From 0df0e40cf2da28816e00c8aec11193e14284320b Mon Sep 17 00:00:00 2001 From: maowenrui <3505719167@qq.com> Date: Tue, 23 Jun 2026 13:18:06 +0800 Subject: [PATCH] fix remove func --- Anti-Cheat_Driver/comm_win7.cpp | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/Anti-Cheat_Driver/comm_win7.cpp b/Anti-Cheat_Driver/comm_win7.cpp index 137be4f..a666ccf 100644 --- a/Anti-Cheat_Driver/comm_win7.cpp +++ b/Anti-Cheat_Driver/comm_win7.cpp @@ -3,8 +3,7 @@ #include "utils.h" #include "kernel_function.h" -#pragma warning(disable : 4309) -#pragma warning(disable : 4838) +#pragma warning(disable : 4309 4838) PFILE_OBJECT file_obj{ 0 }; PDEVICE_OBJECT device_obj{ 0 }; @@ -39,6 +38,8 @@ namespace comm_win7 return status; }; + uintptr_t beep_trampoline = NULL; + auto comm_install_hook() -> BOOL { auto drv_obj = device_obj->DriverObject; @@ -47,7 +48,7 @@ namespace comm_win7 orign_maj_function = drv_obj->MajorFunction[IRP_MJ_DEVICE_CONTROL]; - auto beep_trampoline = utils::get_beep_trampoline_ptr(); + beep_trampoline = utils::get_beep_trampoline_ptr(); if (!beep_trampoline) return FALSE; @@ -73,6 +74,15 @@ namespace comm_win7 { drv_obj->MajorFunction[IRP_MJ_DEVICE_CONTROL] = (PDRIVER_DISPATCH)orign_maj_function; + + if (!beep_trampoline) + return FALSE; + + char nullcode[12]{ 0 }; + auto status = kernel_function::MmMDLPagesCopy((PVOID)beep_trampoline, &nullcode, sizeof(nullcode), 0x0000002, KernelMode); + if (!NT_SUCCESS(status)) + return FALSE; + } return TRUE;