TimeMocker

A Windows application that injects fake time into running processes by hooking Win32 time APIs.

Architecture

TimeMocker.sln
├── TimeMocker.UI        — WinForms controller app (run as Admin)
│   ├── Forms/MainForm   — UI: process chooser, time picker, pattern manager
│   ├── Core/InjectionManager  — EasyHook-based injector per process
│   ├── Core/ProcessWatcher    — background scanner for auto-inject patterns
│   └── Core/SharedMemoryManager — named MMF shared with the hook DLL
│
└── TimeMocker.Hook      — DLL injected into target processes
    └── InjectionEntryPoint — hooks 5 Win32 time functions via EasyHook

Hooked APIs

API	DLL
GetSystemTime	kernel32
GetLocalTime	kernel32
GetSystemTimeAsFileTime	kernel32
GetSystemTimePreciseAsFileTime	kernel32
NtQuerySystemTime	ntdll

Requirements

• Windows 10/11 x64
• .NET Framework 4.8 (pre-installed on Win10+)
• Visual Studio 2022 or dotnet build
• Must run as Administrator (UAC prompt shown automatically)

Build

# Clone / extract the solution
cd TimeMocker
dotnet restore
dotnet build -c Release -p:Platform=x64

# Outputs go to:
#   TimeMocker.UI/bin/x64/Release/net48/TimeMocker.exe
#   TimeMocker.UI/bin/x64/Release/net48/TimeMocker.Hook.dll   ← must be next to .exe

In Visual Studio: open TimeMocker.sln, set platform to x64, build solution.

Usage

Manual Injection

1. Launch TimeMocker.exe (UAC will prompt for elevation)
2. Processes tab → search for your target process → select it
3. Set the desired date/time in the Mock Time Settings bar at the top
4. Tick Enable Mock → click Inject →
5. The target process now sees your fake time immediately

Auto-Inject Rules

1. Go to the Auto-Inject Rules tab
2. Enter a pattern matching the process path or name, e.g.:
   • Glob: C:\Games\MyGame\*
   • Glob by name: *chrome*
   • Regex: ^.*\\MyApp\.exe$
3. Click + Add Rule
4. Tick Enable Auto-Inject Watcher
5. Any process that starts (or is already running) matching the rule gets injected automatically

Auto-Advance Time

Tick Auto-advance time in the time bar — the fake time ticks forward in sync with real time from the moment you set it.

IPC Design

The fake time is stored in a named Memory-Mapped File (one per injected process):

Name: TimeMocker_<PID>
Size: 12 bytes
  [0..7]  FakeUtcTicks (Int64 — DateTime.Ticks)
  [8..11] Enabled      (Int32 — 0=passthrough, 1=mock)

The hook reads this on every time API call (~50 ns read, no syscall). The UI writes it whenever you click Apply or toggle the checkbox.

Notes & Limitations

• 64-bit only — 32-bit processes require a separate 32-bit hook DLL build
• Processes using QueryPerformanceCounter for monotonic timing are not affected
  (QPC is a hardware register; patching it is unsupported by EasyHook)
• Anti-cheat or heavily protected processes (Epic, BattlEye, etc.) will block injection
• Some .NET apps read time through the CLR, which internally calls the hooked APIs — these will be affected
• EasyHook does not fully support hot-eject; to restore real time, disable the mock via the checkbox rather than ejecting

License

MIT