getltime.txt

来自「Cracker终结者——提供最优秀的软件保护技术」· 文本 代码 · 共 17 行

  apihooks -o getltime explorer.exe
hooks GetLocalTime in explorer and then
time +1 hour is displayed in taskbar's
right corner. GetLTime unloads itself
after ~7 minutes. Then is the displayed
time normal.
  You can unload GetLTime using
  apihooks -u getltime explorer.exe
- it will try to unhook itself. Direct
unloading is not recommended - when the
hooked API is overhooked Hooks_DLL hans't
chance to properly unhook itself before
unmapping. Recommended method is to
call StopGLT via LoadAndCall - then
is unhooking done properly (remote thread
cycles as long as the API is not overhooked).