From c988910caeebfd1415ad4d036964a67078493e46 Mon Sep 17 00:00:00 2001 From: Derek Lesho Date: Thu, 21 Mar 2019 00:23:09 -0400 Subject: [PATCH] ntoskrnl.exe: Update the tick count in KUSER_SHARED_DATA when accessed. EasyAntiCheat.sys constantly reads this value, so I think keeping it up-to-date is a good idea. Signed-off-by: Derek Lesho Signed-off-by: Alexandre Julliard --- dlls/ntoskrnl.exe/instr.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/dlls/ntoskrnl.exe/instr.c b/dlls/ntoskrnl.exe/instr.c index 90a63b04781..d5d197de358 100644 --- a/dlls/ntoskrnl.exe/instr.c +++ b/dlls/ntoskrnl.exe/instr.c @@ -26,6 +26,7 @@ #include +#define NONAMELESSUNION #include "windef.h" #include "winbase.h" #include "winternl.h" @@ -594,6 +595,15 @@ static void fake_syscall_function(void) } +static void update_shared_data(void) +{ + struct _KUSER_SHARED_DATA *shared_data = (struct _KUSER_SHARED_DATA *)wine_user_shared_data; + + shared_data->u.TickCountQuad = GetTickCount64(); + shared_data->u.TickCount.High2Time = shared_data->u.TickCount.High1Time; +} + + /*********************************************************************** * emulate_instruction * @@ -794,6 +804,7 @@ static DWORD emulate_instruction( EXCEPTION_RECORD *rec, CONTEXT *context ) if (offset <= sizeof(KSHARED_USER_DATA) - data_size) { ULONGLONG temp = 0; + update_shared_data(); memcpy( &temp, wine_user_shared_data + offset, data_size ); store_reg_word( context, instr[2], (BYTE *)&temp, long_op, rex ); context->Rip += prefixlen + len + 2; @@ -814,6 +825,7 @@ static DWORD emulate_instruction( EXCEPTION_RECORD *rec, CONTEXT *context ) if (offset <= sizeof(KSHARED_USER_DATA) - data_size) { + update_shared_data(); switch (*instr) { case 0x8a: store_reg_byte( context, instr[1], wine_user_shared_data + offset, rex ); break; @@ -835,6 +847,7 @@ static DWORD emulate_instruction( EXCEPTION_RECORD *rec, CONTEXT *context ) if (offset <= sizeof(KSHARED_USER_DATA) - data_size) { + update_shared_data(); memcpy( &context->Rax, wine_user_shared_data + offset, data_size ); context->Rip += prefixlen + len + 1; return ExceptionContinueExecution;