π§ Purpose of the Code The program locates a specific target process, injects a custom code payload or a DLL into it, and hooks Windows time-related APIs (like GetTickCount, timeGetTime, and QueryPerformanceCounter) to simulate faster passage of time within that target process. It's essentially a cheat-like mechanism often used for debugging, reverse engineering, or game manipulation.
β
Fully contained Non-Dll memory injection method
β
Windows 11 Compatible
β
Bypasses DEP and ASLR using PEB based recursive search
β
Supports DLL based injection via (string)FilePath
β
Tested and validated
π§© Main Functional Components
-
Privilege Elevation EnableDebugPrivilege enables SeDebugPrivilege so the injector can access and manipulate other processes, especially those requiring admin rights.
-
Process Discovery find_process locates the process by its executable name using CreateToolhelp32Snapshot and Process32Next.
-
DLL Injection There are two injection paths:
Code Injection (inject_function):
Allocates memory in the target process using VirtualAllocEx.
Writes a custom payload (Injected) to this memory.
Uses CreateRemoteThread to invoke the code, which installs API hooks for time manipulation.
DLL Injection (inject_image):
Writes the DLL path (C:\DllToInject.dll) into the remote process.
Uses CreateRemoteThread to call LoadLibraryA, causing the target to load the specified DLL.
- Hook Implementation The Injected procedure:
Resolves addresses of time-related APIs from kernel32.dll and winmm.dll.
Patches the Import Address Table (IAT) of the target process using SetHook to redirect calls to custom hook functions:
GetTickCountHook
timeGetTimeHook
QueryPerformanceCounterHook
These hooks apply an acceleration factor (default is 5x) to simulate faster time.
- API Hook Mechanics SetHook performs manual IAT patching: it walks through the PE headers of the target module to locate function entries and replaces them with the custom hook addresses.
Each hook function modifies the returned time value using the formula:
accelerated_time = base_time + (current_time - base_time) * acceleration_factor π Support Functions get_proc_address, get_load_library: Fetch function pointers like LoadLibraryA or GetProcAddress.
WriteConsoleString, dwtoa: Output messages and convert integers to ASCII.
InlineInjected, InlineSetHook: Alternative injection method using inline patches (commented out or optional).
main: Entry point of the program that orchestrates the process lookup, privilege escalation, and injection. It shows a message box indicating success or failure.
π§ What Makes It Special? Manual PE parsing to find and hook IAT entries.
Time manipulation using custom hooks to alter how fast a target process perceives time passing.
Robust privilege handling and error messaging for diagnostics.
Designed to work seamlessly with 64-bit processes and uses correct x64 ABI conventions.
π Potential Use Cases & Caution Could be used for game "speed hacks" or bypassing timers in apps.
May trigger antivirus/anticheat systems.
Intended for educational, debugging, or automation purposes β not for malicious use.