有个现成的闭源给出了需要 hook 的 API https://www.nirsoft.net/utils/run_as_date.html > How does it work ? > RunAsDate intercepts the kernel API calls that returns the current date and time (GetSystemTime, GetLocalTime, GetSystemTimeAsFileTime, NtQuerySystemTime, GetSystemTimePreciseAsFileTime), and replaces the current date/time with the date/time that you specify.