I have a question regarding hooking NtQueryPerformanceCounter If I hook it to return RDTSC and a fixed frequency, do I also need to hook KeQueryPerformanceCounter? Since NtQueryPerformanceCounter internally calls KeQueryPerformanceCounter, I'm wondering if hooking only the user-mode API is enough, or if kernel-mode calls to KeQueryPerformanceCounter need to be handled separately as well(HalpPerformanceCounter) here my results RDTSC: 210217482788015, QPC: 210217482789074, FREQ: 4008009327
RDTSC: 210217893162169, QPC: 210217893165583, FREQ: 4008009327
RDTSC: 210218341592139, QPC: 210218341595441, FREQ: 4008009327
RDTSC: 210218787127728, QPC: 210218787131187, FREQ: 4008009327
RDTSC: 210219226825851, QPC: 210219226829304, FREQ: 4008009327
RDTSC: 210219631082536, QPC: 210219631085986, FREQ: 4008009327
RDTSC: 210220039708107, QPC: 210220039711958, FREQ: 4008009327
RDTSC: 210220444651779, QPC: 210220444655100, FREQ: 4008009327
RDTSC: 210220849406895, QPC: 210220849410251, FREQ: 4008009327
RDTSC: 210221291244601, QPC: 210221291248279, FREQ: 4008009327
User-mode applications can bypass your hooks via direct or indirect (if IAT or EAT hook) syscalls.
Hooking NtQueryPerformanceCounter will only work for user-mode applications.
Hooking KeQueryPerformanceCounter would work for both, and you wouldn't need to hook NtQueryPerformanceCounter explicitly. But you need to be extremely careful as you can impact overall system performance if you do hook it.
Also, keep in mind that PatchGuard exists. And it won't be happy to see something different about KeQueryPerformanceCounter.
Don't do this. It's just a bad idea all around. The kernel knows which timer resources it has and how they interact with multicore machines, which at this point might not be running at the same frequency.
If your app needs RDTSC, then by all means use it. There are compiler intrinsics to make that easy. But you can't force the rest of the system to use it.
AFAIK on modern OSes user-mode QueryPerfomanceCounter does not use transition to kernel on modern hardware by default (and use RDTSC directly).
The exact implementation of QueryPerfomanceCounter is hardware dependent.
That what the OP is trying to do is also infeasible, doesn't make any of the points about it being a bad idea any less valid