init

Anti-Cheat_Driver/kernel_function.cpp

@@ -0,0 +1,70 @@
+#include "kernel_function.h"
+#include "kernel_api.h"
+
+namespace kernel_function
+{
+	PEPROCESS process{ 0 };
+
+	auto FindProcess(const CHAR* ProcessName) -> PEPROCESS
+	{
+		for (ULONG i = 4; i < 0x401000; i += 4)
+		{
+			auto status = PsLookupProcessByProcessId(ULongToHandle(i), &process);
+			if (!NT_SUCCESS(status))
+				continue;
+
+			auto image_file_name = reinterpret_cast<char*>(kernel_api::psgetprocessimagefilname(process));
+			if (!strcmp(image_file_name, ProcessName))
+				return process;
+
+			ObDereferenceObject(process);
+		}
+
+		return process;
+	}
+	auto GetKernelModule(CONST CHAR* Module) -> uintptr_t
+	{
+		UNICODE_STRING unFuncName{ 0 };
+
+		void* buffer = nullptr;
+		DWORD buffer_size = 0;
+
+
+	retry:
+		buffer = ExAllocatePool(NonPagedPool, buffer_size);
+		NTSTATUS status = kernel_api::ntquerysysteminformation(static_cast <SYSTEM_INFORMATION_CLASS>(11), buffer, buffer_size, &buffer_size);
+		if (status == STATUS_INFO_LENGTH_MISMATCH)
+		{
+			if (buffer)
+				ExFreePool(buffer);
+
+			goto retry;
+		}
+
+
+		uintptr_t base = 0;
+		const auto modulebase = static_cast<PRTL_PROCESS_MODULES>(buffer);
+
+		if (!modulebase)
+			return 0;
+
+		for (auto i = 0u; i < modulebase->NumberOfModules; i++)
+		{
+			const char* current_module_name = (reinterpret_cast<char*>(modulebase->Modules[i].FullPathName) + modulebase->Modules[i].OffsetToFileName);
+
+			if (!_stricmp(current_module_name, Module))
+			{
+				const auto ImageBase = modulebase->Modules[i].ImageBase;
+				base = (uintptr_t)ImageBase;
+				break;
+			}
+		}
+
+
+		ExFreePool(buffer);
+
+		return base;
+	}
+
+
+}