版本:1.0

作者: xIkUg/RCT/CCG          xikug.xp [at] gmail [dot] com

我常去的网站：
36eK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3c8W2j5Y4g2Y4L8h3q4F1i4K6u0W2N6$3W2F1N6r3!0G2L8s2y4H3M7X3!0Q4x3X3g2U0L8$3@1`.
645K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3k6U0k6$3y4Z5K9h3&6S2i4K6u0W2j5$3!0E0
http://bbs.pediy.com
c94K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4g2F1M7r3q4U0K9#2)9J5k6h3y4F1

说明：为了不至于混淆视线，本文以Win2000专业版，非3G，非PAE系统为蓝本进行讲述。其他系统稍有不同，但不在本文的讲述范围。

SharedUserData 是操作系统为每个进程提供的个共享数据结构，里面存放有很多重要的系统信息，如TickCount、系统时间、SystemRoot等。。。

其在DDK定义为：

#define KI_USER_SHARED_DATA         0xffdf0000
#define SharedUserData  ((KUSER_SHARED_DATA * const) KI_USER_SHARED_DATA)

#define PTE_BASE    0xC0000000
#define PDE_BASE    0xC0300000

#define GetPteAddress(va) ((PMMPTE)(((((ULONG)(va)) >> 12) << 2) + PTE_BASE))
#define GetPdeAddress(va)  ((PMMPTE)(((((ULONG)(va)) >> 22) << 2) + PDE_BASE))

ProcessPTE->p = ExAllocatePool(NonPagedPool, PAGE_SIZE)

RtlCopyMemory(ProcessPTE->p, SharedUserData, sizeof(KUSER_SHARED_DATA));
pMySharedData = ProcessPTE->p;
RtlTimeToTimeFields((PLARGE_INTEGER)&pMySharedData->SystemTime, &TimeFields);
TimeFields.Year = 2007;
TimeFields.Month = 1;
TimeFields.Day = 1;
RtlTimeFieldsToTime(&TimeFields, (PLARGE_INTEGER)&pMySharedData->SystemTime);
pMySharedData->SystemTime.High2Time = pMySharedData->SystemTime.High1Time;

pSharedData = ProcessPTE->p;
RtlTimeToTimeFields((PLARGE_INTEGER)&SharedUserData->SystemTime, &TimeFields);
TimeFields.Year = 2007;
TimeFields.Month = 1;
TimeFields.Day = 1;
RtlTimeFieldsToTime(&TimeFields, (PLARGE_INTEGER)&pSharedData->SystemTime);
pSharedData->SystemTime.High2Time = pSharedData->SystemTime.High1Time;

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课