init

2026-05-27 13:24:57 +08:00
commit 4bf9a42170
21 changed files with 901 additions and 0 deletions
@@ -0,0 +1,4 @@
+/.vs
+/x64
+/Anti-Cheat_Driver/Debug
+/Anti-Cheat_Driver/x64
@@ -0,0 +1,51 @@
+
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio Version 16
+VisualStudioVersion = 16.0.37206.5
+MinimumVisualStudioVersion = 10.0.40219.1
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Anti-Cheat_Driver", "Anti-Cheat_Driver\Anti-Cheat_Driver.vcxproj", "{E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|ARM = Debug|ARM
+		Debug|ARM64 = Debug|ARM64
+		Debug|x64 = Debug|x64
+		Debug|x86 = Debug|x86
+		Release|ARM = Release|ARM
+		Release|ARM64 = Release|ARM64
+		Release|x64 = Release|x64
+		Release|x86 = Release|x86
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Debug|ARM.ActiveCfg = Debug|ARM
+		{E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Debug|ARM.Build.0 = Debug|ARM
+		{E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Debug|ARM.Deploy.0 = Debug|ARM
+		{E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Debug|ARM64.ActiveCfg = Debug|ARM64
+		{E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Debug|ARM64.Build.0 = Debug|ARM64
+		{E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Debug|ARM64.Deploy.0 = Debug|ARM64
+		{E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Debug|x64.ActiveCfg = Debug|x64
+		{E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Debug|x64.Build.0 = Debug|x64
+		{E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Debug|x64.Deploy.0 = Debug|x64
+		{E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Debug|x86.ActiveCfg = Debug|Win32
+		{E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Debug|x86.Build.0 = Debug|Win32
+		{E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Debug|x86.Deploy.0 = Debug|Win32
+		{E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Release|ARM.ActiveCfg = Release|ARM
+		{E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Release|ARM.Build.0 = Release|ARM
+		{E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Release|ARM.Deploy.0 = Release|ARM
+		{E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Release|ARM64.ActiveCfg = Release|ARM64
+		{E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Release|ARM64.Build.0 = Release|ARM64
+		{E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Release|ARM64.Deploy.0 = Release|ARM64
+		{E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Release|x64.ActiveCfg = Release|x64
+		{E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Release|x64.Build.0 = Release|x64
+		{E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Release|x64.Deploy.0 = Release|x64
+		{E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Release|x86.ActiveCfg = Release|Win32
+		{E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Release|x86.Build.0 = Release|Win32
+		{E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Release|x86.Deploy.0 = Release|Win32
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+	GlobalSection(ExtensibilityGlobals) = postSolution
+		SolutionGuid = {CD588ADD-9BCE-4444-9BBE-0E95D50A1FE4}
+	EndGlobalSection
+EndGlobal
@@ -0,0 +1,166 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|x64">
+      <Configuration>Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|x64">
+      <Configuration>Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|ARM">
+      <Configuration>Debug</Configuration>
+      <Platform>ARM</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|ARM">
+      <Configuration>Release</Configuration>
+      <Platform>ARM</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|ARM64">
+      <Configuration>Debug</Configuration>
+      <Platform>ARM64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|ARM64">
+      <Configuration>Release</Configuration>
+      <Platform>ARM64</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <ProjectGuid>{E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}</ProjectGuid>
+    <TemplateGuid>{dd38f7fc-d7bd-488b-9242-7d8754cde80d}</TemplateGuid>
+    <TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
+    <MinimumVisualStudioVersion>12.0</MinimumVisualStudioVersion>
+    <Configuration>Debug</Configuration>
+    <Platform Condition="'$(Platform)' == ''">Win32</Platform>
+    <RootNamespace>Anti_Cheat_Driver</RootNamespace>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
+    <TargetVersion>Windows10</TargetVersion>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
+    <ConfigurationType>Driver</ConfigurationType>
+    <DriverType>WDM</DriverType>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
+    <TargetVersion>Windows10</TargetVersion>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
+    <ConfigurationType>Driver</ConfigurationType>
+    <DriverType>WDM</DriverType>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
+    <TargetVersion>Windows10</TargetVersion>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
+    <ConfigurationType>Driver</ConfigurationType>
+    <DriverType>WDM</DriverType>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
+    <TargetVersion>Windows7</TargetVersion>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
+    <ConfigurationType>Driver</ConfigurationType>
+    <DriverType>WDM</DriverType>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'" Label="Configuration">
+    <TargetVersion>Windows10</TargetVersion>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
+    <ConfigurationType>Driver</ConfigurationType>
+    <DriverType>WDM</DriverType>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'" Label="Configuration">
+    <TargetVersion>Windows10</TargetVersion>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
+    <ConfigurationType>Driver</ConfigurationType>
+    <DriverType>WDM</DriverType>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM64'" Label="Configuration">
+    <TargetVersion>Windows10</TargetVersion>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
+    <ConfigurationType>Driver</ConfigurationType>
+    <DriverType>WDM</DriverType>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM64'" Label="Configuration">
+    <TargetVersion>Windows10</TargetVersion>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
+    <ConfigurationType>Driver</ConfigurationType>
+    <DriverType>WDM</DriverType>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <PropertyGroup />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'">
+    <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'">
+    <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM64'">
+    <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM64'">
+    <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
+  </PropertyGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <Link>
+      <AdditionalOptions>/INTEGRITYCHECK %(AdditionalOptions)</AdditionalOptions>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+    <FilesToPackage Include="$(TargetPath)" />
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="anit_screen_grap.cpp" />
+    <ClCompile Include="create_thread_callback.cpp" />
+    <ClCompile Include="driver_main.cpp" />
+    <ClCompile Include="io_ctl.cpp" />
+    <ClCompile Include="kernel_api.cpp" />
+    <ClCompile Include="kernel_function.cpp" />
+    <ClCompile Include="ob_reg_callback.cpp" />
+    <ClCompile Include="utils.cpp" />
+  </ItemGroup>
+  <ItemGroup>
+    <ClInclude Include="anit_screen_grap.h" />
+    <ClInclude Include="Base.h" />
+    <ClInclude Include="create_thread_callback.h" />
+    <ClInclude Include="io_ctl.h" />
+    <ClInclude Include="kernel_api.h" />
+    <ClInclude Include="kernel_function.h" />
+    <ClInclude Include="ob_reg_callback.h" />
+    <ClInclude Include="utils.h" />
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+  </ImportGroup>
+</Project>
@@ -0,0 +1,91 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup>
+    <Filter Include="Source Files">
+      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
+      <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
+    </Filter>
+    <Filter Include="Header Files">
+      <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
+      <Extensions>h;hpp;hxx;hm;inl;inc;xsd</Extensions>
+    </Filter>
+    <Filter Include="Driver Files">
+      <UniqueIdentifier>{8E41214B-6785-4CFE-B992-037D68949A14}</UniqueIdentifier>
+      <Extensions>inf;inv;inx;mof;mc;</Extensions>
+    </Filter>
+    <Filter Include="kernel_callback">
+      <UniqueIdentifier>{eedbbbd4-845f-4fda-933c-23fd4c209ab3}</UniqueIdentifier>
+    </Filter>
+    <Filter Include="kernel_extern_api">
+      <UniqueIdentifier>{b3f98251-c1bf-4bd0-a5bd-d5425c272a5e}</UniqueIdentifier>
+    </Filter>
+    <Filter Include="Iocontrol">
+      <UniqueIdentifier>{1373c16e-e769-4553-b7b9-0f87b2f6ab0e}</UniqueIdentifier>
+    </Filter>
+    <Filter Include="Resource Files">
+      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
+      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
+    </Filter>
+    <Filter Include="utils">
+      <UniqueIdentifier>{6ba5e47f-4fd9-46a0-b7f1-f1b3c67ec0b3}</UniqueIdentifier>
+    </Filter>
+    <Filter Include="window_function">
+      <UniqueIdentifier>{f5a68c3d-f493-4980-b3d2-b26f3f25e1be}</UniqueIdentifier>
+    </Filter>
+    <Filter Include="kernel_private">
+      <UniqueIdentifier>{17541143-1a94-4036-9c0b-54a1855caa73}</UniqueIdentifier>
+    </Filter>
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="driver_main.cpp">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+    <ClCompile Include="ob_reg_callback.cpp">
+      <Filter>kernel_callback</Filter>
+    </ClCompile>
+    <ClCompile Include="kernel_api.cpp">
+      <Filter>kernel_extern_api</Filter>
+    </ClCompile>
+    <ClCompile Include="io_ctl.cpp">
+      <Filter>Iocontrol</Filter>
+    </ClCompile>
+    <ClCompile Include="utils.cpp">
+      <Filter>utils</Filter>
+    </ClCompile>
+    <ClCompile Include="anit_screen_grap.cpp">
+      <Filter>window_function</Filter>
+    </ClCompile>
+    <ClCompile Include="kernel_function.cpp">
+      <Filter>kernel_private</Filter>
+    </ClCompile>
+    <ClCompile Include="create_thread_callback.cpp">
+      <Filter>kernel_callback</Filter>
+    </ClCompile>
+  </ItemGroup>
+  <ItemGroup>
+    <ClInclude Include="Base.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
+    <ClInclude Include="ob_reg_callback.h">
+      <Filter>kernel_callback</Filter>
+    </ClInclude>
+    <ClInclude Include="kernel_api.h">
+      <Filter>kernel_extern_api</Filter>
+    </ClInclude>
+    <ClInclude Include="io_ctl.h">
+      <Filter>Iocontrol</Filter>
+    </ClInclude>
+    <ClInclude Include="utils.h">
+      <Filter>utils</Filter>
+    </ClInclude>
+    <ClInclude Include="anit_screen_grap.h">
+      <Filter>window_function</Filter>
+    </ClInclude>
+    <ClInclude Include="kernel_function.h">
+      <Filter>kernel_private</Filter>
+    </ClInclude>
+    <ClInclude Include="create_thread_callback.h">
+      <Filter>kernel_callback</Filter>
+    </ClInclude>
+  </ItemGroup>
+</Project>
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="Current" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <PropertyGroup />
+</Project>
@@ -0,0 +1,12 @@
+#pragma once
+#ifndef BASE_H
+#define BASE_H
+
+#include <ntifs.h>
+#include <ntddk.h>
+#include <windef.h>
+#include <intrin.h>
+#include <ntimage.h>
+
+
+#endif // !BASE_H
@@ -0,0 +1,50 @@
+#include "anit_screen_grap.h"
+#include "utils.h"
+#include "kernel_function.h"
+
+
+namespace anit_screen_grap
+{
+	auto GreProtectSpriteContent(HWND hWnd, UINT Flags) -> BOOL
+	{
+		UNREFERENCED_PARAMETER(hWnd);
+		UNREFERENCED_PARAMETER(Flags);
+		auto eprocess = kernel_function::FindProcess("IHuan.exe");
+
+		ObDereferenceObject(eprocess);
+
+		KAPC_STATE apc{ 0 };
+
+		KeStackAttachProcess(eprocess, &apc);
+
+		typedef BOOL(__fastcall* fn_GreProtectSpriteContent)(LPVOID, HWND, INT, UINT);
+		static fn_GreProtectSpriteContent _GreProtectSpriteContent = nullptr;
+		if (!_GreProtectSpriteContent) {
+			auto version = utils::GetVersion();
+		
+			if (version.dwBuildNumber == 7601 || version.dwBuildNumber == 7600)
+			{
+				auto ker_win32k_base = kernel_function::GetKernelModule("win32k.sys");
+				auto func_offset = utils::FindSectionsCode(ker_win32k_base, "\xE8\x00\x00\x00\x00\x8B\xF8\x85\xC0\x75\x26\x85\xF6", "x????xxxxxxxx", ".text");			
+				_GreProtectSpriteContent = (fn_GreProtectSpriteContent)((*(long*)(func_offset + 1)) + (func_offset + 5));
+			}
+			else
+			{
+				auto ker_win32kfull_base = kernel_function::GetKernelModule("win32kfull.sys");
+				auto func_offset = utils::FindSectionsCode(ker_win32kfull_base, "\xE8\x00\x00\x00\x00\x8B\x00\x85\xC0\x75\x0E\x85\x00\x74\x00\x33\xD2", "x????x?xxxxx?x?xx", ".text");
+				_GreProtectSpriteContent = (fn_GreProtectSpriteContent)((*(long*)(func_offset + 1)) + (func_offset + 5));
+			}
+		}
+
+		if (!_GreProtectSpriteContent)
+			return FALSE;
+
+		DbgPrintEx(77, 0, "%p\n", _GreProtectSpriteContent);
+
+		auto suc = _GreProtectSpriteContent(NULL, hWnd, TRUE, Flags);
+
+		KeUnstackDetachProcess(&apc);
+		return suc;
+	}
+
+}
@@ -0,0 +1,9 @@
+#pragma once
+#include "Base.h"
+
+namespace anit_screen_grap
+{
+	auto GreProtectSpriteContent(HWND hWnd, UINT Flags) -> BOOL;
+
+
+}
@@ -0,0 +1,55 @@
+#include "create_thread_callback.h"
+
+
+
+
+
+namespace thread_notify_routine
+{
+	//保护的进程ID
+	auto protect_id = ULongToHandle(3460);
+
+
+	void thread_notify_routine(HANDLE ProcessId, HANDLE ThreadId, BOOLEAN Create)
+	{
+		if (Create)
+		{
+			PEPROCESS process{ 0 };
+			auto status = PsLookupProcessByProcessId(ProcessId, &process);
+			if (!NT_SUCCESS(status))
+				goto end;
+
+			PEPROCESS protect_process{ 0 };
+			status = PsLookupProcessByProcessId(protect_id, &protect_process);
+			if (!NT_SUCCESS(status))
+				goto end;
+
+			if (protect_process != process)
+				goto end;
+
+			auto cutor_process_id = PsGetCurrentProcessId();
+			if (ProcessId != cutor_process_id)
+			{
+				DbgPrintEx(77, 0, "[!] 恶意远程线程检测！\n");
+				DbgPrintEx(77, 0, "[!] 目标进程: %d\n", ProcessId);
+				DbgPrintEx(77, 0, "[!] 被创建线程: %d\n", ThreadId);
+				DbgPrintEx(77, 0, "[!] 创建者进程: %d\n", cutor_process_id);
+			}
+
+
+		end:
+			ObDereferenceObject(process);
+		}
+	}
+
+	auto create_thread_routine() -> NTSTATUS
+	{
+		return PsSetCreateThreadNotifyRoutine(thread_notify_routine);
+	}
+
+	auto unload_thread_routine() -> NTSTATUS
+	{
+		return PsRemoveCreateThreadNotifyRoutine(thread_notify_routine);
+	}
+
+}
@@ -0,0 +1,11 @@
+#pragma once
+#include "Base.h"
+
+namespace thread_notify_routine
+{
+
+	auto create_thread_routine()->NTSTATUS;
+
+	auto unload_thread_routine()->NTSTATUS;
+
+}
@@ -0,0 +1,19 @@
+#include "ob_reg_callback.h"
+#include "anit_screen_grap.h"
+#include "create_thread_callback.h"
+
+EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING)
+{
+	drv_obj->DriverUnload = [](PDRIVER_OBJECT)
+	{
+		ob_call_back::uninstall_ob_callback();
+		thread_notify_routine::unload_thread_routine();
+	};
+
+	kernel_api::kernel_api_init();
+	thread_notify_routine::create_thread_routine();
+	ob_call_back::register_ob_reg_callback();
+
+	
+	return STATUS_SUCCESS;
+}
@@ -0,0 +1,60 @@
+#include "io_ctl.h"
+
+UNICODE_STRING g_usDeviceName = RTL_CONSTANT_STRING(L"\\Device\\dump_Test");
+UNICODE_STRING g_usSymbolicName = RTL_CONSTANT_STRING(L"\\??\\_dump_");
+
+auto io_ctl::init_device_and_symbolic(PDRIVER_OBJECT drv_obj) -> NTSTATUS
+{
+	auto dispatch_create_close = [](PDEVICE_OBJECT devcie_object, PIRP irp)
+	{
+		UNREFERENCED_PARAMETER(devcie_object);
+
+		irp->IoStatus.Information = 0;
+		irp->IoStatus.Status = 0;
+		IoCompleteRequest(irp, IO_NO_INCREMENT);
+
+		return STATUS_SUCCESS;
+	};
+
+
+	NTSTATUS status{ 0 };
+	PDEVICE_OBJECT dev_obj{ 0 };
+
+	while (1)
+	{
+		status = IoCreateDevice(drv_obj, NULL, &g_usDeviceName, FILE_DEVICE_UNKNOWN, NULL, NULL, &dev_obj);
+		if (!NT_SUCCESS(status))
+		{
+			DbgPrintEx(77, 0, "[+] failed io create dev!!\n");
+			break;
+		}
+
+		status = IoCreateSymbolicLink(&g_usSymbolicName, &g_usDeviceName);
+		if (!NT_SUCCESS(status))
+		{
+			DbgPrintEx(77, 0, "[+] failed io create link!!\n");
+			break;
+		}
+
+		break;
+	}
+
+	drv_obj->MajorFunction[IRP_MJ_CLOSE] = dispatch_create_close;
+	drv_obj->MajorFunction[IRP_MJ_CREATE] = dispatch_create_close;
+	drv_obj->MajorFunction[IRP_MJ_DEVICE_CONTROL] = dispatch_device_io;
+	return status;
+
+}
+
+auto io_ctl::dispatch_device_io(PDEVICE_OBJECT devcie_object, PIRP irp) -> NTSTATUS
+{
+	UNREFERENCED_PARAMETER(devcie_object);
+	NTSTATUS status{ 0 };
+
+
+
+	irp->IoStatus.Information = 0;
+	irp->IoStatus.Status = status;
+	IoCompleteRequest(irp, IO_NO_INCREMENT);
+	return status;
+}
@@ -0,0 +1,9 @@
+#pragma once
+#include "Base.h"
+
+namespace io_ctl
+{
+	auto init_device_and_symbolic(PDRIVER_OBJECT drv_obj) -> NTSTATUS;
+
+	auto dispatch_device_io(PDEVICE_OBJECT devcie_object, PIRP irp) -> NTSTATUS;
+}
@@ -0,0 +1,30 @@
+#include "kernel_api.h"
+
+namespace kernel_api
+{
+	struct imported_ imported { 0 };
+
+	auto kernel_api_init() -> void
+	{
+		UNICODE_STRING unFuncName{ 0 };
+
+		RtlInitUnicodeString(&unFuncName, L"ZwQuerySystemInformation");
+		imported.nt_querysystem_information = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
+
+
+		RtlInitUnicodeString(&unFuncName, L"PsGetProcessImageFileName");
+		imported.ps_getprocessimage_filname = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
+	}
+
+	NTSTATUS ntquerysysteminformation(ULONG SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength)
+	{
+		return  reinterpret_cast<NTSTATUS(*)(ULONG, PVOID, ULONG, PULONG)>(imported.nt_querysystem_information)
+			(SystemInformationClass, SystemInformation, SystemInformationLength, ReturnLength);
+	}
+
+	UCHAR* psgetprocessimagefilname(PEPROCESS Process)
+	{
+		return reinterpret_cast<UCHAR * (*)(PEPROCESS)>
+			(imported.ps_getprocessimage_filname)(Process);
+	}
+}
@@ -0,0 +1,35 @@
+#pragma once
+#include "Base.h"
+
+struct imported_
+{
+	ULONG64 zw_setsystem_information;
+	ULONG64 mm_copy_virtualMemory;
+	ULONG64 nt_querysystem_information;
+	ULONG64 rtl_findexported_routinebyname;
+	ULONG64 ex_get_previous_mode;
+	ULONG64 io_create_driver;
+	ULONG64 zw_trace_control;
+	ULONG64 ps_getprocessimage_filname;
+	ULONG64 zw_protect_virtualmemory;
+	ULONG64 ps_lookup_processby_processid;
+	ULONG64 ps_getprocess_exitstatus;
+	ULONG64 io_getcurrent_process;
+	ULONG64 mm_copy_memory;
+	ULONG64 ps_getprocess_section_baseaddress;
+};
+
+namespace kernel_api
+{
+	extern struct imported_ imported;
+
+	auto kernel_api_init() -> void;
+
+	NTSTATUS ntquerysysteminformation(ULONG SystemInformationClass,
+		PVOID SystemInformation,
+		ULONG SystemInformationLength,
+		PULONG ReturnLength);
+
+	UCHAR* psgetprocessimagefilname(PEPROCESS Process);
+
+}
@@ -0,0 +1,70 @@
+#include "kernel_function.h"
+#include "kernel_api.h"
+
+namespace kernel_function
+{
+	PEPROCESS process{ 0 };
+
+	auto FindProcess(const CHAR* ProcessName) -> PEPROCESS
+	{
+		for (ULONG i = 4; i < 0x401000; i += 4)
+		{
+			auto status = PsLookupProcessByProcessId(ULongToHandle(i), &process);
+			if (!NT_SUCCESS(status))
+				continue;
+
+			auto image_file_name = reinterpret_cast<char*>(kernel_api::psgetprocessimagefilname(process));
+			if (!strcmp(image_file_name, ProcessName))
+				return process;
+
+			ObDereferenceObject(process);
+		}
+
+		return process;
+	}
+	auto GetKernelModule(CONST CHAR* Module) -> uintptr_t
+	{
+		UNICODE_STRING unFuncName{ 0 };
+
+		void* buffer = nullptr;
+		DWORD buffer_size = 0;
+
+
+	retry:
+		buffer = ExAllocatePool(NonPagedPool, buffer_size);
+		NTSTATUS status = kernel_api::ntquerysysteminformation(static_cast <SYSTEM_INFORMATION_CLASS>(11), buffer, buffer_size, &buffer_size);
+		if (status == STATUS_INFO_LENGTH_MISMATCH)
+		{
+			if (buffer)
+				ExFreePool(buffer);
+
+			goto retry;
+		}
+
+
+		uintptr_t base = 0;
+		const auto modulebase = static_cast<PRTL_PROCESS_MODULES>(buffer);
+
+		if (!modulebase)
+			return 0;
+
+		for (auto i = 0u; i < modulebase->NumberOfModules; i++)
+		{
+			const char* current_module_name = (reinterpret_cast<char*>(modulebase->Modules[i].FullPathName) + modulebase->Modules[i].OffsetToFileName);
+
+			if (!_stricmp(current_module_name, Module))
+			{
+				const auto ImageBase = modulebase->Modules[i].ImageBase;
+				base = (uintptr_t)ImageBase;
+				break;
+			}
+		}
+
+
+		ExFreePool(buffer);
+
+		return base;
+	}
+
+
+}
@@ -0,0 +1,49 @@
+#pragma once
+#include "Base.h"
+
+namespace kernel_function
+{
+
+	typedef enum _SYSTEM_INFORMATION_CLASS {
+		SystemBasicInformation = 0,
+		SystemPerformanceInformation = 2,
+		SystemTimeOfDayInformation = 3,
+		SystemProcessInformation = 5,
+		SystemProcessorPerformanceInformation = 8,
+		SystemInterruptInformation = 23,
+		SystemExceptionInformation = 33,
+		SystemRegistryQuotaInformation = 37,
+		SystemLookasideInformation = 45,
+		SystemCodeIntegrityInformation = 103,
+		SystemPolicyInformation = 134,
+	} SYSTEM_INFORMATION_CLASS;
+
+	typedef struct _RTL_PROCESS_MODULE_INFORMATION
+	{
+		HANDLE Section;
+		PVOID MappedBase;
+		PVOID ImageBase;
+		ULONG ImageSize;
+		ULONG Flags;
+		USHORT LoadOrderIndex;
+		USHORT InitOrderIndex;
+		USHORT LoadCount;
+		USHORT OffsetToFileName;
+		UCHAR FullPathName[256];
+	} RTL_PROCESS_MODULE_INFORMATION, * PRTL_PROCESS_MODULE_INFORMATION;
+
+	typedef struct _RTL_PROCESS_MODULES
+	{
+		ULONG NumberOfModules;
+		RTL_PROCESS_MODULE_INFORMATION Modules[1];
+	} RTL_PROCESS_MODULES, * PRTL_PROCESS_MODULES;
+
+
+	auto FindProcess(CONST CHAR* ProcessName)->PEPROCESS;
+
+	auto GetKernelModule(CONST CHAR* Module)->uintptr_t;
+
+
+
+
+}
@@ -0,0 +1,82 @@
+#include "ob_reg_callback.h"
+void* reg_ob_callback_handle;
+
+
+auto is_allow_process(PUNICODE_STRING image_file_name) -> BOOL
+{
+	if (!image_file_name->Buffer)
+		return FALSE;
+
+	if (wcsstr(image_file_name->Buffer, L"\\System32\\taskmgr.exe"))
+		return TRUE;
+
+	return FALSE;
+}
+
+
+auto ob_call_back::register_ob_reg_callback() -> NTSTATUS
+{
+	auto ob_callback = [](_In_ PVOID RegistrationContext, 
+		_In_ POB_PRE_OPERATION_INFORMATION pOperationInformation) -> OB_PREOP_CALLBACK_STATUS
+	{
+		UNREFERENCED_PARAMETER(RegistrationContext);
+		auto dwPid = PsGetProcessId(reinterpret_cast<PEPROCESS>(pOperationInformation->Object));
+		
+		auto operation_eprocess = PsGetCurrentProcess();
+
+		PUNICODE_STRING image_file_name{ 0 };
+		auto status = SeLocateProcessImageName(operation_eprocess, &image_file_name);
+		if (NT_SUCCESS(status))
+		{
+			if(is_allow_process(image_file_name))
+				goto end;
+				
+			if (dwPid == ULongToHandle(1836))
+			{
+				pOperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess = 0;
+				pOperationInformation->Parameters->DuplicateHandleInformation.OriginalDesiredAccess = 0;
+			}
+		}
+	end:
+		return OB_PREOP_SUCCESS;
+	};
+
+	NTSTATUS status;
+	OB_CALLBACK_REGISTRATION obReg;
+	OB_OPERATION_REGISTRATION opReg;
+	memset(&obReg, 0, sizeof(obReg));
+	obReg.Version = ObGetFilterVersion();
+	obReg.OperationRegistrationCount = 1;
+	obReg.RegistrationContext = NULL;
+	RtlInitUnicodeString(&obReg.Altitude, L"32688");
+	obReg.OperationRegistration = &opReg;
+	memset(&opReg, 0, sizeof(opReg));
+	opReg.ObjectType = PsProcessType;
+	opReg.Operations = OB_OPERATION_HANDLE_CREATE | OB_OPERATION_HANDLE_DUPLICATE;
+	opReg.PreOperation = (POB_PRE_OPERATION_CALLBACK)ob_callback;
+
+	//-------------------------------------------------------
+	//PVOID addr = (PVOID)((ULONG64)*PsProcessType + 0x40 + 0x20);
+	//*(PULONG)addr = 0x1fffff;  //注意  ： 修改PsProcessType/PsThreadType下_OBJECT_TYPE_INITIALIZER下RetainAccess为0x1fffff 无视抹权限 ObpPreInterceptHandleCreate
+	//方式2 : 注册两个ObRegisterCallbacks 层分别在xx的上方和下方 等xx抹了之后 抹回去
+	//方式3 ：Pte hook Obp
+	//方式4 ：遍历CallbacksList替换或修改Pre Post函数
+
+	status = ObRegisterCallbacks(&obReg, &reg_ob_callback_handle);
+	return status;
+	
+}
+
+auto ob_call_back::uninstall_ob_callback() -> BOOLEAN
+{
+
+	if (reg_ob_callback_handle)
+	{
+		ObUnRegisterCallbacks(reg_ob_callback_handle);
+		reg_ob_callback_handle = nullptr;
+
+		return TRUE;
+	}
+	
+	return FALSE;
+}
@@ -0,0 +1,11 @@
+#pragma once
+#include "kernel_api.h"
+
+namespace ob_call_back
+{
+	auto register_ob_reg_callback() -> NTSTATUS;
+
+
+	auto uninstall_ob_callback() -> BOOLEAN;
+
+}
@@ -0,0 +1,66 @@
+#include "utils.h"
+
+namespace utils
+{
+	auto GetVersion() -> OSVERSIONINFOW
+	{
+		OSVERSIONINFOW osver{ 0 };
+		osver.dwOSVersionInfoSize = sizeof(OSVERSIONINFOW);
+		RtlGetVersion(&osver);
+		return osver;
+	}
+
+	auto patternCheck(const char* data, const char* pattern, const char* mask) -> bool
+	{
+		size_t len = strlen(mask);
+
+		for (size_t i = 0; i < len; i++)
+		{
+			if (data[i] == pattern[i] || mask[i] == '?')
+				continue;
+			else
+				return false;
+		}
+
+		return true;
+	}
+	auto patternFind(unsigned long long addr, unsigned long size, const char* pattern, const char* mask) -> ULONG64
+	{
+		size -= (unsigned long)strlen(mask);
+		for (unsigned long i = 0; i < size; i++)
+		{
+			if (patternCheck((const char*)addr + i, pattern, mask))
+				return addr + i;
+		}
+		return 0;
+	}
+
+
+
+	auto FindSectionsCode(unsigned long long Base, const char* pattern, const char* mask, const char* name) -> ULONG64
+	{
+		auto image_dos = (PIMAGE_DOS_HEADER)Base;
+		auto ntheader = (PIMAGE_NT_HEADERS)(Base + image_dos->e_lfanew);
+
+		auto section = IMAGE_FIRST_SECTION(ntheader);
+		for (size_t i = 0; i < ntheader->FileHeader.NumberOfSections; i++)
+		{
+			PIMAGE_SECTION_HEADER p = &section[i];
+			if (strstr((const char*)p->Name, name))
+			{
+				unsigned long long result = patternFind(Base + p->VirtualAddress, p->Misc.VirtualSize, pattern, mask);
+				if (result) return result;
+
+			}
+		}
+		return 0;
+	}
+
+
+
+
+
+
+
+
+}
@@ -0,0 +1,17 @@
+#pragma once
+#include "Base.h"
+
+namespace utils
+{
+	auto GetVersion() -> OSVERSIONINFOW;
+
+
+
+	auto FindSectionsCode(unsigned long long Base, const char* pattern, const char* mask, const char* name) -> ULONG64;
+
+
+
+
+
+
+}