File tree Expand file tree Collapse file tree
Expand file tree Collapse file tree Original file line number Diff line number Diff line change 1+ KI_USER_SHARED_DATA equ 0FFFFF78000000000h
2+ SharedSystemTime equ KI_USER_SHARED_DATA + 14h
3+
4+ .data
5+
6+ AccuTimeBuf:
7+ buffer db 8 dup( 0 ) ;
8+
19.code _text
210
311NopToy PROC PUBLIC
816
917NopToy ENDP
1018
19+ MonikaDelayMsNative PROC PUBLIC
20+
21+ push rcx ; // backup goal parameter
22+
23+ ;before we call stupid NT API, we should prepare a safer stack buffer
24+ push rbp ;
25+ mov rbp , rsp ;
26+ sub rsp , 128 ; // fly away 128 bytes
27+ ;Query Current Time
28+ mov rcx , AccuTimeBuf
29+ call KeQuerySystemTime ;
30+ ;Now we can partly restore the stack
31+ mov rsp , rbp ;
32+ mov rax , [ AccuTimeBuf ] ;
33+ push rax ; // push the current time to stack
34+ mov rbp , rsp ;
35+
36+ WaitLoop:
37+ hlt ;
38+ ;Before we call stupid NT API, we should prepare a safer stack buffer
39+ sub rsp , 128 ; // fly away 128 bytes
40+ ;Query Current Time
41+ mov rcx , AccuTimeBuf
42+ call KeQuerySystemTime ;
43+ ;Now we can partly restore the stack
44+ mov rsp , rbp ;
45+ mov rax , [ AccuTimeBuf ] ; Current Time
46+ pop rbx ; The Initial Time
47+ add rsp , 8 ; skip the orignal rbp bakup
48+ pop rcx ; The Goal delay
49+ ; Now we should put rsp to a right place
50+ sub rsp , 8 + 8 + 8
51+ sub rax , rbx ; The Time Difference
52+ cmp rax , rcx ;
53+ jb WaitLoop ;
54+
55+ add rsp , 8
56+ pop rbp ;
57+ add rsp , 8
58+ ret
59+
60+ MonikaDelayMsNative ENDP
61+
1162END
You can’t perform that action at this time.
0 commit comments