dsh-timelab

Speeds up, slows down, or shifts the target process's clock.

Install

dsh plugin --profile "$env:DSH_PROFILE" add @alexzeng666/dsh-timelab

Usage

verify_timeshift(pid=12345, offset_sec=3456000)            # 40 days forward
verify_timeshift(pid=12345, offset_sec=-86400)             # 1 day back
verify_timeshift(pid=12345, factor=5, duration_ms=10000)   # 5x speed

Pick either offset_sec or factor. Hooks are removed at duration_ms.

Covered APIs (19)

| Category | APIs | |---|---| | Reads | GetTickCount GetTickCount64 timeGetTime QueryPerformanceCounter GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetMessageTime GetSystemTime GetLocalTime | | Waits | Sleep SleepEx WaitForSingleObject WaitForSingleObjectEx WaitForMultipleObjects WaitForMultipleObjectsEx | | Timers | SetTimer SetWaitableTimer SetWaitableTimerEx timeSetEvent |

Algorithm

Reads use four-point baseline re-anchoring: the first call sets baseReal = baseHook = real, after which virtual = baseHook + (real - baseReal) × factor; offset mode adds a fixed offset on top. On a factor change it re-anchors on the last observed value, so virtual time stays continuous across the switch.

Waits / timers take duration ÷ factor, with INFINITE and 0 passed through unchanged.

Return

VerifyFragment. detail holds mode, hooks_installed, hook_failures, covered_apis and log_path.

Behavior

• kernel32's forwarded APIs (Sleep, GetSystemTimeAsFileTime and friends) are really implemented in kernelbase: the hook tries kernelbase first and falls back to the given module. Otherwise it installs but never fires.
• Hooks install one at a time; a failure loses only that one, counted in hook_failures.
• Early exit, injection failure, or not a single hook installed all still produce a conclusion.
• 32-bit targets are not supported.