init

Anti-Cheat_Driver/create_thread_callback.cpp

@@ -0,0 +1,55 @@
+#include "create_thread_callback.h"
+
+
+
+
+
+namespace thread_notify_routine
+{
+	//保护的进程ID
+	auto protect_id = ULongToHandle(3460);
+
+
+	void thread_notify_routine(HANDLE ProcessId, HANDLE ThreadId, BOOLEAN Create)
+	{
+		if (Create)
+		{
+			PEPROCESS process{ 0 };
+			auto status = PsLookupProcessByProcessId(ProcessId, &process);
+			if (!NT_SUCCESS(status))
+				goto end;
+
+			PEPROCESS protect_process{ 0 };
+			status = PsLookupProcessByProcessId(protect_id, &protect_process);
+			if (!NT_SUCCESS(status))
+				goto end;
+
+			if (protect_process != process)
+				goto end;
+
+			auto cutor_process_id = PsGetCurrentProcessId();
+			if (ProcessId != cutor_process_id)
+			{
+				DbgPrintEx(77, 0, "[!] 恶意远程线程检测！\n");
+				DbgPrintEx(77, 0, "[!] 目标进程: %d\n", ProcessId);
+				DbgPrintEx(77, 0, "[!] 被创建线程: %d\n", ThreadId);
+				DbgPrintEx(77, 0, "[!] 创建者进程: %d\n", cutor_process_id);
+			}
+
+
+		end:
+			ObDereferenceObject(process);
+		}
+	}
+
+	auto create_thread_routine() -> NTSTATUS
+	{
+		return PsSetCreateThreadNotifyRoutine(thread_notify_routine);
+	}
+
+	auto unload_thread_routine() -> NTSTATUS
+	{
+		return PsRemoveCreateThreadNotifyRoutine(thread_notify_routine);
+	}
+
+}