KdUpdateTimeSlipEvent KernelDebugger Trick

//http://waleedassar.blogspot.com
//http://www.twitter.com/waleedassar

//------If KdPitchDebugger is true i.e. no kernel debuggers present,
//then the Referenced event Object by NtSetSystemInformation will not be
//dereferenced by the "KdUpdateTimeSlipEvent" function.
//This can be detected by checking the "PointerCount" field in the
//"_OBJECT_HEADER" structure for the corresponding event object.

//Also, check
//http://everdox.blogspot.com/2013/07/time-slip-dpc-kernel-debugger-detection.html

#include "stdafx.h"
#include "windows.h"
#include "stdio.h"



#define ObjectBasicInformation 0
#define SystemTimeSlipNotification 0x2E


struct _OBJECT_BASIC_INFORMATION
{
   unsigned long Attributes;
   ACCESS_MASK DesiredAccess;
   unsigned long HandleCount;
   unsigned long ReferenceCount;
   unsigned long PagedPoolUsage;
   unsigned long NonPagedPoolUsage;
   unsigned long Reserved[3];
   unsigned long NameInformationLength;
   unsigned long TypeInformationLength;
   unsigned long SecurityDescriptorLength;
   LARGE_INTEGER CreationTime;
};

extern "C"
{
    int __stdcall ZwQueryObject(HANDLE,
                                unsigned long,
                                _OBJECT_BASIC_INFORMATION*,
                                unsigned long,
                                unsigned long*);

    int __stdcall ZwSetSystemInformation(unsigned long,
                                         void*,
                                         unsigned long);
}
//-----------------Priv. Stuff-----------------------------
struct UNICODE_STRING
{
    unsigned short len;        //length in bytes
    unsigned short max_len;    //length in bytes + 2 null zeros
    wchar_t* pStr;
};

struct OBJECT_ATTRIBUTES
{
  unsigned long      Length;
  HANDLE          RootDirectory;
  UNICODE_STRING* ObjectName;
  unsigned long           Attributes;
  void*           SecurityDescriptor;
  void*           SecurityQualityOfService;
};

BOOL Acquire_Systemtime_Privilege()
{

    LUID X;
    if(!LookupPrivilegeValue(0,"SeSystemtimePrivilege",&X))
    {
           return FALSE;
    }
    HANDLE hToken;
    if(!OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES,&hToken) )
    {
        return FALSE;
    }
    TOKEN_PRIVILEGES T={0};
    T.PrivilegeCount=1;
    T.Privileges[0].Luid=X;
    T.Privileges[0].Attributes=SE_PRIVILEGE_ENABLED;

    if(!AdjustTokenPrivileges(hToken,FALSE,&T,0,0,0) )
    {
        return FALSE;
    }
    return TRUE;
}
//--------------------------------------------------------------------


int main(int argc, char* argv[])
{
    HANDLE hEvent = CreateEvent(0,FALSE,FALSE,0);
    if(hEvent == INVALID_HANDLE_VALUE)
        {
            printf("Can't create events!\r\n");
            /* hehe, thanks @nickeverdox */
            return 0;
        }

    _OBJECT_BASIC_INFORMATION ObjBasic={0};
    int ret = ZwQueryObject(hEvent,ObjectBasicInformation,& ObjBasic,sizeof(ObjBasic),0);
    printf("return value is %x\r\n",ret);

    unsigned long RefCount = ObjBasic.ReferenceCount;
    printf("Reference Count is %x\r\n",ObjBasic.ReferenceCount);


    BOOL bRet = Acquire_Systemtime_Privilege();
    if(!bRet) printf("Can't acquire SeSystemtimePrivilege\r\n");

    ret = ZwSetSystemInformation(SystemTimeSlipNotification,&hEvent,4);
    printf("return value is %x\r\n",ret);

    //Now check the reference count to detect kernel debuggers------------------

       //------If KdPitchDebugger is true i.e. no kernel debuggers present,
       //then the Referenced event Object by NtSetSystemInformation will not be
       //dereferenced by the "KdUpdateTimeSlipEvent" function.
       //This can be detected by checking the "PointerCount" field in the
       //"_OBJECT_HEADER" structure for the corresponding event object.

    memset(&ObjBasic,0,sizeof(ObjBasic));
    ret = ZwQueryObject(hEvent,ObjectBasicInformation,& ObjBasic,sizeof(ObjBasic),0);
    printf("return value is %x\r\n",ret);
    printf("Reference Count is %x\r\n",ObjBasic.ReferenceCount);


    if(RefCount == ObjBasic.ReferenceCount) printf("Kernel Debugger present\r\n");
    else printf("No Kernel Debuggers\r\n");
    return 0;
}