feat eprocess flag protect

2026-06-09 14:27:13 +08:00
parent 78278820eb
commit 32d8fd5951
2 changed files with 77 additions and 0 deletions
@@ -0,0 +1,61 @@
+#include "process_func.h"
+namespace process_function
+{
+	ULONG orin_protect_val;
+
+	auto eprocess_get_protect_offset() -> UINT32
+	{
+		UNICODE_STRING func_name{ 0 };
+		RtlInitUnicodeString(&func_name, L"PsIsProtectedProcess");
+		auto pfunc_address = reinterpret_cast<unsigned char*>(MmGetSystemRoutineAddress(&func_name));
+		auto offset = *(UINT32*)(pfunc_address + 0x2);
+		return offset;
+	}
+
+
+	auto eprocess_protect_process_on(UINT32 Pid) -> NTSTATUS
+	{
+		PEPROCESS process{ 0 };
+
+		auto status = PsLookupProcessByProcessId(ULongToHandle(Pid), &process);
+		if (!NT_SUCCESS(status))
+			return status;
+
+		auto offset = eprocess_get_protect_offset();
+	
+		auto Protection = reinterpret_cast<unsigned long*>((UINT64)process + offset);
+		if (*Protection != 0xc0000061)
+		{
+			orin_protect_val = *Protection;
+			*Protection = 0xc0000061;
+		}
+
+		ObDereferenceObject(process);
+		return status;
+	}
+
+	auto eprocess_protect_process_off(UINT32 Pid) -> NTSTATUS
+	{
+		PEPROCESS process{ 0 };
+
+		auto status = PsLookupProcessByProcessId(ULongToHandle(Pid), &process);
+		if (!NT_SUCCESS(status))
+			return status;
+
+		auto offset = eprocess_get_protect_offset();
+		auto Protection = reinterpret_cast<unsigned long*>((UINT64)process + offset);
+		if (*Protection == 0xc0000061) 
+			*Protection = orin_protect_val;
+
+		ObDereferenceObject(process);
+		return status;
+	}
+
+
+
+
+
+}
+
+
+