From 32d8fd59510d42e2bedc28bea997485da6731cb3 Mon Sep 17 00:00:00 2001
From: maowenrui <3505719167@qq.com>
Date: Tue, 9 Jun 2026 14:27:13 +0800
Subject: [PATCH] feat eprocess flag protect

---
 Anti-Cheat_Driver/process_func.cpp | 61 ++++++++++++++++++++++++++++++
 Anti-Cheat_Driver/process_func.h   | 16 ++++++++
 2 files changed, 77 insertions(+)
 create mode 100644 Anti-Cheat_Driver/process_func.cpp
 create mode 100644 Anti-Cheat_Driver/process_func.h

diff --git a/Anti-Cheat_Driver/process_func.cpp b/Anti-Cheat_Driver/process_func.cpp
new file mode 100644
index 0000000..70add97
--- /dev/null
+++ b/Anti-Cheat_Driver/process_func.cpp
@@ -0,0 +1,61 @@
+#include "process_func.h"
+namespace process_function
+{
+	ULONG orin_protect_val;
+
+	auto eprocess_get_protect_offset() -> UINT32
+	{
+		UNICODE_STRING func_name{ 0 };
+		RtlInitUnicodeString(&func_name, L"PsIsProtectedProcess");
+		auto pfunc_address = reinterpret_cast<unsigned char*>(MmGetSystemRoutineAddress(&func_name));
+		auto offset = *(UINT32*)(pfunc_address + 0x2);
+		return offset;
+	}
+
+
+	auto eprocess_protect_process_on(UINT32 Pid) -> NTSTATUS
+	{
+		PEPROCESS process{ 0 };
+
+		auto status = PsLookupProcessByProcessId(ULongToHandle(Pid), &process);
+		if (!NT_SUCCESS(status))
+			return status;
+
+		auto offset = eprocess_get_protect_offset();
+	
+		auto Protection = reinterpret_cast<unsigned long*>((UINT64)process + offset);
+		if (*Protection != 0xc0000061)
+		{
+			orin_protect_val = *Protection;
+			*Protection = 0xc0000061;
+		}
+
+		ObDereferenceObject(process);
+		return status;
+	}
+
+	auto eprocess_protect_process_off(UINT32 Pid) -> NTSTATUS
+	{
+		PEPROCESS process{ 0 };
+
+		auto status = PsLookupProcessByProcessId(ULongToHandle(Pid), &process);
+		if (!NT_SUCCESS(status))
+			return status;
+
+		auto offset = eprocess_get_protect_offset();
+		auto Protection = reinterpret_cast<unsigned long*>((UINT64)process + offset);
+		if (*Protection == 0xc0000061) 
+			*Protection = orin_protect_val;
+
+		ObDereferenceObject(process);
+		return status;
+	}
+
+
+
+
+
+}
+
+
+
diff --git a/Anti-Cheat_Driver/process_func.h b/Anti-Cheat_Driver/process_func.h
new file mode 100644
index 0000000..445a9f4
--- /dev/null
+++ b/Anti-Cheat_Driver/process_func.h
@@ -0,0 +1,16 @@
+#pragma once
+#ifndef PROCESS_FUNC
+#define PROCESS_FUNC
+#include "Base.h"
+
+
+namespace process_function
+{
+	auto eprocess_protect_process_on(UINT32 Pid)->NTSTATUS;
+
+	auto eprocess_protect_process_off(UINT32 Pid)->NTSTATUS;
+
+	auto kernel_kill_process(UINT32 Pid)->NTSTATUS;
+}
+
+#endif // !PROCESS_FUNC