-
// Check if given address is valid to prevent page faults
131
-
if (!MmIsAddressValid(&PotentialTimeRef[i])) {
132
-
//KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "- TimeDefuser: Page 0x%p is not valid.\n", &PotentialTimeRef[i]));
133
-
continue;
105
+
// Search for timebomb stamp in memory
106
+
CHAR occurance = FALSE;
107
+
void* pExpNtExpirationDate = NULL;
108
+
109
+
KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "[+] TimeDefuser: searching for stamp at 0x%p in %d bytes\n", PotentialTimestamp, KernelSize2));
110
+
111
+
KernelSize2;
112
+
for (size_t i = 0; i < KernelSize2; i++) {
113
+
if (*(unsignedlonglong*)&PotentialTimestamp[i] == TimebombStamp) {
114
+
KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "[+] TimeDefuser: Timebomb stamp found at 0x%p\n", &PotentialTimestamp[i]));
KdPrintEx((DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "[X] TimeDefuser: could not find ExpTimeRefreshWork!\n"));
180
224
returnSTATUS_FAILED_DRIVER_ENTRY;
181
225
182
226
patchOK:
227
+
li->QuadPart = 0; // Clear the ExpirationdDate field in SharedData. This is the last step so it will stay there in case of failure and won't cause any false positives anymore.
0 commit comments