---

#include <windows.h>

typedef struct _KSYSTEM_TIME
{
    ULONG LowPart;
    LONG High1Time;
    LONG High2Time;
} KSYSTEM_TIME, *PKSYSTEM_TIME;

typedef struct _KUSER_SHARED_DATA
{
    ULONG TickCountLowDeprecated;
    ULONG TickCountMultiplier;
    volatile KSYSTEM_TIME InterruptTime;
    volatile KSYSTEM_TIME SystemTime;
    volatile KSYSTEM_TIME TimeZoneBias;
    USHORT ImageNumberLow;
    USHORT ImageNumberHigh;
    WCHAR NtSystemRoot[260];
    ULONG MaxStackTraceDepth;
    ULONG CryptoExponent;
    ULONG TimeZoneId;
    ULONG LargePageMinimum;
    ULONG AitSamplingValue;
    ULONG AppCompatFlag;
    ULONGLONG RNGSeedVersion;
    ULONG GlobalValidationRunlevel;
    LONG TimeZoneBiasStamp;
    ULONG NtBuildNumber;
    NT_PRODUCT_TYPE NtProductType;
    BOOLEAN ProductTypeIsValid;
    BOOLEAN Reserved0[1];
    USHORT NativeProcessorArchitecture;
    ULONG NtMajorVersion;
    ULONG NtMinorVersion;
    BOOLEAN ProcessorFeatures[64];
    ULONG Reserved1;
    ULONG Reserved3;
    volatile ULONG TimeSlip;
    ALTERNATIVE_ARCHITECTURE_TYPE AlternativeArchitecture;
    ULONG BootId;
    LARGE_INTEGER SystemExpirationDate;
    ULONG SuiteMask;
    BOOLEAN KdDebuggerEnabled;
    union
    {
        UCHAR MitigationPolicies;
        UCHAR CycleDivider;
    };
    USHORT ActiveConsoleId;
    volatile USHORT DismountCount;
    ULONG ComPlusPackage;
    ULONG LastSystemRITEventTickCount;
    ULONG NumberOfPhysicalPages;
    BOOLEAN SafeBootMode;
    UCHAR VirtualizationFlags;
    ULONG TraceLogging;
    ULONGLONG TestRetInstruction;
    LONGLONG SystemCall;
    ULONG SystemCallReturn;
    ULONGLONG SystemCallPad[3];
    union
    {
        volatile KSYSTEM_TIME TickCount;
        volatile ULONGLONG TickCountQuad;
    };
    ULONG Cookie;
    ULONG ConsoleHandle;
    ULONGLONG TimeUpdateLock;
    ULONGLONG BaselineSystemTimeQpc;
    ULONGLONG BaselineInterruptTimeQpc;
    ULONGLONG ReservedForFutureUse;
    ULONGLONG ReservedForFutureUse2;
} KUSER_SHARED_DATA, *PKUSER_SHARED_DATA;

struct SavedState
{
    ULONGLONG InterruptTime;
    ULONGLONG SystemTime;
    LONGLONG TimeZoneBias;
    ULONG LastSystemRITEventTickCount;
    ULONGLONG TickCount;
    ULONGLONG TickCountMultiplier;
    ULONGLONG BaselineSystemTimeQpc;
    ULONGLONG BaselineInterruptTimeQpc;
    ULONGLONG PerformanceCounter;
    ULONGLONG PerformanceFrequency;
};

void UpdateLoop(SavedState* state, DWORD update_interval_ms, BOOL* stop_flag)
{
    PKUSER_SHARED_DATA kuser = (PKUSER_SHARED_DATA)0x7FFE0000;

    while (!*stop_flag)
    {
        LARGE_INTEGER CurrentPerfCounter;
        LARGE_INTEGER CurrentPerfFreq;
        QueryPerformanceCounter(&CurrentPerfCounter);
        QueryPerformanceFrequency(&CurrentPerfFreq);

        ULONGLONG ElapsedQpc = CurrentPerfCounter.QuadPart - state->PerformanceCounter;
        ULONGLONG ElapsedMs = (ElapsedQpc * 10000) / state->PerformanceFrequency;

        state->InterruptTime += ElapsedMs;
        state->SystemTime += ElapsedMs;

        ULONGLONG ElapsedTickCount = (ElapsedQpc * state->TickCountMultiplier) >> 32;
        state->TickCount += ElapsedTickCount;
        state->LastSystemRITEventTickCount += (ULONG)ElapsedTickCount;

        state->PerformanceCounter = CurrentPerfCounter.QuadPart;

        kuser->InterruptTime.LowPart = (ULONG)state->InterruptTime;
        kuser->InterruptTime.High1Time = (LONG)(state->InterruptTime >> 32);
        kuser->InterruptTime.High2Time = (LONG)(state->InterruptTime >> 32);

        kuser->SystemTime.LowPart = (ULONG)state->SystemTime;
        kuser->SystemTime.High1Time = (LONG)(state->SystemTime >> 32);
        kuser->SystemTime.High2Time = (LONG)(state->SystemTime >> 32);

        ULONGLONG AbsBias = (state->TimeZoneBias < 0) ? (-state->TimeZoneBias) : state->TimeZoneBias;
        kuser->TimeZoneBias.LowPart = (ULONG)AbsBias;
        kuser->TimeZoneBias.High1Time = (LONG)(AbsBias >> 32);
        kuser->TimeZoneBias.High2Time = (LONG)(AbsBias >> 32);

        kuser->LastSystemRITEventTickCount = state->LastSystemRITEventTickCount;

        kuser->TickCount.LowPart = (ULONG)state->TickCount;
        kuser->TickCount.High1Time = (LONG)(state->TickCount >> 32);
        kuser->TickCount.High2Time = (LONG)(state->TickCount >> 32);

        kuser->BaselineSystemTimeQpc = CurrentPerfCounter.QuadPart;
        kuser->BaselineInterruptTimeQpc = CurrentPerfCounter.QuadPart;

        Sleep(update_interval_ms);
    }
}

SavedState CaptureCurrentState()
{
    PKUSER_SHARED_DATA kuser = (PKUSER_SHARED_DATA)0x7FFE0000;
    SavedState state;

    LARGE_INTEGER PerfCounter;
    LARGE_INTEGER PerfFreq;
    QueryPerformanceCounter(&PerfCounter);
    QueryPerformanceFrequency(&PerfFreq);

    state.InterruptTime = ((ULONGLONG)kuser->InterruptTime.High1Time << 32) | kuser->InterruptTime.LowPart;
    state.SystemTime = ((ULONGLONG)kuser->SystemTime.High1Time << 32) | kuser->SystemTime.LowPart;
    
    LONGLONG BiasHigh = ((LONGLONG)kuser->TimeZoneBias.High1Time << 32);
    state.TimeZoneBias = BiasHigh | kuser->TimeZoneBias.LowPart;
    
    state.LastSystemRITEventTickCount = kuser->LastSystemRITEventTickCount;
    state.TickCount = ((ULONGLONG)kuser->TickCount.High1Time << 32) | kuser->TickCount.LowPart;
    state.TickCountMultiplier = kuser->TickCountMultiplier;
    state.BaselineSystemTimeQpc = kuser->BaselineSystemTimeQpc;
    state.BaselineInterruptTimeQpc = kuser->BaselineInterruptTimeQpc;
    state.PerformanceCounter = PerfCounter.QuadPart;
    state.PerformanceFrequency = PerfFreq.QuadPart;

    return state;
}

int main()
{
    SavedState old_state = CaptureCurrentState();

    old_state.SystemTime -= 6048000000000;
    old_state.InterruptTime -= 6048000000000;
    old_state.TickCount -= 604800;
    old_state.LastSystemRITEventTickCount -= 604800;

    BOOL stop = FALSE;
    UpdateLoop(&old_state, 15, &stop);

    return 0;
}