getltime.cpp

Cracker终结者——提供最优秀的软件保护技术

#define WIN32_LEAN_AND_MEAN
#define UNICODE
#ifdef UNICODE
  #define _UNICODE
#endif
#include <windows.h>
#include <tchar.h>

#pragma comment(lib, "SClientAW")
#define AH_STATIC_LINKING
#include <ApiHooks.h>

__EXPORT API_HOOK ApiHookChain[];
__EXPORT DWORD WINAPI StopGLT(LPVOID);
LARGE_INTEGER StartFileTime;

#define NUNHOOKS 256
ADDR_CONTENTS UGLT[NUNHOOKS];
API_UNHOOK UnhookGetLocalTime  = {NUNHOOKS, 0, UGLT};
PVOID OldGetLocalTime = NULL;

LONG ThreadsIn = 0;

VOID WINAPI NewGetLocalTime(LPSYSTEMTIME lpSystemTime) {
  InterlockedIncrement(&ThreadsIn);
  ORIGFN(0, 1, &lpSystemTime);
  LARGE_INTEGER NowFileTime;
  SystemTimeToFileTime(lpSystemTime, (LPFILETIME)&NowFileTime);
  ++lpSystemTime->wHour;
  if(NowFileTime.QuadPart - StartFileTime.QuadPart > (LONGLONG)5*60*10000000) {
    DWORD TID;
    CreateThread(NULL, 0, StopGLT, NULL, 0, &TID);
  }
  InterlockedDecrement(&ThreadsIn);
}

#define NHOOKS 2
__EXPORT API_HOOK ApiHookChain[NHOOKS] = {
  {"KERNEL32.dll", "GetLocalTime", HOOK_ALL_SAFE, &OldGetLocalTime, &UnhookGetLocalTime, NewGetLocalTime},
  {HOOKS_END}
};

HMODULE hDLL;

BOOL AutoUnload = FALSE;

BOOL APIENTRY DllMain(HINSTANCE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) { 
  if(ul_reason_for_call == DLL_PROCESS_ATTACH) {
    hDLL = hModule;
    SYSTEMTIME lt;
    GetLocalTime(&lt);
    SystemTimeToFileTime(&lt, (LPFILETIME)&StartFileTime);
  }
  else
    if(ul_reason_for_call == DLL_PROCESS_DETACH) {
      if(!AutoUnload)
        UnhookApis(ApiHookChain, WHOLE_AH_CHAIN);
    }
  return(TRUE);
}

__EXPORT DWORD WINAPI StopGLT(LPVOID ThreadBody) {
   while(!UnhookApis(ApiHookChain, WHOLE_AH_CHAIN))
     Sleep(127);
   while(ThreadsIn)
     Sleep(127);
   if(OldGetLocalTime)
     LocalFree(OldGetLocalTime);
   if(ThreadBody)
     VirtualFree(ThreadBody, NULL, MEM_RELEASE);
   AutoUnload = TRUE;
   FreeLibraryAndExitThread(hDLL, ErrorAHTimeOut);
   return(ErrorAHTimeOut);
}