maowengrui/anit-cheat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix close VerifyFlags

Browse Source
This commit is contained in:
maowenrui
2026-06-11 15:26:00 +08:00
parent 91a213d460
commit 4634e0a6db
1 changed files with 12 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Anti-Cheat_Driver/ob_reg_callback.cpp
+12 -6
View File
@@ -1,5 +1,6 @@
#include "ob_reg_callback.h" #include "ob_reg_callback.h"
#include "protect_filter.h" #include "protect_filter.h"
#include "kernel_function.h"
void* reg_ob_callback_handle; void* reg_ob_callback_handle;
@@ -22,13 +23,15 @@ auto ob_call_back::register_ob_reg_callback() -> NTSTATUS
auto ob_callback = [](_In_ PVOID RegistrationContext, auto ob_callback = [](_In_ PVOID RegistrationContext,
_In_ POB_PRE_OPERATION_INFORMATION pOperationInformation) -> OB_PREOP_CALLBACK_STATUS _In_ POB_PRE_OPERATION_INFORMATION pOperationInformation) -> OB_PREOP_CALLBACK_STATUS
{ {
UNREFERENCED_PARAMETER(pOperationInformation);
UNREFERENCED_PARAMETER(RegistrationContext); UNREFERENCED_PARAMETER(RegistrationContext);
auto dwPid = PsGetProcessId(reinterpret_cast<PEPROCESS>(pOperationInformation->Object));
auto dwPid = kernel_api::psgetprocessid(reinterpret_cast<PEPROCESS>(pOperationInformation->Object));
auto operation_eprocess = PsGetCurrentProcess(); auto operation_eprocess = PsGetCurrentProcess();
PUNICODE_STRING image_file_name{ 0 }; PUNICODE_STRING image_file_name{ 0 };
auto status = SeLocateProcessImageName(operation_eprocess, &image_file_name); auto status = kernel_api::selocate_process_imagename(operation_eprocess, &image_file_name);
if (NT_SUCCESS(status)) if (NT_SUCCESS(status))
{ {
if(is_allow_process(image_file_name)) if(is_allow_process(image_file_name))
@@ -36,8 +39,8 @@ auto ob_call_back::register_ob_reg_callback() -> NTSTATUS
if (protect_filter::is_protect_pid(HandleToLong(dwPid), nullptr)) if (protect_filter::is_protect_pid(HandleToLong(dwPid), nullptr))
{ {
pOperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess = 0; //pOperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess = 0;
pOperationInformation->Parameters->DuplicateHandleInformation.OriginalDesiredAccess = 0; //pOperationInformation->Parameters->DuplicateHandleInformation.OriginalDesiredAccess = 0;
} }
} }
end: end:
@@ -64,8 +67,11 @@ auto ob_call_back::register_ob_reg_callback() -> NTSTATUS
//方式2 : 注册两个ObRegisterCallbacks 层分别在xx的上方和下方 等xx抹了之后 抹回去 //方式2 : 注册两个ObRegisterCallbacks 层分别在xx的上方和下方 等xx抹了之后 抹回去
//方式3 ：Pte hook Obp //方式3 ：Pte hook Obp
//方式4 ：遍历CallbacksList替换或修改Pre Post函数 //方式4 ：遍历CallbacksList替换或修改Pre Post函数
BYTE* orgin_byte = nullptr;
kernel_function::Mack_MmVerifyCallBackFlags(&orgin_byte);
status = ObRegisterCallbacks(&obReg, &reg_ob_callback_handle); status = ObRegisterCallbacks(&obReg, &reg_ob_callback_handle);
kernel_function::Orgin_MmVerifyCallBackFlags((BYTE*)&orgin_byte);
return status; return status;
} }