fix close VerifyFlags

Anti-Cheat_Driver/ob_reg_callback.cpp

@@ -1,5 +1,6 @@
 #include "ob_reg_callback.h"
 #include "protect_filter.h"
+#include "kernel_function.h"
 
 void* reg_ob_callback_handle;
 
@@ -22,13 +23,15 @@ auto ob_call_back::register_ob_reg_callback() -> NTSTATUS
 	auto ob_callback = [](_In_ PVOID RegistrationContext, 
 		_In_ POB_PRE_OPERATION_INFORMATION pOperationInformation) -> OB_PREOP_CALLBACK_STATUS
 	{
+		UNREFERENCED_PARAMETER(pOperationInformation);
 		UNREFERENCED_PARAMETER(RegistrationContext);
-		auto dwPid = PsGetProcessId(reinterpret_cast<PEPROCESS>(pOperationInformation->Object));
-		
+
+		auto dwPid = kernel_api::psgetprocessid(reinterpret_cast<PEPROCESS>(pOperationInformation->Object));
+
 		auto operation_eprocess = PsGetCurrentProcess();
 
 		PUNICODE_STRING image_file_name{ 0 };
-		auto status = SeLocateProcessImageName(operation_eprocess, &image_file_name);
+		auto status = kernel_api::selocate_process_imagename(operation_eprocess, &image_file_name);
 		if (NT_SUCCESS(status))
 		{
 			if(is_allow_process(image_file_name))
@@ -36,8 +39,8 @@ auto ob_call_back::register_ob_reg_callback() -> NTSTATUS
 				
 			if (protect_filter::is_protect_pid(HandleToLong(dwPid), nullptr))
 			{
-				pOperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess = 0;
-				pOperationInformation->Parameters->DuplicateHandleInformation.OriginalDesiredAccess = 0;
+				//pOperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess = 0;
+				//pOperationInformation->Parameters->DuplicateHandleInformation.OriginalDesiredAccess = 0;
 			}
 		}
 	end:
@@ -64,8 +67,11 @@ auto ob_call_back::register_ob_reg_callback() -> NTSTATUS
 	//方式2 : 注册两个ObRegisterCallbacks 层分别在xx的上方和下方 等xx抹了之后 抹回去
 	//方式3 ：Pte hook Obp
 	//方式4 ：遍历CallbacksList替换或修改Pre Post函数
-
+	BYTE* orgin_byte = nullptr;
+	kernel_function::Mack_MmVerifyCallBackFlags(&orgin_byte);
 	status = ObRegisterCallbacks(&obReg, &reg_ob_callback_handle);
+	kernel_function::Orgin_MmVerifyCallBackFlags((BYTE*)&orgin_byte);
+
 	return status;
 }