[PATCH] ntoskrnl.exe: Update the tick count in KUSER_SHARED_DATA when accesed.

Derek Lesho dereklesho52 at gmail.com
Wed Mar 20 23:23:09 CDT 2019


EasyAntiCheat.sys constantly reads this value, so I think keeping it
up-to-date is a good idea.

Signed-off-by: Derek Lesho <dereklesho52 at Gmail.com>
---
 dlls/ntoskrnl.exe/instr.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/dlls/ntoskrnl.exe/instr.c b/dlls/ntoskrnl.exe/instr.c
index 192ba05ee4..26762943fc 100644
--- a/dlls/ntoskrnl.exe/instr.c
+++ b/dlls/ntoskrnl.exe/instr.c
@@ -26,6 +26,7 @@
 
 #include <stdarg.h>
 
+#define NONAMELESSUNION
 #include "windef.h"
 #include "winbase.h"
 #include "winternl.h"
@@ -592,6 +593,15 @@ static void fake_syscall_function(void)
 }
 
 
+static void update_shared_data(void)
+{
+    struct _KUSER_SHARED_DATA *shared_data  = (struct _KUSER_SHARED_DATA *)wine_user_shared_data;
+
+    shared_data->u.TickCountQuad = GetTickCount64();
+    shared_data->u.TickCount.High2Time = shared_data->u.TickCount.High1Time;
+}
+
+
 /***********************************************************************
  *           emulate_instruction
  *
@@ -793,6 +803,7 @@ static DWORD emulate_instruction( EXCEPTION_RECORD *rec, CONTEXT *context )
             if (offset <= sizeof(KSHARED_USER_DATA) - data_size)
             {
                 ULONGLONG temp = 0;
+                update_shared_data();
                 memcpy( &temp, wine_user_shared_data + offset, data_size );
                 store_reg_word( context, instr[2], (BYTE *)&temp, long_op, rex );
                 context->Rip += prefixlen + len + 2;
@@ -813,6 +824,7 @@ static DWORD emulate_instruction( EXCEPTION_RECORD *rec, CONTEXT *context )
 
         if (offset <= sizeof(KSHARED_USER_DATA) - data_size)
         {
+            update_shared_data();
             switch (*instr)
             {
             case 0x8a: store_reg_byte( context, instr[1], wine_user_shared_data + offset, rex ); break;
@@ -834,6 +846,7 @@ static DWORD emulate_instruction( EXCEPTION_RECORD *rec, CONTEXT *context )
 
         if (offset <= sizeof(KSHARED_USER_DATA) - data_size)
         {
+            update_shared_data();
             memcpy( &context->Rax, wine_user_shared_data + offset, data_size );
             context->Rip += prefixlen + len + 1;
             return ExceptionContinueExecution;
-- 
2.20.1




More information about the wine-devel mailing list