init

2026-05-27 13:24:57 +08:00
commit 4bf9a42170
21 changed files with 901 additions and 0 deletions
@@ -0,0 +1,50 @@
+#include "anit_screen_grap.h"
+#include "utils.h"
+#include "kernel_function.h"
+
+
+namespace anit_screen_grap
+{
+	auto GreProtectSpriteContent(HWND hWnd, UINT Flags) -> BOOL
+	{
+		UNREFERENCED_PARAMETER(hWnd);
+		UNREFERENCED_PARAMETER(Flags);
+		auto eprocess = kernel_function::FindProcess("IHuan.exe");
+
+		ObDereferenceObject(eprocess);
+
+		KAPC_STATE apc{ 0 };
+
+		KeStackAttachProcess(eprocess, &apc);
+
+		typedef BOOL(__fastcall* fn_GreProtectSpriteContent)(LPVOID, HWND, INT, UINT);
+		static fn_GreProtectSpriteContent _GreProtectSpriteContent = nullptr;
+		if (!_GreProtectSpriteContent) {
+			auto version = utils::GetVersion();
+		
+			if (version.dwBuildNumber == 7601 || version.dwBuildNumber == 7600)
+			{
+				auto ker_win32k_base = kernel_function::GetKernelModule("win32k.sys");
+				auto func_offset = utils::FindSectionsCode(ker_win32k_base, "\xE8\x00\x00\x00\x00\x8B\xF8\x85\xC0\x75\x26\x85\xF6", "x????xxxxxxxx", ".text");			
+				_GreProtectSpriteContent = (fn_GreProtectSpriteContent)((*(long*)(func_offset + 1)) + (func_offset + 5));
+			}
+			else
+			{
+				auto ker_win32kfull_base = kernel_function::GetKernelModule("win32kfull.sys");
+				auto func_offset = utils::FindSectionsCode(ker_win32kfull_base, "\xE8\x00\x00\x00\x00\x8B\x00\x85\xC0\x75\x0E\x85\x00\x74\x00\x33\xD2", "x????x?xxxxx?x?xx", ".text");
+				_GreProtectSpriteContent = (fn_GreProtectSpriteContent)((*(long*)(func_offset + 1)) + (func_offset + 5));
+			}
+		}
+
+		if (!_GreProtectSpriteContent)
+			return FALSE;
+
+		DbgPrintEx(77, 0, "%p\n", _GreProtectSpriteContent);
+
+		auto suc = _GreProtectSpriteContent(NULL, hWnd, TRUE, Flags);
+
+		KeUnstackDetachProcess(&apc);
+		return suc;
+	}
+
+}