Skip to content

Commit ff22ae9

Browse files
NevermindExpressNevermindExpress
committed
1.8.2 merge legacy driver to normal one
1 parent 2578b95 commit ff22ae9

6 files changed

Lines changed: 83 additions & 137 deletions

File tree

‎.vs/TimeDefuser-VS2026.vcxproj.filters‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,6 @@
11
<?xml version="1.0" encoding="utf-8"?>
22
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
33
<ItemGroup>
4-
<Filter Include="tdwdm">
5-
<UniqueIdentifier>{e79a6596-9c12-4d86-9073-0b0aa23c42a7}</UniqueIdentifier>
6-
</Filter>
74
<Filter Include="Header Files">
85
<UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
96
<Extensions>h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd</Extensions>

‎src/Driver.c‎

Lines changed: 73 additions & 71 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
#include "TimeDefuser.h"
22

3-
#ifndef TD_LEGACY
43
BOOLEAN PatchExGetExpirationDate(void* pExGetExpirationDate) {
54
PMDL mdl = NULL;
65
unsigned char* map = NULL;
@@ -35,28 +34,25 @@ BOOLEAN PatchExGetExpirationDate(void* pExGetExpirationDate) {
3534
IoFreeMdl(mdl);
3635
return TRUE;
3736
}
38-
#endif
39-
#define PDRIVER_OBEJCT void* // Unused by TimeDefuser
4037

41-
NTSTATUS DriverEntry(void* DriverObject, PUNICODE_STRING RegistryPath) {
38+
NTSTATUS DriverEntry(PDRIVER_OBEJCT DriverObject, PUNICODE_STRING RegistryPath) {
4239
LARGE_INTEGER* li = KUSERSystemExpirationDate; // Address of SystemExpirationDate field at KUSER_SHARED_DATA
4340
unsigned long long TimebombStamp = 0; // Expiration date stamp
4441
RTL_PROCESS_MODULES ModuleInfo = { 0 }; // Structure used for getting kernel base address
4542
unsigned long long* KernelBase = NULL; // Kernel Base address
4643
ULONG KernelSize = 0; // Kernel image size
4744
//HANDLE hKey = OpenRegistryKey(RegistryPath);
4845
HANDLE hKey = 0;
49-
#ifndef TD_LEGACY
5046
unsigned int KernelSize2 = 0; // Var used in loops as a max value
5147
PAGESections ps[5] = { 0 }; // PE sections that name starts with "PAGE"
5248
unsigned char* PotentialTimestamp = NULL;// Potential address of ExNtExpirationDate/a
53-
#endif
49+
BOOLEAN Legacy = FALSE;
5450

5551
// Unrefence unused variables.
5652
UNREFERENCED_PARAMETER(DriverObject);
5753

5854
// Print version info.
59-
TDPrint("[*] TimeDefuser: version " td_version td_variant" loaded "
55+
TDPrint("[*] TimeDefuser: version " td_version " loaded "
6056
"| Compiled on " __DATE__ " " __TIME__ " "
6157
"| https://github.com/NevermindExpress/TimeDefuser\n");
6258

@@ -68,6 +64,16 @@ NTSTATUS DriverEntry(void* DriverObject, PUNICODE_STRING RegistryPath) {
6864
}
6965
TDPrint("[+] TimeDefuser: SystemExpirationDate is 0x%llx\n", TimebombStamp);
7066

67+
// Determine if we are running in a legacy system
68+
{
69+
int verMajor = 0;
70+
PsGetVersion(&verMajor, 0, 0, 0);
71+
if (verMajor == 5) {
72+
TDPrint("[*] TimeDefuser: Legacy system detected.\n");
73+
Legacy = TRUE;
74+
}
75+
}
76+
7177
// Get kernel base
7278
ZwQuerySystemInformation(SystemModuleInformation, &ModuleInfo, sizeof(ModuleInfo), 0);
7379
if (ModuleInfo.NumberOfModules == 0) {
@@ -80,77 +86,75 @@ NTSTATUS DriverEntry(void* DriverObject, PUNICODE_STRING RegistryPath) {
8086

8187
// Check whether addresses are cached
8288
if (hKey) {
83-
//if (CompareKernelVersion(hKey)) {
84-
if(0) {
85-
//// Get cached address offsets for timestamps.
86-
////int Stamp1 = RegReadValue(hKey, L"Stamp1", NULL, 0),
87-
//// Stamp2 = RegReadValue(hKey, L"Stamp2", NULL, 0);
88-
89-
//// Zero first timestamp
90-
////if (!Stamp1) {
91-
//if(1) {
92-
// // No cached address, assume nothing is cached.
93-
// goto patchBeginning;
94-
//}
95-
//TDPrint("[*] TimeDefuser: Cached addresses are found on registry.\n");
96-
//TDPrint("[+] TimeDefuser: Cached ExpNtExpirationDate address 0x%p is used.\n", (unsigned long long*)((char*)KernelBase + Stamp1));
97-
//*(unsigned long long*)((char*)KernelBase+Stamp1) = 0;
98-
//#ifdef TD_LEGACY
99-
// // On legacy, for some reason, actual timebomb stamp
100-
// // is the next qword (on XP 2526). We will zero that too.
101-
// *(unsigned long long*)((char*)KernelBase+Stamp1+8) = 0;
102-
//#endif
103-
//
104-
//// Zero second timestamp if available.
105-
//if (Stamp2) {
106-
// TDPrint("[+] TimeDefuser: Cached ExpNtExpirationData address 0x%p is used.\n", (char*)KernelBase + Stamp2);
107-
// #ifdef TD_LEGACY
108-
// RtlZeroMemory((char*)KernelBase + Stamp2, 16);
109-
// #else
110-
// *(unsigned long long*)((char*)KernelBase + Stamp2) = 0;
111-
// #endif
112-
//}
113-
114-
//#ifndef TD_LEGACY
115-
//int Function = RegReadValue(hKey, L"Function", NULL, 0);
116-
// TDPrint("[+] TimeDefuser: Cached ExGetExpirationDate function address 0x%p is used.\n", (char*)KernelBase + Function);
117-
// if (!PatchExGetExpirationDate((char*)KernelBase + Function))
118-
// goto patchFail;
119-
//#endif
120-
// goto patchOK;
89+
if (CompareKernelVersion(hKey)) {
90+
// Get cached address offsets for timestamps.
91+
int Stamp1 = RegReadValue(hKey, L"Stamp1", NULL, 0),
92+
Stamp2 = RegReadValue(hKey, L"Stamp2", NULL, 0);
93+
94+
// Zero first timestamp
95+
if (!Stamp1) {
96+
// No cached address, assume nothing is cached.
97+
goto patchBeginning;
98+
}
99+
TDPrint("[*] TimeDefuser: Cached addresses are found on registry.\n");
100+
TDPrint("[+] TimeDefuser: Cached ExpNtExpirationDate address 0x%p is used.\n", (unsigned long long*)((char*)KernelBase + Stamp1));
101+
*(unsigned long long*)((char*)KernelBase+Stamp1) = 0;
102+
if(Legacy) {
103+
// On legacy, for some reason, actual timebomb stamp
104+
// is the next qword (on XP 2526). We will zero that too.
105+
*(unsigned long long*)((char*)KernelBase + Stamp1 + 8) = 0;
106+
}
107+
108+
// Zero second timestamp if available.
109+
if (Stamp2) {
110+
TDPrint("[+] TimeDefuser: Cached ExpNtExpirationData address 0x%p is used.\n", (char*)KernelBase + Stamp2);
111+
*(unsigned long long*)((char*)KernelBase + Stamp2) = 0;
112+
if (Legacy)
113+
*(unsigned long long*)((char*)KernelBase + Stamp2 + 8) = 0;
114+
}
115+
116+
if (!Legacy) {
117+
int Function = RegReadValue(hKey, L"Function", NULL, 0);
118+
TDPrint("[+] TimeDefuser: Cached ExGetExpirationDate function address 0x%p is used.\n", (char*)KernelBase + Function);
119+
if (!PatchExGetExpirationDate((char*)KernelBase + Function))
120+
goto patchFail;
121+
}
122+
goto patchOK;
121123
}
122124
// Kernel version mismatch.
123125
}
124-
//patchBeginning:
126+
patchBeginning:
125127
TDPrint("[*] TimeDefuser: No or mismatching cached addresses are found on registry.\n");
126-
//SaveKernelVersion(hKey);
127-
#ifdef TD_LEGACY
128-
// Search for timebomb stamp in memory
129-
KernelSize /= sizeof(unsigned __int64);
130-
for (unsigned int i = 0; i < KernelSize; i++) {
131-
if (KernelBase[i] == TimebombStamp) {
132-
TDPrint("[+] TimeDefuser: ExpNtExpirationDate found at 0x%p\n", &KernelBase[i]);
133-
KernelBase[i] = 0;
134-
// For some reason actual timebomb was the next qword on XP 2526, I'll save this and search for it again.
135-
TimebombStamp = KernelBase[i + 1]; // Save the lower part of stamp.
136-
KernelBase[i + 1] = 0; // And null where I found it too.
137-
RegWriteDword(hKey, L"Stamp1", (ULONG)((unsigned char*)&KernelBase[i] - (unsigned char*)KernelBase));
138-
break;
128+
SaveKernelVersion(hKey);
129+
130+
if (Legacy) {
131+
// Search for timebomb stamp in memory
132+
KernelSize /= sizeof(unsigned __int64);
133+
for (unsigned int i = 0; i < KernelSize; i++) {
134+
if (KernelBase[i] == TimebombStamp) {
135+
TDPrint("[+] TimeDefuser: ExpNtExpirationDate found at 0x%p\n", &KernelBase[i]);
136+
KernelBase[i] = 0;
137+
// For some reason actual timebomb was the next qword on XP 2526, I'll save this and search for it again.
138+
TimebombStamp = KernelBase[i + 1]; // Save the lower part of stamp.
139+
KernelBase[i + 1] = 0; // And null where I found it too.
140+
RegWriteDword(hKey, L"Stamp1", (ULONG)((unsigned char*)&KernelBase[i] - (unsigned char*)KernelBase));
141+
break;
142+
}
139143
}
140-
}
141144

142-
// Search for the second stamp, ExpNtExpirationData (and not Date)
143-
for (unsigned int i = 0; i < KernelSize; i++) {
144-
if ((int)KernelBase[i] == (int)TimebombStamp) {
145-
TDPrint("[+] TimeDefuser: ExpNtExpirationData found at 0x%p\n", &KernelBase[i]);
146-
RtlZeroMemory(&KernelBase[i], 16);
147-
RegWriteDword(hKey, L"Stamp2", (ULONG)((unsigned char*)&KernelBase[i] - (unsigned char*)KernelBase));
148-
goto patchOK;
145+
// Search for the second stamp, ExpNtExpirationData (and not Date)
146+
for (unsigned int i = 0; i < KernelSize; i++) {
147+
if ((int)KernelBase[i] == (int)TimebombStamp) {
148+
TDPrint("[+] TimeDefuser: ExpNtExpirationData found at 0x%p\n", &KernelBase[i]);
149+
KernelBase[i] = KernelBase[i + 1] = 0;
150+
RegWriteDword(hKey, L"Stamp2", (ULONG)((unsigned char*)&KernelBase[i] - (unsigned char*)KernelBase));
151+
goto patchOK;
152+
}
149153
}
154+
// That's all for legacy implementation, get out.
155+
goto patchOK;
150156
}
151-
// That's all for legacy implementation, get out.
152157

153-
#else
154158
// Check for PE Header existance.
155159
if (*(short*)KernelBase != PEheader) {
156160
TDPrint("[X] TimeDefuser: PE Header not found!\n");
@@ -291,8 +295,6 @@ NTSTATUS DriverEntry(void* DriverObject, PUNICODE_STRING RegistryPath) {
291295
// No references found so far so we fail.
292296
TDPrint("[X] TimeDefuser: could not find ExpTimeRefreshWork!\n");
293297

294-
#endif
295-
296298
patchFail:
297299
TDPrint("[X] TimeDefuser: Patch failed.\n");
298300
return STATUS_FAILED_DRIVER_ENTRY;

‎src/TimeDefuser.h‎

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,7 @@
44
#include "tdwdm/wdm.h"
55

66
/// Definitions
7-
#define td_version "1.8.1"
8-
#ifdef TD_LEGACY
9-
#define td_variant " (Legacy)"
10-
#else
11-
#define td_variant ""
12-
#endif
7+
#define td_version "1.8.2"
138

149
#define SystemModuleInformation 11
1510
#define PEheader 0x5a4d // MZ

‎src/TimeDefuser.inf‎

Lines changed: 5 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ Class = System
1111
ClassGuid = {4d36e97d-e325-11ce-bfc1-08002be10318}
1212
Provider = %ManufacturerName%
1313
CatalogFile = TimeDefuser.cat
14-
DriverVer = 01/18/2026,1.8.1
14+
DriverVer = 01/18/2026,1.8.2
1515
PnpLockdown = 1
1616

1717
[DestinationDirs]
@@ -23,26 +23,18 @@ DefaultDestDir = 12 ; %SystemRoot%\System32\drivers
2323
[SourceDisksFiles]
2424
TimeDefuser-x86.sys = 1
2525
TimeDefuser-amd64.sys = 1
26-
TimeDefuser-Legacy-x86.sys = 1
27-
TimeDefuser-Legacy-amd64.sys = 1
2826

2927
;==============================
3028
; OS-specific Information
3129
;==============================
3230
[Manufacturer]
33-
%ManufacturerName% = Standard,NTx86.6.0,NTamd64.6.0,NTx86,NTamd64
34-
35-
[Standard.NTx86.6.0]
36-
%TimeDefuser.DeviceDesc.x86% = TimeDefuser_Inst_x86, Root\TimeDefuser
37-
38-
[Standard.NTamd64.6.0]
39-
%TimeDefuser.DeviceDesc.amd64% = TimeDefuser_Inst_amd64, Root\TimeDefuser
31+
%ManufacturerName% = Standard,NTx86,NTamd64
4032

4133
[Standard.NTx86]
42-
%TimeDefuser.LDeviceDesc.x86L% = TimeDefuser_Inst_x86_Legacy, Root\TimeDefuser
34+
%TimeDefuser.LDeviceDesc.x86% = TimeDefuser_Inst_x86, Root\TimeDefuser
4335

4436
[Standard.NTamd64]
45-
%TimeDefuser.LDeviceDesc.amd64L% = TimeDefuser_Inst_amd64_Legacy, Root\TimeDefuser
37+
%TimeDefuser.LDeviceDesc.amd64% = TimeDefuser_Inst_amd64, Root\TimeDefuser
4638

4739
;==============================
4840
; x86 Install Sections
@@ -82,44 +74,6 @@ StartType = 3 ; SERVICE_DEMAND_START
8274
ErrorControl = 1 ; SERVICE_ERROR_NORMAL
8375
ServiceBinary = %12%\TimeDefuser-amd64.sys
8476

85-
;==============================
86-
; x86 Legacy Install Sections
87-
;==============================
88-
[TimeDefuser_Inst_x86_Legacy]
89-
CopyFiles = CopyFiles_x86_Legacy
90-
91-
[TimeDefuser_Inst_x86_Legacy.Services]
92-
AddService = TimeDefuser, 0x00000002, Service_Inst_x86_Legacy
93-
94-
[CopyFiles_x86_Legacy]
95-
TimeDefuser-Legacy-x86.sys
96-
97-
[Service_Inst_x86_Legacy]
98-
DisplayName = %TimeDefuser.SVCDESC%
99-
ServiceType = 1 ; SERVICE_KERNEL_DRIVER
100-
StartType = 3 ; SERVICE_DEMAND_START
101-
ErrorControl = 1 ; SERVICE_ERROR_NORMAL
102-
ServiceBinary = %12%\TimeDefuser-x86-Legacy.sys
103-
104-
;==============================
105-
; amd64 Legacy Install Sections
106-
;==============================
107-
[TimeDefuser_Inst_amd64_Legacy]
108-
CopyFiles = CopyFiles_amd64_Legacy
109-
110-
[TimeDefuser_Inst_amd64_Legacy.Services]
111-
AddService = TimeDefuser, 0x00000002, Service_Inst_amd64
112-
113-
[CopyFiles_amd64_Legacy]
114-
TimeDefuser-Legacy-amd64.sys
115-
116-
[Service_Inst_amd64_Legacy]
117-
DisplayName = %TimeDefuser.LSVCDESC%
118-
ServiceType = 1 ; SERVICE_KERNEL_DRIVER
119-
StartType = 3 ; SERVICE_DEMAND_START
120-
ErrorControl = 1 ; SERVICE_ERROR_NORMAL
121-
ServiceBinary = %12%\TimeDefuser-amd64-Legacy.sys
122-
12377
;==============================
12478
; General Strings
12579
;==============================
@@ -128,7 +82,4 @@ ManufacturerName = "NevermindExpress"
12882
DiskName = "TimeDefuser Installation Disk"
12983
TimeDefuser.DeviceDesc.x86 = "TimeDefuser (x86)"
13084
TimeDefuser.DeviceDesc.amd64 = "TimeDefuser (AMD64)"
131-
TimeDefuser.DeviceDesc.x86L = "TimeDefuser (x86 Legacy)"
132-
TimeDefuser.DeviceDesc.amd64L = "TimeDefuser (AMD64 Legacy)"
133-
TimeDefuser.SVCDESC = "TimeDefuser Service"
134-
TimeDefuser.LSVCDESC = "TimeDefuser Legacy Service"
85+
TimeDefuser.SVCDESC = "TimeDefuser Service"

‎src/TimeDefuser.rc‎

0 Bytes
Binary file not shown.

‎src/tdwdm/wdm.h‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,10 @@
1717
#include <excpt.h>
1818
#include <dpfilter.h>
1919

20-
//#undef NTSYSAPI
20+
#define PDRIVER_OBEJCT void* // Unused by TimeDefuser
21+
2122
#define NTKERNELAPI __declspec(dllimport)
22-
//#define NTSYSAPI
23+
2324

2425
// Definitions
2526
#define TIMER_TOLERABLE_DELAY_BITS 6
@@ -833,7 +834,7 @@ void* __cdecl memcpy(
833834

834835

835836
/// ???
836-
NTKERNELAPI BOOLEAN PsGetVersion(
837+
NTKERNELAPI BOOLEAN NTAPI PsGetVersion(
837838
_Out_opt_ PULONG MajorVersion,
838839
_Out_opt_ PULONG MinorVersion,
839840
_Out_opt_ PULONG BuildNumber,

0 commit comments

Comments
 (0)