;@echo off
;goto make

;anti rdtsc trick by Neitsa

.686p
.model flat, stdcall
option casemap:none


include anti_rdtsc.inc



;-------------------------------------------------------------------------------
;                            N O N D I S C A R D A B L E   C O D E                                  
;-------------------------------------------------------------------------------

.code

;-------------------------------------------------------------------------------
;                                   DispatchCreateClose                                             
;-------------------------------------------------------------------------------

DispatchCreateClose proc pDeviceObject:PDEVICE_OBJECT, pIrp:PIRP

	; CreateFile was called, to get driver handle
	; CloseHandle was called, to close driver handle
	; In both cases we are in user process context here

	mov eax, pIrp
	assume eax:ptr _IRP
	mov [eax].IoStatus.Status, STATUS_SUCCESS
	and [eax].IoStatus.Information, 0
	assume eax:nothing

	fastcall IofCompleteRequest, pIrp, IO_NO_INCREMENT

	mov eax, STATUS_SUCCESS
	ret

DispatchCreateClose endp

;-------------------------------------------------------------------------------
;                                     DispatchControl                                               
;-------------------------------------------------------------------------------

DispatchControl proc uses esi edi pDeviceObject:PDEVICE_OBJECT, pIrp:PIRP

	; DeviceIoControl was called
	; We are in user process context here

local status:NTSTATUS
local dwBytesReturned:DWORD

	and dwBytesReturned, 0

	mov esi, pIrp
	assume esi:ptr _IRP

	IoGetCurrentIrpStackLocation esi
	mov edi, eax
	assume edi:ptr IO_STACK_LOCATION

	.if [edi].Parameters.DeviceIoControl.IoControlCode == IOCTL_GET_REGISTERS
		.if [edi].Parameters.DeviceIoControl.OutputBufferLength >= sizeof RegistersStruct;DRIVER_VERSION

			mov eax, [esi].AssociatedIrp.SystemBuffer
			assume eax:ptr RegistersStruct
			mov ebx,Cr0
			mov [eax]._Cr0,ebx
			mov ebx,Cr2
			mov [eax]._Cr2,ebx
			mov ebx,Cr3
			mov [eax]._Cr3,ebx
			mov ebx,Cr4
			mov [eax]._Cr4,ebx
			mov ebx,Dr0
			mov [eax]._Dr0,ebx
			mov ebx,Dr1
			mov [eax]._Dr1,ebx
			mov ebx,Dr2
			mov [eax]._Dr2,ebx
			mov ebx,Dr3
			mov [eax]._Dr3,ebx
			mov ebx,Dr6
			mov [eax]._Dr6,ebx
			mov ebx,Dr7
			mov [eax]._Dr7,ebx
			mov ebx,Cr4
			or ebx,100000100y ;PCE & TSD flag set ! (disable RDTSC and enable RDPMC)
			;or ebx,100b ; only TSD set ! (disable RDTSC only)
			mov Cr4,ebx
			mov [eax]._Cr4Mod,ebx
			assume eax:nothing
			mov dwBytesReturned, sizeof RegistersStruct
			mov status, STATUS_SUCCESS
		.else
			mov status, STATUS_BUFFER_TOO_SMALL
		.endif
	.else
		mov status, STATUS_INVALID_DEVICE_REQUEST
	.endif

	assume edi:nothing

	push status
	pop [esi].IoStatus.Status

	push dwBytesReturned
	pop [esi].IoStatus.Information

	assume esi:nothing

	fastcall IofCompleteRequest, esi, IO_NO_INCREMENT

	mov eax, status
	ret

DispatchControl endp

;-------------------------------------------------------------------------------
;                                       DriverUnload                                                
;-------------------------------------------------------------------------------

DriverUnload proc pDriverObject:PDRIVER_OBJECT

	; ControlService,,SERVICE_CONTROL_STOP was called
	; We are in System process (pid = 8) context here

	;########## Remove flags ###############
	mov eax,Cr4
	and eax,0FFFFFEFBh ; remove PCE & TSD !
	;and eax,0FFFFFFFBh ; remove TSD only !
	mov Cr4,eax
	;#######################################

	invoke IoDeleteSymbolicLink, addr g_usSymbolicLinkName

	mov eax, pDriverObject
	invoke IoDeleteDevice, (DRIVER_OBJECT PTR [eax]).DeviceObject

	ret

DriverUnload endp

;-------------------------------------------------------------------------------
;                              D I S C A R D A B L E   C O D E                                      
;-------------------------------------------------------------------------------

.code INIT

;-------------------------------------------------------------------------------
;                                       DriverEntry                                                 
;-------------------------------------------------------------------------------

DriverEntry proc pDriverObject:PDRIVER_OBJECT, pusRegistryPath:PUNICODE_STRING

	; StartService was called
	; We are in System process (pid = 8) context here

local status:NTSTATUS
local pDeviceObject:PDEVICE_OBJECT

	mov status, STATUS_DEVICE_CONFIGURATION_ERROR

	invoke IoCreateDevice, pDriverObject, 0, addr g_usDeviceName, FILE_DEVICE_UNKNOWN, 0, FALSE, addr pDeviceObject
	.if eax == STATUS_SUCCESS
		invoke IoCreateSymbolicLink, addr g_usSymbolicLinkName, addr g_usDeviceName
		.if eax == STATUS_SUCCESS
			mov eax, pDriverObject
			assume eax:ptr DRIVER_OBJECT
			mov [eax].MajorFunction[IRP_MJ_CREATE*(sizeof PVOID)],			offset DispatchCreateClose
			mov [eax].MajorFunction[IRP_MJ_CLOSE*(sizeof PVOID)],			offset DispatchCreateClose
			mov [eax].MajorFunction[IRP_MJ_DEVICE_CONTROL*(sizeof PVOID)],	offset DispatchControl
			mov [eax].DriverUnload,											offset DriverUnload
			assume eax:nothing
			mov status, STATUS_SUCCESS
		.else
			invoke IoDeleteDevice, pDeviceObject
		.endif
	.endif

	mov eax, status
	ret

DriverEntry endp

end DriverEntry
;-------------------------------------------------------------------------------
;Make file
;-------------------------------------------------------------------------------
:make

set drv=anti_rdtsc
\masm32\bin\ml /nologo /c /coff %drv%.bat
\masm32\bin\link /nologo /driver /base:0x10000 /align:32 /out:%drv%.sys /subsystem:native /ignore:4078 %drv%.obj rsrc.obj

del %drv%.obj
move %drv%.sys ..

echo.
pause
