arsetryhtehrwgefwadasdadasd

ma_de_hao_mei_le

已于 2024-06-18 17:04:18 修改

阅读量364

点赞数 5

文章标签： C++

于 2024-06-17 16:32:35 首次发布

我是https://wochinijiamile.blog.csdn.net/的博主，手贱把号注销了

本文链接：https://blog.csdn.net/ma_de_hao_mei_le/article/details/139747934

版权

驱动项目

https://github.com/wqreytuk/article/blob/main/agsdygasidgasuidgoGx64_ASM_Kernel_Mode-main.7z

48b91400000080f7ffff48b8bd427ae5d594bfd6488b0948f7e148b8cdcccccccccccccc48c1ea1748f7e24c8bea49c1ed02

在这里插入图片描述

直接在windbg中把执行内存修改为上面这一串字节序列，运行完成后r13中将包含当前时间戳，可使用如下代码转换成人类可阅读时间格式

/*代码BEGIN*/
#include <windows.h>
#include <stdint.h>
#include <stdio.h>

int main()
{
        // Example adjusted time value
    uint64_t adjustedTime = 0x9f4ce6f4;

        // Reverse the operations to get the original time
        uint64_t time = adjustedTime * 5L * 10000000L;

        // Split the 64-bit time into high and low parts
        FILETIME fileTime;
        fileTime.dwLowDateTime = (DWORD)(time & 0xFFFFFFFF);
        fileTime.dwHighDateTime = (DWORD)(time >> 32);

        // Optionally, convert FILETIME back to SYSTEMTIME for readable time
        SYSTEMTIME systemTime;
        FileTimeToSystemTime(&fileTime, &systemTime);

        // Print the SYSTEMTIME
        printf("Year: %d\n", systemTime.wYear);
        printf("Month: %d\n", systemTime.wMonth);
        printf("Day: %d\n", systemTime.wDay);
        printf("Hour: %d\n", systemTime.wHour);
        printf("Minute: %d\n", systemTime.wMinute);
        printf("Second: %d\n", systemTime.wSecond);
        printf("Milliseconds: %d\n", systemTime.wMilliseconds);

        return 0;
  

}
/*代码END*/