From 3e7beaa4ecabd750fd649cb7c3dbd55f78c29578 Mon Sep 17 00:00:00 2001
From: maowenrui <3505719167@qq.com>
Date: Tue, 23 Jun 2026 13:18:59 +0800
Subject: [PATCH] fix disable fail
---
Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj | 17 +++
.../Anti-Cheat_Driver.vcxproj.filters | 79 +++++++++++-
Anti-Cheat_Driver/comm_win10.cpp | 5 +-
Anti-Cheat_Driver/driver_main.cpp | 85 ++++++++++++-
Anti-Cheat_Driver/kernel_api.cpp | 14 ++-
Anti-Cheat_Driver/kernel_api.h | 3 +-
Anti-Cheat_Driver/kernel_function.cpp | 90 +++++++++++++-
Anti-Cheat_Driver/kernel_function.h | 114 ++++++++++++++++++
8 files changed, 391 insertions(+), 16 deletions(-)
diff --git a/Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj b/Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj
index 3ef5f31..5549405 100644
--- a/Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj
+++ b/Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj
@@ -152,13 +152,20 @@
+
+
+
+
+
+
+
@@ -169,13 +176,23 @@
+
+
+
+
+
+
+
+
+
+
diff --git a/Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj.filters b/Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj.filters
index 848284c..3f5e641 100644
--- a/Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj.filters
+++ b/Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj.filters
@@ -19,9 +19,6 @@
{b3f98251-c1bf-4bd0-a5bd-d5425c272a5e}
-
- {1373c16e-e769-4553-b7b9-0f87b2f6ab0e}
-
{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}
rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms
@@ -41,6 +38,27 @@
{39d8ef92-d541-4aee-9850-0a3d878333dc}
+
+ {1373c16e-e769-4553-b7b9-0f87b2f6ab0e}
+
+
+ {eb37b22e-76b8-4afe-9adb-bc5b6842ee98}
+
+
+ {ea698d6c-d13f-4cc1-9129-3f8e935ee10d}
+
+
+ {c6d3ba67-35ff-487d-b42b-beaf95752ea6}
+
+
+ {d29bdd3e-0035-4cad-a658-7b272bd7d199}
+
+
+ {14cf9a07-d604-4163-8bfc-ded4b6e62df5}
+
+
+ {4f8c4f4e-0ff6-4cfa-804b-27bd50fca679}
+
@@ -53,7 +71,7 @@
kernel_extern_api
- Iocontrol
+ comm\Iocontrol
utils
@@ -88,6 +106,27 @@
comm
+
+ kernel_callback
+
+
+ utils\hde
+
+
+ Hooks\InlineHook
+
+
+ mouse_keyboard
+
+
+ kernel_extern_api\ShadowSSDT
+
+
+ mouse_keyboard
+
+
+ mouse_keyboard
+
@@ -100,7 +139,7 @@
kernel_extern_api
- Iocontrol
+ comm\Iocontrol
utils
@@ -135,5 +174,35 @@
comm
+
+ kernel_callback
+
+
+ utils\hde
+
+
+ utils\hde
+
+
+ utils\hde
+
+
+ utils\hde
+
+
+ Hooks\InlineHook
+
+
+ mouse_keyboard
+
+
+ kernel_extern_api\ShadowSSDT
+
+
+ mouse_keyboard
+
+
+ mouse_keyboard
+
\ No newline at end of file
diff --git a/Anti-Cheat_Driver/comm_win10.cpp b/Anti-Cheat_Driver/comm_win10.cpp
index 550db97..17a61c6 100644
--- a/Anti-Cheat_Driver/comm_win10.cpp
+++ b/Anti-Cheat_Driver/comm_win10.cpp
@@ -2,8 +2,7 @@
#include "comm_dispatch.h"
#include "utils.h"
#include "kernel_function.h"
-#pragma warning(disable : 4309)
-#pragma warning(disable : 4838)
+#pragma warning(disable : 4309 4838)
typedef NTSTATUS(__fastcall* fnHalpTimerConvertAuxiliaryCounterToPerformanceCounter)(PVOID, PVOID, PVOID);
fnHalpTimerConvertAuxiliaryCounterToPerformanceCounter _HalpTimerConvertAuxiliaryCounterToPerformanceCounter = 0;
@@ -33,6 +32,7 @@ namespace comm_win10
// mov rax,comm_callback
// jmp rax
+
char jmprax[] = { 0x48, 0xB8, 0x13, 0x09, 0xFC, 0xD6, 0xFC, 0x7F, 0x00, 0x00, 0xFF, 0xE0 };
*(uintptr_t*)&jmprax[2] = (uintptr_t)comm_callback;
@@ -62,7 +62,6 @@ namespace comm_win10
if (!beep_trampoline_ptr)
return FALSE;
-
char nullcode[12]{ 0 };
auto status = kernel_function::MmMDLPagesCopy((PVOID)beep_trampoline_ptr, &nullcode, sizeof(nullcode), 0x0000002, KernelMode);
if (!NT_SUCCESS(status))
diff --git a/Anti-Cheat_Driver/driver_main.cpp b/Anti-Cheat_Driver/driver_main.cpp
index a6cd779..8cacb71 100644
--- a/Anti-Cheat_Driver/driver_main.cpp
+++ b/Anti-Cheat_Driver/driver_main.cpp
@@ -1,8 +1,72 @@
#include "ob_reg_callback.h"
#include "create_thread_callback.h"
+#include "process_notify_callback.h"
#include "protect_filter.h"
#include "comm.h"
+#include "inline_hooks.h"
+#include "mouse_keybord_hook.h"
+typedef NTSTATUS (NTAPI* fnNtOpenProcess)(
+ _Out_ PHANDLE ProcessHandle,
+ _In_ ACCESS_MASK DesiredAccess,
+ _In_ POBJECT_ATTRIBUTES ObjectAttributes,
+ _In_opt_ PCLIENT_ID ClientId);
+
+typedef NTSTATUS(NTAPI* fnNtCreateFile)(
+ _Out_ PHANDLE FileHandle,
+ _In_ ACCESS_MASK DesiredAccess,
+ _In_ POBJECT_ATTRIBUTES ObjectAttributes,
+ _Out_ PIO_STATUS_BLOCK IoStatusBlock,
+ _In_opt_ PLARGE_INTEGER AllocationSize,
+ _In_ ULONG FileAttributes,
+ _In_ ULONG ShareAccess,
+ _In_ ULONG CreateDisposition,
+ _In_ ULONG CreateOptions,
+ _In_reads_bytes_opt_(EaLength) PVOID EaBuffer,
+ _In_ ULONG EaLength
+ );
+
+
+fnNtOpenProcess origon_ntOpenProcess;
+fnNtCreateFile origon_ntCreatFile;
+
+NTSTATUS NTAPI hkNtOpenProcess(
+ _Out_ PHANDLE ProcessHandle,
+ _In_ ACCESS_MASK DesiredAccess,
+ _In_ POBJECT_ATTRIBUTES ObjectAttributes,
+ _In_opt_ PCLIENT_ID ClientId
+)
+{
+
+ DbgPrintEx(77, 0, "NtOpenProcess\n");
+
+ return origon_ntOpenProcess(ProcessHandle, DesiredAccess, ObjectAttributes, ClientId);
+}
+
+
+NTSTATUS
+NTAPI
+hkNtCreateFile(
+ _Out_ PHANDLE FileHandle,
+ _In_ ACCESS_MASK DesiredAccess,
+ _In_ POBJECT_ATTRIBUTES ObjectAttributes,
+ _Out_ PIO_STATUS_BLOCK IoStatusBlock,
+ _In_opt_ PLARGE_INTEGER AllocationSize,
+ _In_ ULONG FileAttributes,
+ _In_ ULONG ShareAccess,
+ _In_ ULONG CreateDisposition,
+ _In_ ULONG CreateOptions,
+ _In_reads_bytes_opt_(EaLength) PVOID EaBuffer,
+ _In_ ULONG EaLength
+)
+
+{
+
+ DbgPrintEx(77, 0, "NtCreateFile\n");
+
+
+ return origon_ntCreatFile(FileHandle, DesiredAccess, ObjectAttributes, IoStatusBlock, AllocationSize, FileAttributes, ShareAccess, CreateDisposition, CreateOptions, EaBuffer, EaLength);
+}
EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING)
{
@@ -12,16 +76,31 @@ EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING)
{
kernel_comm_create::remove();
ob_call_back::uninstall_ob_callback();
- //DbgPrintEx(77,0,"%x\n", thread_notify_routine::unload_thread_routine());
+ process_notify_callback::remov_process_notify();
+ thread_notify_routine::unload_thread_routine();
+
+ inline_hooks_manager::fn_get_instance()->inline_remov_hook((void**)NtOpenProcess);
+ inline_hooks_manager::fn_get_instance()->inline_remov_hook((void**)NtCreateFile);
+
+ mouse_keybord_hook::remove_mouse_keybord_hook();
};
}
- kernel_api::kernel_api_init();
protect_filter::Init();
+ kernel_api::kernel_api_init();
kernel_comm_create::Init();
+
+ //inline_hooks_manager::fn_get_instance()->inline_install_hook(NtOpenProcess, hkNtOpenProcess, (void**)&origon_ntOpenProcess);
+ //inline_hooks_manager::fn_get_instance()->inline_install_hook(NtCreateFile, hkNtCreateFile, (void**)&origon_ntCreatFile);
+
+
+ mouse_keybord_hook::install_mouse_keybord_hook();
DbgPrintEx(77, 0, "[+]ob_reg_callback status:%x\n", ob_call_back::register_ob_reg_callback());
- //DbgPrintEx(77, 0, "[+]create_thread_routine status:%x\n", thread_notify_routine::create_thread_routine());
+ DbgPrintEx(77, 0, "[+]process_notify_callback status:%x\n", process_notify_callback::install_process_notify());
+ DbgPrintEx(77, 0, "[+]create_thread_routine status:%x\n", thread_notify_routine::create_thread_routine());
+
+
return STATUS_SUCCESS;
}
\ No newline at end of file
diff --git a/Anti-Cheat_Driver/kernel_api.cpp b/Anti-Cheat_Driver/kernel_api.cpp
index 7cd53e3..bbbf435 100644
--- a/Anti-Cheat_Driver/kernel_api.cpp
+++ b/Anti-Cheat_Driver/kernel_api.cpp
@@ -1,9 +1,9 @@
#include "kernel_api.h"
+struct imported_ imported { 0 };
+
namespace kernel_api
{
- struct imported_ imported { 0 };
-
auto kernel_api_init() -> void
{
UNICODE_STRING unFuncName{ 0 };
@@ -19,6 +19,9 @@ namespace kernel_api
RtlInitUnicodeString(&unFuncName, L"SeLocateProcessImageName");
imported.se_locateprocess_imagename = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
+
+ RtlInitUnicodeString(&unFuncName, L"RtlFindExportedRoutineByName");
+ imported.rtl_findexported_routinebyname = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
}
NTSTATUS ntquerysysteminformation(ULONG SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength)
@@ -43,4 +46,11 @@ namespace kernel_api
return reinterpret_cast
(imported.se_locateprocess_imagename)(Process, pImageFileName);
}
+
+ PVOID rtlfindexportedroutinebyname(PVOID ImageBase, PCCH RoutineName)
+ {
+ return reinterpret_cast(imported.rtl_findexported_routinebyname)
+ (ImageBase, RoutineName);
+ }
}
+
\ No newline at end of file
diff --git a/Anti-Cheat_Driver/kernel_api.h b/Anti-Cheat_Driver/kernel_api.h
index 063f2cd..d96312d 100644
--- a/Anti-Cheat_Driver/kernel_api.h
+++ b/Anti-Cheat_Driver/kernel_api.h
@@ -23,7 +23,7 @@ struct imported_
namespace kernel_api
{
- extern struct imported_ imported;
+ //extern struct imported_ imported;
auto kernel_api_init() -> void;
@@ -38,4 +38,5 @@ namespace kernel_api
NTSTATUS selocate_process_imagename(PEPROCESS Process, PUNICODE_STRING* pImageFileName);
+ PVOID rtlfindexportedroutinebyname(PVOID ImageBase, PCCH RoutineName);
}
\ No newline at end of file
diff --git a/Anti-Cheat_Driver/kernel_function.cpp b/Anti-Cheat_Driver/kernel_function.cpp
index 4c8ae6d..8e8a8e6 100644
--- a/Anti-Cheat_Driver/kernel_function.cpp
+++ b/Anti-Cheat_Driver/kernel_function.cpp
@@ -5,10 +5,9 @@
#pragma warning(disable : 4838)
namespace kernel_function
{
- PEPROCESS process{ 0 };
-
auto FindProcess(const CHAR* ProcessName) -> PEPROCESS
{
+ PEPROCESS process{ 0 };
for (ULONG i = 4; i < 0x401000; i += 4)
{
auto status = PsLookupProcessByProcessId(ULongToHandle(i), &process);
@@ -68,6 +67,65 @@ namespace kernel_function
return base;
}
+ auto GetProcessModule(HANDLE Pid, UNICODE_STRING ModuleName, PVOID Buffer) -> NTSTATUS
+ {
+ NTSTATUS status = STATUS_SUCCESS;
+ PEPROCESS process = NULL;
+ UNICODE_STRING UniCodeName{ 0 };
+ uintptr_t ModuleBase = 0;
+
+ status = PsLookupProcessByProcessId(Pid, &process);
+ if (!NT_SUCCESS(status))
+ {
+ DbgPrintEx(77, 0, "[drv_memory] PsLookupProcessByProcessId failed with status %x\n", status);
+ return status;
+ }
+ BOOLEAN Is64 = (utils::PsGetProcessWow64Process(process) != NULL) ? TRUE : FALSE;
+
+ KAPC_STATE ApcState;
+ KeStackAttachProcess(process, &ApcState);
+ if (Is64)
+ {
+ PPEB32 Peb32 = (PPEB32)utils::PsGetProcessWow64Process(process);
+ PLIST_ENTRY32 LdrEntry32 = (PLIST_ENTRY32)((PPEB_LDR_DATA32)Peb32->Ldr)->InLoadOrderModuleList.Flink;
+ while (LdrEntry32 != &((PPEB_LDR_DATA32)Peb32->Ldr)->InLoadOrderModuleList)
+ {
+ PLDR_DATA_TABLE_ENTRY32 LdrDataTableEntry32 = (PLDR_DATA_TABLE_ENTRY32)LdrEntry32;
+ if (LdrDataTableEntry32->BaseDllName.Buffer == NULL) continue;
+
+ RtlInitUnicodeString(&UniCodeName, (PWCHAR)LdrDataTableEntry32->BaseDllName.Buffer);
+ if (RtlEqualUnicodeString(&ModuleName, &UniCodeName, TRUE))
+ {
+ ModuleBase = (uintptr_t)LdrDataTableEntry32->DllBase;
+ break;
+ }
+ LdrEntry32 = (PLIST_ENTRY32)LdrEntry32->Flink;
+ }
+ }
+ else
+ {
+ PPEB64 Peb64 = (PPEB64)utils::PsGetProcessPeb(process);
+ PLIST_ENTRY64 LdrEntry64 = (PLIST_ENTRY64)((PPEB_LDR_DATA64)Peb64->Ldr)->InLoadOrderModuleList.Flink;
+ while (LdrEntry64 != &((PPEB_LDR_DATA64)Peb64->Ldr)->InLoadOrderModuleList)
+ {
+ PLDR_DATA_TABLE_ENTRY64 LdrDataTableEntry64 = (PLDR_DATA_TABLE_ENTRY64)LdrEntry64;
+ if (LdrDataTableEntry64->BaseDllName.Buffer == NULL) continue;
+
+ RtlInitUnicodeString(&UniCodeName, LdrDataTableEntry64->BaseDllName.Buffer);
+ if (RtlEqualUnicodeString(&UniCodeName, &ModuleName, TRUE))
+ {
+ ModuleBase = (uintptr_t)LdrDataTableEntry64->DllBase;
+ break;
+ }
+ LdrEntry64 = (PLIST_ENTRY64)LdrEntry64->Flink;
+ }
+ }
+ KeUnstackDetachProcess(&ApcState);
+ ObDereferenceObject(process);
+ RtlCopyMemory(Buffer, &ModuleBase, sizeof(uintptr_t));
+ return status;
+ }
+
auto MmMDLPagesCopy(IN PVOID Address, PVOID Buff, SIZE_T Size, BYTE Type, CHAR AccessMode) -> NTSTATUS
{
PMDL pMDL = IoAllocateMdl(Address, (ULONG)Size, FALSE, FALSE, NULL);
@@ -169,5 +227,33 @@ namespace kernel_function
return TRUE;
}
+ auto ke_stack_attch_process(PEPROCESS PROCESS) -> KAPC_STATE
+ {
+ KAPC_STATE apc_state{ 0 };
+ KeStackAttachProcess(PROCESS, &apc_state);
+ return apc_state;
+ }
+ auto ke_unstack_detach_process(KAPC_STATE apc_state) -> void
+ {
+ KeUnstackDetachProcess(&apc_state);
+ }
+
+ auto GetgSessionGlobalSlots() -> uintptr_t {
+
+ static uintptr_t gSessionGlobalSlots;
+ if (gSessionGlobalSlots == NULL) {
+ auto win32k = GetKernelModule("win32k.sys");
+ if (!win32k)
+ return NULL;
+
+ auto W32GetSessionStateForSession = utils::FindSectionsCode(win32k, "\x48\x8b\x05\x00\x00\x00\x00\xff\xc9\x48\x8b\x04\xc8", "xxx????xxxxxx", ".text");
+ if (!W32GetSessionStateForSession)
+ return NULL;
+
+ gSessionGlobalSlots = (*(ULONG*)(W32GetSessionStateForSession + 3)) + (W32GetSessionStateForSession + 7);
+ }
+
+ return gSessionGlobalSlots;
+ }
}
diff --git a/Anti-Cheat_Driver/kernel_function.h b/Anti-Cheat_Driver/kernel_function.h
index 8588a08..7b5c42c 100644
--- a/Anti-Cheat_Driver/kernel_function.h
+++ b/Anti-Cheat_Driver/kernel_function.h
@@ -37,11 +37,119 @@ namespace kernel_function
RTL_PROCESS_MODULE_INFORMATION Modules[1];
} RTL_PROCESS_MODULES, * PRTL_PROCESS_MODULES;
+ typedef struct _PEB32
+ {
+ UCHAR InheritedAddressSpace;
+ UCHAR ReadImageFileExecOptions;
+ UCHAR BeingDebugged;
+ UCHAR BitField;
+ ULONG Mutant;
+ ULONG ImageBaseAddress;
+ ULONG Ldr;
+ ULONG ProcessParameters;
+ ULONG SubSystemData;
+ ULONG ProcessHeap;
+ ULONG FastPebLock;
+ ULONG AtlThunkSListPtr;
+ ULONG IFEOKey;
+ ULONG CrossProcessFlags;
+ ULONG UserSharedInfoPtr;
+ ULONG SystemReserved;
+ ULONG AtlThunkSListPtr32;
+ ULONG ApiSetMap;
+ } PEB32, * PPEB32; ////32 PEB结构
+
+ typedef struct _LDR_DATA_TABLE_ENTRY32
+ {
+ LIST_ENTRY32 InLoadOrderLinks;
+ LIST_ENTRY32 InMemoryOrderLinks;
+ LIST_ENTRY32 InInitializationOrderLinks;
+ ULONG DllBase;
+ ULONG EntryPoint;
+ ULONG SizeOfImage;
+ UNICODE_STRING32 FullDllName;
+ UNICODE_STRING32 BaseDllName;
+ ULONG Flags;
+ USHORT LoadCount;
+ USHORT TlsIndex;
+ LIST_ENTRY32 HashLinks;
+ ULONG TimeDateStamp;
+ } LDR_DATA_TABLE_ENTRY32, * PLDR_DATA_TABLE_ENTRY32;//32 PEB结构
+ typedef struct _PEB_LDR_DATA32
+ {
+ ULONG Length;
+ UCHAR Initialized;
+ ULONG SsHandle;
+ LIST_ENTRY32 InLoadOrderModuleList;
+ LIST_ENTRY32 InMemoryOrderModuleList;
+ LIST_ENTRY32 InInitializationOrderModuleList;
+ } PEB_LDR_DATA32, * PPEB_LDR_DATA32;//32 PEB结构
+
+ typedef struct _PEB64
+ {
+ UCHAR InheritedAddressSpace;
+ UCHAR ReadImageFileExecOptions;
+ UCHAR BeingDebugged;
+ UCHAR BitField;
+ ULONG64 Mutant;
+ ULONG64 ImageBaseAddress;
+ ULONG64 Ldr;
+ ULONG64 ProcessParameters;
+ ULONG64 SubSystemData;
+ ULONG64 ProcessHeap;
+ ULONG64 FastPebLock;
+ ULONG64 AtlThunkSListPtr;
+ ULONG64 IFEOKey;
+ ULONG64 CrossProcessFlags;
+ ULONG64 UserSharedInfoPtr;
+ ULONG SystemReserved;
+ ULONG AtlThunkSListPtr32;
+ ULONG64 ApiSetMap;
+ } PEB64, * PPEB64;
+ typedef struct _PEB_LDR_DATA64
+ {
+ ULONG Length;
+ BOOLEAN Initialized;
+ ULONG64 SsHandle;
+ LIST_ENTRY64 InLoadOrderModuleList;
+ LIST_ENTRY64 InMemoryOrderModuleList;
+ LIST_ENTRY64 InInitializationOrderModuleList;
+ ULONG64 EntryInProgress;
+ } PEB_LDR_DATA64, * PPEB_LDR_DATA64;
+ typedef struct _LDR_DATA_TABLE_ENTRY64
+ {
+ LIST_ENTRY64 InLoadOrderLinks;
+ LIST_ENTRY64 InMemoryOrderLinks;
+ LIST_ENTRY64 InInitializationOrderLinks;
+ PVOID DllBase;
+ ULONG64 EntryPoint;
+ ULONG64 SizeOfImage;
+ UNICODE_STRING FullDllName;
+ UNICODE_STRING BaseDllName;
+ ULONG Flags;
+ USHORT LoadCount;
+ USHORT TlsIndex;
+ LIST_ENTRY64 HashLinks;
+ ULONG64 SectionPointer;
+ ULONG64 CheckSum;
+ ULONG64 TimeDateStamp;
+ ULONG64 LoadedImports;
+ ULONG64 EntryPointActivationContext;
+ ULONG64 PatchInformation;
+ LIST_ENTRY64 ForwarderLinks;
+ LIST_ENTRY64 ServiceTagLinks;
+ LIST_ENTRY64 StaticLinks;
+ ULONG64 ContextInformation;
+ ULONG64 OriginalBase;
+ LARGE_INTEGER LoadTime;
+ } LDR_DATA_TABLE_ENTRY64, * PLDR_DATA_TABLE_ENTRY64;
auto FindProcess(CONST CHAR* ProcessName)->PEPROCESS;
auto GetKernelModule(CONST CHAR* Module)->uintptr_t;
+ auto GetProcessModule(HANDLE Pid, UNICODE_STRING ModuleName, PVOID Buffer) -> NTSTATUS;
+
auto MmMDLPagesCopy(IN PVOID Address, PVOID Buff, SIZE_T Size, BYTE Type, CHAR AccessMode)->NTSTATUS;
auto GetMmverifyCallBackFlags()->uintptr_t;
@@ -49,4 +157,10 @@ namespace kernel_function
auto Mack_MmVerifyCallBackFlags(BYTE** orgin_byte)->BOOL;
auto Orgin_MmVerifyCallBackFlags(BYTE* orgin_byte)->BOOL;
+
+ auto ke_stack_attch_process(PEPROCESS PROCESS) ->KAPC_STATE;
+
+ auto ke_unstack_detach_process(KAPC_STATE apc_state) -> void;
+
+ auto GetgSessionGlobalSlots()->uintptr_t;
}
\ No newline at end of file