commit 4bf9a4217079e9519d0da0333483ba8c20d2ae5a Author: maowenrui <3505719167@qq.com> Date: Wed May 27 13:24:57 2026 +0800 init diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..f22488c --- /dev/null +++ b/.gitignore @@ -0,0 +1,4 @@ +/.vs +/x64 +/Anti-Cheat_Driver/Debug +/Anti-Cheat_Driver/x64 \ No newline at end of file diff --git a/Anti-Cheat_Driver.sln b/Anti-Cheat_Driver.sln new file mode 100644 index 0000000..d9d0768 --- /dev/null +++ b/Anti-Cheat_Driver.sln @@ -0,0 +1,51 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Version 16 +VisualStudioVersion = 16.0.37206.5 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Anti-Cheat_Driver", "Anti-Cheat_Driver\Anti-Cheat_Driver.vcxproj", "{E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|ARM = Debug|ARM + Debug|ARM64 = Debug|ARM64 + Debug|x64 = Debug|x64 + Debug|x86 = Debug|x86 + Release|ARM = Release|ARM + Release|ARM64 = Release|ARM64 + Release|x64 = Release|x64 + Release|x86 = Release|x86 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Debug|ARM.ActiveCfg = Debug|ARM + {E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Debug|ARM.Build.0 = Debug|ARM + {E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Debug|ARM.Deploy.0 = Debug|ARM + {E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Debug|ARM64.ActiveCfg = Debug|ARM64 + {E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Debug|ARM64.Build.0 = Debug|ARM64 + {E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Debug|ARM64.Deploy.0 = Debug|ARM64 + {E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Debug|x64.ActiveCfg = Debug|x64 + {E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Debug|x64.Build.0 = Debug|x64 + {E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Debug|x64.Deploy.0 = Debug|x64 + {E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Debug|x86.ActiveCfg = Debug|Win32 + {E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Debug|x86.Build.0 = Debug|Win32 + {E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Debug|x86.Deploy.0 = Debug|Win32 + {E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Release|ARM.ActiveCfg = Release|ARM + {E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Release|ARM.Build.0 = Release|ARM + {E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Release|ARM.Deploy.0 = Release|ARM + {E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Release|ARM64.ActiveCfg = Release|ARM64 + {E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Release|ARM64.Build.0 = Release|ARM64 + {E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Release|ARM64.Deploy.0 = Release|ARM64 + {E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Release|x64.ActiveCfg = Release|x64 + {E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Release|x64.Build.0 = Release|x64 + {E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Release|x64.Deploy.0 = Release|x64 + {E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Release|x86.ActiveCfg = Release|Win32 + {E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Release|x86.Build.0 = Release|Win32 + {E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Release|x86.Deploy.0 = Release|Win32 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection + GlobalSection(ExtensibilityGlobals) = postSolution + SolutionGuid = {CD588ADD-9BCE-4444-9BBE-0E95D50A1FE4} + EndGlobalSection +EndGlobal diff --git a/Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj b/Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj new file mode 100644 index 0000000..bc97148 --- /dev/null +++ b/Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj @@ -0,0 +1,166 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + Debug + ARM + + + Release + ARM + + + Debug + ARM64 + + + Release + ARM64 + + + + {E15AAB35-A0F2-4401-A41C-4AB5B200C6AD} + {dd38f7fc-d7bd-488b-9242-7d8754cde80d} + v4.5 + 12.0 + Debug + Win32 + Anti_Cheat_Driver + + + + Windows10 + true + WindowsKernelModeDriver10.0 + Driver + WDM + + + Windows10 + false + WindowsKernelModeDriver10.0 + Driver + WDM + + + Windows10 + true + WindowsKernelModeDriver10.0 + Driver + WDM + + + Windows7 + false + WindowsKernelModeDriver10.0 + Driver + WDM + + + Windows10 + true + WindowsKernelModeDriver10.0 + Driver + WDM + + + Windows10 + false + WindowsKernelModeDriver10.0 + Driver + WDM + + + Windows10 + true + WindowsKernelModeDriver10.0 + Driver + WDM + + + Windows10 + false + WindowsKernelModeDriver10.0 + Driver + WDM + + + + + + + + + + + DbgengKernelDebugger + + + DbgengKernelDebugger + + + DbgengKernelDebugger + + + DbgengKernelDebugger + + + DbgengKernelDebugger + + + DbgengKernelDebugger + + + DbgengKernelDebugger + + + DbgengKernelDebugger + + + + /INTEGRITYCHECK %(AdditionalOptions) + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj.filters b/Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj.filters new file mode 100644 index 0000000..e203ec0 --- /dev/null +++ b/Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj.filters @@ -0,0 +1,91 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hpp;hxx;hm;inl;inc;xsd + + + {8E41214B-6785-4CFE-B992-037D68949A14} + inf;inv;inx;mof;mc; + + + {eedbbbd4-845f-4fda-933c-23fd4c209ab3} + + + {b3f98251-c1bf-4bd0-a5bd-d5425c272a5e} + + + {1373c16e-e769-4553-b7b9-0f87b2f6ab0e} + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + {6ba5e47f-4fd9-46a0-b7f1-f1b3c67ec0b3} + + + {f5a68c3d-f493-4980-b3d2-b26f3f25e1be} + + + {17541143-1a94-4036-9c0b-54a1855caa73} + + + + + Source Files + + + kernel_callback + + + kernel_extern_api + + + Iocontrol + + + utils + + + window_function + + + kernel_private + + + kernel_callback + + + + + Header Files + + + kernel_callback + + + kernel_extern_api + + + Iocontrol + + + utils + + + window_function + + + kernel_private + + + kernel_callback + + + \ No newline at end of file diff --git a/Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj.user b/Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj.user new file mode 100644 index 0000000..88a5509 --- /dev/null +++ b/Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj.user @@ -0,0 +1,4 @@ + + + + \ No newline at end of file diff --git a/Anti-Cheat_Driver/Base.h b/Anti-Cheat_Driver/Base.h new file mode 100644 index 0000000..c20f8c6 --- /dev/null +++ b/Anti-Cheat_Driver/Base.h @@ -0,0 +1,12 @@ +#pragma once +#ifndef BASE_H +#define BASE_H + +#include +#include +#include +#include +#include + + +#endif // !BASE_H diff --git a/Anti-Cheat_Driver/anit_screen_grap.cpp b/Anti-Cheat_Driver/anit_screen_grap.cpp new file mode 100644 index 0000000..793fa6f --- /dev/null +++ b/Anti-Cheat_Driver/anit_screen_grap.cpp @@ -0,0 +1,50 @@ +#include "anit_screen_grap.h" +#include "utils.h" +#include "kernel_function.h" + + +namespace anit_screen_grap +{ + auto GreProtectSpriteContent(HWND hWnd, UINT Flags) -> BOOL + { + UNREFERENCED_PARAMETER(hWnd); + UNREFERENCED_PARAMETER(Flags); + auto eprocess = kernel_function::FindProcess("IHuan.exe"); + + ObDereferenceObject(eprocess); + + KAPC_STATE apc{ 0 }; + + KeStackAttachProcess(eprocess, &apc); + + typedef BOOL(__fastcall* fn_GreProtectSpriteContent)(LPVOID, HWND, INT, UINT); + static fn_GreProtectSpriteContent _GreProtectSpriteContent = nullptr; + if (!_GreProtectSpriteContent) { + auto version = utils::GetVersion(); + + if (version.dwBuildNumber == 7601 || version.dwBuildNumber == 7600) + { + auto ker_win32k_base = kernel_function::GetKernelModule("win32k.sys"); + auto func_offset = utils::FindSectionsCode(ker_win32k_base, "\xE8\x00\x00\x00\x00\x8B\xF8\x85\xC0\x75\x26\x85\xF6", "x????xxxxxxxx", ".text"); + _GreProtectSpriteContent = (fn_GreProtectSpriteContent)((*(long*)(func_offset + 1)) + (func_offset + 5)); + } + else + { + auto ker_win32kfull_base = kernel_function::GetKernelModule("win32kfull.sys"); + auto func_offset = utils::FindSectionsCode(ker_win32kfull_base, "\xE8\x00\x00\x00\x00\x8B\x00\x85\xC0\x75\x0E\x85\x00\x74\x00\x33\xD2", "x????x?xxxxx?x?xx", ".text"); + _GreProtectSpriteContent = (fn_GreProtectSpriteContent)((*(long*)(func_offset + 1)) + (func_offset + 5)); + } + } + + if (!_GreProtectSpriteContent) + return FALSE; + + DbgPrintEx(77, 0, "%p\n", _GreProtectSpriteContent); + + auto suc = _GreProtectSpriteContent(NULL, hWnd, TRUE, Flags); + + KeUnstackDetachProcess(&apc); + return suc; + } + +} \ No newline at end of file diff --git a/Anti-Cheat_Driver/anit_screen_grap.h b/Anti-Cheat_Driver/anit_screen_grap.h new file mode 100644 index 0000000..ea5b409 --- /dev/null +++ b/Anti-Cheat_Driver/anit_screen_grap.h @@ -0,0 +1,9 @@ +#pragma once +#include "Base.h" + +namespace anit_screen_grap +{ + auto GreProtectSpriteContent(HWND hWnd, UINT Flags) -> BOOL; + + +} \ No newline at end of file diff --git a/Anti-Cheat_Driver/create_thread_callback.cpp b/Anti-Cheat_Driver/create_thread_callback.cpp new file mode 100644 index 0000000..ecb121f --- /dev/null +++ b/Anti-Cheat_Driver/create_thread_callback.cpp @@ -0,0 +1,55 @@ +#include "create_thread_callback.h" + + + + + +namespace thread_notify_routine +{ + //±£»¤µÄ½ø³ÌID + auto protect_id = ULongToHandle(3460); + + + void thread_notify_routine(HANDLE ProcessId, HANDLE ThreadId, BOOLEAN Create) + { + if (Create) + { + PEPROCESS process{ 0 }; + auto status = PsLookupProcessByProcessId(ProcessId, &process); + if (!NT_SUCCESS(status)) + goto end; + + PEPROCESS protect_process{ 0 }; + status = PsLookupProcessByProcessId(protect_id, &protect_process); + if (!NT_SUCCESS(status)) + goto end; + + if (protect_process != process) + goto end; + + auto cutor_process_id = PsGetCurrentProcessId(); + if (ProcessId != cutor_process_id) + { + DbgPrintEx(77, 0, "[!] ¶ñÒâÔ¶³ÌÏ̼߳ì²â£¡\n"); + DbgPrintEx(77, 0, "[!] Ä¿±ê½ø³Ì: %d\n", ProcessId); + DbgPrintEx(77, 0, "[!] ±»´´½¨Ïß³Ì: %d\n", ThreadId); + DbgPrintEx(77, 0, "[!] ´´½¨Õß½ø³Ì: %d\n", cutor_process_id); + } + + + end: + ObDereferenceObject(process); + } + } + + auto create_thread_routine() -> NTSTATUS + { + return PsSetCreateThreadNotifyRoutine(thread_notify_routine); + } + + auto unload_thread_routine() -> NTSTATUS + { + return PsRemoveCreateThreadNotifyRoutine(thread_notify_routine); + } + +} \ No newline at end of file diff --git a/Anti-Cheat_Driver/create_thread_callback.h b/Anti-Cheat_Driver/create_thread_callback.h new file mode 100644 index 0000000..11d4355 --- /dev/null +++ b/Anti-Cheat_Driver/create_thread_callback.h @@ -0,0 +1,11 @@ +#pragma once +#include "Base.h" + +namespace thread_notify_routine +{ + + auto create_thread_routine()->NTSTATUS; + + auto unload_thread_routine()->NTSTATUS; + +} \ No newline at end of file diff --git a/Anti-Cheat_Driver/driver_main.cpp b/Anti-Cheat_Driver/driver_main.cpp new file mode 100644 index 0000000..730a4e3 --- /dev/null +++ b/Anti-Cheat_Driver/driver_main.cpp @@ -0,0 +1,19 @@ +#include "ob_reg_callback.h" +#include "anit_screen_grap.h" +#include "create_thread_callback.h" + +EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING) +{ + drv_obj->DriverUnload = [](PDRIVER_OBJECT) + { + ob_call_back::uninstall_ob_callback(); + thread_notify_routine::unload_thread_routine(); + }; + + kernel_api::kernel_api_init(); + thread_notify_routine::create_thread_routine(); + ob_call_back::register_ob_reg_callback(); + + + return STATUS_SUCCESS; +} \ No newline at end of file diff --git a/Anti-Cheat_Driver/io_ctl.cpp b/Anti-Cheat_Driver/io_ctl.cpp new file mode 100644 index 0000000..3a8a3e6 --- /dev/null +++ b/Anti-Cheat_Driver/io_ctl.cpp @@ -0,0 +1,60 @@ +#include "io_ctl.h" + +UNICODE_STRING g_usDeviceName = RTL_CONSTANT_STRING(L"\\Device\\dump_Test"); +UNICODE_STRING g_usSymbolicName = RTL_CONSTANT_STRING(L"\\??\\_dump_"); + +auto io_ctl::init_device_and_symbolic(PDRIVER_OBJECT drv_obj) -> NTSTATUS +{ + auto dispatch_create_close = [](PDEVICE_OBJECT devcie_object, PIRP irp) + { + UNREFERENCED_PARAMETER(devcie_object); + + irp->IoStatus.Information = 0; + irp->IoStatus.Status = 0; + IoCompleteRequest(irp, IO_NO_INCREMENT); + + return STATUS_SUCCESS; + }; + + + NTSTATUS status{ 0 }; + PDEVICE_OBJECT dev_obj{ 0 }; + + while (1) + { + status = IoCreateDevice(drv_obj, NULL, &g_usDeviceName, FILE_DEVICE_UNKNOWN, NULL, NULL, &dev_obj); + if (!NT_SUCCESS(status)) + { + DbgPrintEx(77, 0, "[+] failed io create dev!!\n"); + break; + } + + status = IoCreateSymbolicLink(&g_usSymbolicName, &g_usDeviceName); + if (!NT_SUCCESS(status)) + { + DbgPrintEx(77, 0, "[+] failed io create link!!\n"); + break; + } + + break; + } + + drv_obj->MajorFunction[IRP_MJ_CLOSE] = dispatch_create_close; + drv_obj->MajorFunction[IRP_MJ_CREATE] = dispatch_create_close; + drv_obj->MajorFunction[IRP_MJ_DEVICE_CONTROL] = dispatch_device_io; + return status; + +} + +auto io_ctl::dispatch_device_io(PDEVICE_OBJECT devcie_object, PIRP irp) -> NTSTATUS +{ + UNREFERENCED_PARAMETER(devcie_object); + NTSTATUS status{ 0 }; + + + + irp->IoStatus.Information = 0; + irp->IoStatus.Status = status; + IoCompleteRequest(irp, IO_NO_INCREMENT); + return status; +} diff --git a/Anti-Cheat_Driver/io_ctl.h b/Anti-Cheat_Driver/io_ctl.h new file mode 100644 index 0000000..a47818c --- /dev/null +++ b/Anti-Cheat_Driver/io_ctl.h @@ -0,0 +1,9 @@ +#pragma once +#include "Base.h" + +namespace io_ctl +{ + auto init_device_and_symbolic(PDRIVER_OBJECT drv_obj) -> NTSTATUS; + + auto dispatch_device_io(PDEVICE_OBJECT devcie_object, PIRP irp) -> NTSTATUS; +} \ No newline at end of file diff --git a/Anti-Cheat_Driver/kernel_api.cpp b/Anti-Cheat_Driver/kernel_api.cpp new file mode 100644 index 0000000..63aeb75 --- /dev/null +++ b/Anti-Cheat_Driver/kernel_api.cpp @@ -0,0 +1,30 @@ +#include "kernel_api.h" + +namespace kernel_api +{ + struct imported_ imported { 0 }; + + auto kernel_api_init() -> void + { + UNICODE_STRING unFuncName{ 0 }; + + RtlInitUnicodeString(&unFuncName, L"ZwQuerySystemInformation"); + imported.nt_querysystem_information = (ULONG64)MmGetSystemRoutineAddress(&unFuncName); + + + RtlInitUnicodeString(&unFuncName, L"PsGetProcessImageFileName"); + imported.ps_getprocessimage_filname = (ULONG64)MmGetSystemRoutineAddress(&unFuncName); + } + + NTSTATUS ntquerysysteminformation(ULONG SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength) + { + return reinterpret_cast(imported.nt_querysystem_information) + (SystemInformationClass, SystemInformation, SystemInformationLength, ReturnLength); + } + + UCHAR* psgetprocessimagefilname(PEPROCESS Process) + { + return reinterpret_cast + (imported.ps_getprocessimage_filname)(Process); + } +} diff --git a/Anti-Cheat_Driver/kernel_api.h b/Anti-Cheat_Driver/kernel_api.h new file mode 100644 index 0000000..ec3e145 --- /dev/null +++ b/Anti-Cheat_Driver/kernel_api.h @@ -0,0 +1,35 @@ +#pragma once +#include "Base.h" + +struct imported_ +{ + ULONG64 zw_setsystem_information; + ULONG64 mm_copy_virtualMemory; + ULONG64 nt_querysystem_information; + ULONG64 rtl_findexported_routinebyname; + ULONG64 ex_get_previous_mode; + ULONG64 io_create_driver; + ULONG64 zw_trace_control; + ULONG64 ps_getprocessimage_filname; + ULONG64 zw_protect_virtualmemory; + ULONG64 ps_lookup_processby_processid; + ULONG64 ps_getprocess_exitstatus; + ULONG64 io_getcurrent_process; + ULONG64 mm_copy_memory; + ULONG64 ps_getprocess_section_baseaddress; +}; + +namespace kernel_api +{ + extern struct imported_ imported; + + auto kernel_api_init() -> void; + + NTSTATUS ntquerysysteminformation(ULONG SystemInformationClass, + PVOID SystemInformation, + ULONG SystemInformationLength, + PULONG ReturnLength); + + UCHAR* psgetprocessimagefilname(PEPROCESS Process); + +} \ No newline at end of file diff --git a/Anti-Cheat_Driver/kernel_function.cpp b/Anti-Cheat_Driver/kernel_function.cpp new file mode 100644 index 0000000..b14e1ea --- /dev/null +++ b/Anti-Cheat_Driver/kernel_function.cpp @@ -0,0 +1,70 @@ +#include "kernel_function.h" +#include "kernel_api.h" + +namespace kernel_function +{ + PEPROCESS process{ 0 }; + + auto FindProcess(const CHAR* ProcessName) -> PEPROCESS + { + for (ULONG i = 4; i < 0x401000; i += 4) + { + auto status = PsLookupProcessByProcessId(ULongToHandle(i), &process); + if (!NT_SUCCESS(status)) + continue; + + auto image_file_name = reinterpret_cast(kernel_api::psgetprocessimagefilname(process)); + if (!strcmp(image_file_name, ProcessName)) + return process; + + ObDereferenceObject(process); + } + + return process; + } + auto GetKernelModule(CONST CHAR* Module) -> uintptr_t + { + UNICODE_STRING unFuncName{ 0 }; + + void* buffer = nullptr; + DWORD buffer_size = 0; + + + retry: + buffer = ExAllocatePool(NonPagedPool, buffer_size); + NTSTATUS status = kernel_api::ntquerysysteminformation(static_cast (11), buffer, buffer_size, &buffer_size); + if (status == STATUS_INFO_LENGTH_MISMATCH) + { + if (buffer) + ExFreePool(buffer); + + goto retry; + } + + + uintptr_t base = 0; + const auto modulebase = static_cast(buffer); + + if (!modulebase) + return 0; + + for (auto i = 0u; i < modulebase->NumberOfModules; i++) + { + const char* current_module_name = (reinterpret_cast(modulebase->Modules[i].FullPathName) + modulebase->Modules[i].OffsetToFileName); + + if (!_stricmp(current_module_name, Module)) + { + const auto ImageBase = modulebase->Modules[i].ImageBase; + base = (uintptr_t)ImageBase; + break; + } + } + + + ExFreePool(buffer); + + return base; + } + + +} diff --git a/Anti-Cheat_Driver/kernel_function.h b/Anti-Cheat_Driver/kernel_function.h new file mode 100644 index 0000000..4ca2fb5 --- /dev/null +++ b/Anti-Cheat_Driver/kernel_function.h @@ -0,0 +1,49 @@ +#pragma once +#include "Base.h" + +namespace kernel_function +{ + + typedef enum _SYSTEM_INFORMATION_CLASS { + SystemBasicInformation = 0, + SystemPerformanceInformation = 2, + SystemTimeOfDayInformation = 3, + SystemProcessInformation = 5, + SystemProcessorPerformanceInformation = 8, + SystemInterruptInformation = 23, + SystemExceptionInformation = 33, + SystemRegistryQuotaInformation = 37, + SystemLookasideInformation = 45, + SystemCodeIntegrityInformation = 103, + SystemPolicyInformation = 134, + } SYSTEM_INFORMATION_CLASS; + + typedef struct _RTL_PROCESS_MODULE_INFORMATION + { + HANDLE Section; + PVOID MappedBase; + PVOID ImageBase; + ULONG ImageSize; + ULONG Flags; + USHORT LoadOrderIndex; + USHORT InitOrderIndex; + USHORT LoadCount; + USHORT OffsetToFileName; + UCHAR FullPathName[256]; + } RTL_PROCESS_MODULE_INFORMATION, * PRTL_PROCESS_MODULE_INFORMATION; + + typedef struct _RTL_PROCESS_MODULES + { + ULONG NumberOfModules; + RTL_PROCESS_MODULE_INFORMATION Modules[1]; + } RTL_PROCESS_MODULES, * PRTL_PROCESS_MODULES; + + + auto FindProcess(CONST CHAR* ProcessName)->PEPROCESS; + + auto GetKernelModule(CONST CHAR* Module)->uintptr_t; + + + + +} \ No newline at end of file diff --git a/Anti-Cheat_Driver/ob_reg_callback.cpp b/Anti-Cheat_Driver/ob_reg_callback.cpp new file mode 100644 index 0000000..ec614a2 --- /dev/null +++ b/Anti-Cheat_Driver/ob_reg_callback.cpp @@ -0,0 +1,82 @@ +#include "ob_reg_callback.h" +void* reg_ob_callback_handle; + + +auto is_allow_process(PUNICODE_STRING image_file_name) -> BOOL +{ + if (!image_file_name->Buffer) + return FALSE; + + if (wcsstr(image_file_name->Buffer, L"\\System32\\taskmgr.exe")) + return TRUE; + + return FALSE; +} + + +auto ob_call_back::register_ob_reg_callback() -> NTSTATUS +{ + auto ob_callback = [](_In_ PVOID RegistrationContext, + _In_ POB_PRE_OPERATION_INFORMATION pOperationInformation) -> OB_PREOP_CALLBACK_STATUS + { + UNREFERENCED_PARAMETER(RegistrationContext); + auto dwPid = PsGetProcessId(reinterpret_cast(pOperationInformation->Object)); + + auto operation_eprocess = PsGetCurrentProcess(); + + PUNICODE_STRING image_file_name{ 0 }; + auto status = SeLocateProcessImageName(operation_eprocess, &image_file_name); + if (NT_SUCCESS(status)) + { + if(is_allow_process(image_file_name)) + goto end; + + if (dwPid == ULongToHandle(1836)) + { + pOperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess = 0; + pOperationInformation->Parameters->DuplicateHandleInformation.OriginalDesiredAccess = 0; + } + } + end: + return OB_PREOP_SUCCESS; + }; + + NTSTATUS status; + OB_CALLBACK_REGISTRATION obReg; + OB_OPERATION_REGISTRATION opReg; + memset(&obReg, 0, sizeof(obReg)); + obReg.Version = ObGetFilterVersion(); + obReg.OperationRegistrationCount = 1; + obReg.RegistrationContext = NULL; + RtlInitUnicodeString(&obReg.Altitude, L"32688"); + obReg.OperationRegistration = &opReg; + memset(&opReg, 0, sizeof(opReg)); + opReg.ObjectType = PsProcessType; + opReg.Operations = OB_OPERATION_HANDLE_CREATE | OB_OPERATION_HANDLE_DUPLICATE; + opReg.PreOperation = (POB_PRE_OPERATION_CALLBACK)ob_callback; + + //------------------------------------------------------- + //PVOID addr = (PVOID)((ULONG64)*PsProcessType + 0x40 + 0x20); + //*(PULONG)addr = 0x1fffff; //×¢Òâ £º ÐÞ¸ÄPsProcessType/PsThreadTypeÏÂ_OBJECT_TYPE_INITIALIZERÏÂRetainAccessΪ0x1fffff ÎÞÊÓĨȨÏÞ ObpPreInterceptHandleCreate + //·½Ê½2 : ×¢²áÁ½¸öObRegisterCallbacks ²ã·Ö±ðÔÚxxµÄÉÏ·½ºÍÏ·½ µÈxxĨÁËÖ®ºó Ĩ»ØÈ¥ + //·½Ê½3 £ºPte hook Obp + //·½Ê½4 £º±éÀúCallbacksListÌæ»»»òÐÞ¸ÄPre Postº¯Êý + + status = ObRegisterCallbacks(&obReg, ®_ob_callback_handle); + return status; + +} + +auto ob_call_back::uninstall_ob_callback() -> BOOLEAN +{ + + if (reg_ob_callback_handle) + { + ObUnRegisterCallbacks(reg_ob_callback_handle); + reg_ob_callback_handle = nullptr; + + return TRUE; + } + + return FALSE; +} diff --git a/Anti-Cheat_Driver/ob_reg_callback.h b/Anti-Cheat_Driver/ob_reg_callback.h new file mode 100644 index 0000000..0b03a64 --- /dev/null +++ b/Anti-Cheat_Driver/ob_reg_callback.h @@ -0,0 +1,11 @@ +#pragma once +#include "kernel_api.h" + +namespace ob_call_back +{ + auto register_ob_reg_callback() -> NTSTATUS; + + + auto uninstall_ob_callback() -> BOOLEAN; + +} \ No newline at end of file diff --git a/Anti-Cheat_Driver/utils.cpp b/Anti-Cheat_Driver/utils.cpp new file mode 100644 index 0000000..5131e83 --- /dev/null +++ b/Anti-Cheat_Driver/utils.cpp @@ -0,0 +1,66 @@ +#include "utils.h" + +namespace utils +{ + auto GetVersion() -> OSVERSIONINFOW + { + OSVERSIONINFOW osver{ 0 }; + osver.dwOSVersionInfoSize = sizeof(OSVERSIONINFOW); + RtlGetVersion(&osver); + return osver; + } + + auto patternCheck(const char* data, const char* pattern, const char* mask) -> bool + { + size_t len = strlen(mask); + + for (size_t i = 0; i < len; i++) + { + if (data[i] == pattern[i] || mask[i] == '?') + continue; + else + return false; + } + + return true; + } + auto patternFind(unsigned long long addr, unsigned long size, const char* pattern, const char* mask) -> ULONG64 + { + size -= (unsigned long)strlen(mask); + for (unsigned long i = 0; i < size; i++) + { + if (patternCheck((const char*)addr + i, pattern, mask)) + return addr + i; + } + return 0; + } + + + + auto FindSectionsCode(unsigned long long Base, const char* pattern, const char* mask, const char* name) -> ULONG64 + { + auto image_dos = (PIMAGE_DOS_HEADER)Base; + auto ntheader = (PIMAGE_NT_HEADERS)(Base + image_dos->e_lfanew); + + auto section = IMAGE_FIRST_SECTION(ntheader); + for (size_t i = 0; i < ntheader->FileHeader.NumberOfSections; i++) + { + PIMAGE_SECTION_HEADER p = §ion[i]; + if (strstr((const char*)p->Name, name)) + { + unsigned long long result = patternFind(Base + p->VirtualAddress, p->Misc.VirtualSize, pattern, mask); + if (result) return result; + + } + } + return 0; + } + + + + + + + + +} \ No newline at end of file diff --git a/Anti-Cheat_Driver/utils.h b/Anti-Cheat_Driver/utils.h new file mode 100644 index 0000000..ccb7feb --- /dev/null +++ b/Anti-Cheat_Driver/utils.h @@ -0,0 +1,17 @@ +#pragma once +#include "Base.h" + +namespace utils +{ + auto GetVersion() -> OSVERSIONINFOW; + + + + auto FindSectionsCode(unsigned long long Base, const char* pattern, const char* mask, const char* name) -> ULONG64; + + + + + + +} \ No newline at end of file