是否可以Hook到任何时间检索函数
我需要挂钩任何尝试检索系统时间的函数，以便为不同的应用程序生成“时间无关”的重播。一些事件（例如伪随机数生成）取决于对 time() 的调用，但例如其他一些事件则调用 timeGetTime() 或 _time64()。
我需要挂钩（在 Windows 中）以捕获所有时间检索函数的最小函数集是什么？实际上可以挂钩这些功能吗？我试图按时完成（），但我的钩子被忽略了。我已经成功连接到其他函数（如 rand），但我的 time() 钩子似乎被忽略了。
我正在使用 Detours，但我愿意使用任何其他 API 拦截工具。
I need to hook any function that tries to retrieve the system time in order to generate "time independent" replays for different applications. Some events like pseudorandom number generation depend on calls to time(), but for example some others call timeGetTime() or _time64().
What is the minimum set of functions that I would need to hook (in Windows) to catch all time retrieving functions. Is it actually possible to hook on these functions? I am trying to do it on time(), but my hook is being ignored. I have had success hooking to other functions (like rand) but my time() hook seems to be ignored.
I am using Detours, but I am open to use any other API interception tool.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
对于游戏“speedhacks”，通常挂钩的 3 个 API 是：
大多数这些函数返回自系统启动以来的时间或类似的时间。在你的钩子里，你需要决定你想做什么。您可以：
init_time）real_timeinit_time + 0.5*(real_time-init_time)，例如，这会使时间减半For game 'speedhacks', the 3 APIs which are usually hooked are:
Most of these functions return a time since the system started or something similar. In your hook, you need to decide what you want to do. You could:
init_time)real_timeinit_time + 0.5*(real_time-init_time)which would slow time down by half for example您可能想挂钩时间系统调用。呃，我不知道为什么我要这么建议。但是 kernel32.dll 中的逆向工程
GetSystemTime将详细说明该系统调用是如何进行的。You probably want to hook the time system call. Ugh, I don't know why I'm even suggesting that. But reverse engineering
GetSystemTimein kernel32.dll would detail how that system call is made.您想要挂钩的最小（最好）内核 API 集是
NtQuerySystemTime和NtGetTickCount。建议使用内核挂钩，因为有太多用户态 api 需要挂钩，而且您永远不知道应用程序是否使用这两个函数直接访问时间数据。当然，您应该通过调用 PsGetCurrentProcess() 并将
*(eprocess->UniqueProcessID)与目标进程 ID 进行比较来过滤掉进程。The minimum set of (preferably) kernel APIs that you want to hook are
NtQuerySystemTimeandNtGetTickCount. Kernel hooks are recommended since there's too many user-land apis to hook and you never know whether the application is directly accessing the time data using those two functions.Of course you should filter out the process by calling PsGetCurrentProcess() and comparing the
*(eprocess->UniqueProcessID)with your target process id.