#include "driver_func.h" typedef ULONG(WINAPI* NtConvertBetweenAuxiliaryCounterAndPerformanceCounterProc)(char a1, PVOID a2, PVOID a3, PVOID a4); NtConvertBetweenAuxiliaryCounterAndPerformanceCounterProc gNtConvertBetweenAuxiliary = NULL; HANDLE null_device_handle; OSVERSIONINFOW os{ 0 }; namespace driver_func { auto GetVersion() -> OSVERSIONINFOW { OSVERSIONINFOW os{ 0 }; typedef NTSTATUS(WINAPI* PFNRtlGetVersion)(PRTL_OSVERSIONINFOW); static PFNRtlGetVersion RtlGetVersion = nullptr; if (RtlGetVersion == nullptr) { HMODULE hNtdll = GetModuleHandleW(L"ntdll.dll"); if (hNtdll != NULL) { RtlGetVersion = (PFNRtlGetVersion)GetProcAddress(hNtdll, "RtlGetVersion"); } } RtlGetVersion(&os); return os; } auto init() -> BOOL { os = GetVersion(); if (os.dwBuildNumber == 7600 || os.dwBuildNumber == 7601) { null_device_handle = CreateFileA("\\\\.\\Nul", GENERIC_READ | GENERIC_WRITE, 0, 0, OPEN_EXISTING, FILE_ATTRIBUTE_SYSTEM, 0); if (null_device_handle != NULL && null_device_handle != INVALID_HANDLE_VALUE) return TRUE; } else if (os.dwBuildNumber >= 14393) { HMODULE ntdll = GetModuleHandleA("ntdll.dll"); if (ntdll) { if (gNtConvertBetweenAuxiliary == nullptr) { gNtConvertBetweenAuxiliary = (NtConvertBetweenAuxiliaryCounterAndPerformanceCounterProc) GetProcAddress(ntdll, "NtConvertBetweenAuxiliaryCounterAndPerformanceCounter"); return gNtConvertBetweenAuxiliary ? TRUE : FALSE; } } } return FALSE; } auto driver_comm_func(LPVOID Buf, DWORD bufSize)->BOOL { if (os.dwBuildNumber == 7600 || os.dwBuildNumber == 7601) { DWORD retlen = 0; return DeviceIoControl(null_device_handle, 0x12345678, Buf, bufSize, Buf, bufSize, &retlen, NULL); } else if (os.dwBuildNumber >= 14393) { ULONG64 xxx = 0; auto data = (ULONG64)Buf; gNtConvertBetweenAuxiliary(1, &data, (PVOID)&xxx, NULL); return TRUE; } return FALSE; } }