maowengrui/anit-cheat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix win7 getNtSendInput

Browse Source
This commit is contained in:
maowenrui
2026-06-29 09:10:42 +08:00
parent 1a601fb2d3
commit 52a29890d2
8 changed files with 100 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Anti-Cheat_Driver/driver_main.cpp
+4 -1
View File
@@ -38,7 +38,7 @@ NTSTATUS NTAPI hkNtOpenProcess(
)
{
DbgPrintEx(77, 0, "NtOpenProcess\n");
DbgPrintEx(77, 0, "NtOpenProcess\n");
return origon_ntOpenProcess(ProcessHandle, DesiredAccess, ObjectAttributes, ClientId);
}
@@ -90,7 +90,10 @@ EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING)
kernel_api::kernel_api_init();
kernel_comm_create::Init();
//protect_filter::add_protect_list(9624, 0, FALSE);
//protect_filter::add_protect_list(2356, 0, TRUE);
//inline_hooks_manager::fn_get_instance()->inline_install_hook(NtOpenProcess, hkNtOpenProcess, (void**)&origon_ntOpenProcess);
//inline_hooks_manager::fn_get_instance()->inline_install_hook(NtCreateFile, hkNtCreateFile, (void**)&origon_ntCreatFile);
Anti-Cheat_Driver/mouse_key_win10.cpp
+6 -7
View File
@@ -1,20 +1,19 @@
#include "mouse_key_win10.h"
#include "mouse_keybord_hook.h"
#include "inline_hooks.h"
#include "protect_filter.h"
fnNtUserSendInput_win10 origon_NtUserSendInput_win10;
namespace mouse_key_win10
{
__int64 __fastcall hkNtUserSendInput(unsigned int a1, volatile void* a2, int a3, int a4)
{
auto pid = PsGetCurrentProcessId();
if (protect_filter::is_white_pid(HandleToLong(pid), NULL))
return origon_NtUserSendInput_win10(a1, a2, a3, a4);
DbgPrintEx(77, 0, "%d\n", PsGetCurrentProcessId());
return origon_NtUserSendInput_win10(a1, a2, a3, a4);
return NULL;
}
}
Anti-Cheat_Driver/mouse_key_win7.cpp
+17
View File
@@ -0,0 +1,17 @@
#include "mouse_key_win7.h"
#include "protect_filter.h"
fnNtUserSendInput_win7 origon_NtUserSendInput_win7;
namespace mouse_key_win7
{
__int64 __fastcall hkNtUserSendInput(unsigned int a1, unsigned __int64 a2, int a3)
{
auto pid = PsGetCurrentProcessId();
if(protect_filter::is_white_pid(HandleToLong(pid), NULL))
return origon_NtUserSendInput_win7(a1, a2, a3);
return NULL;
}
}
Anti-Cheat_Driver/mouse_key_win7.h
+9
View File
@@ -1 +1,10 @@
#pragma once
#include "Base.h"
typedef __int64(__fastcall* fnNtUserSendInput_win7)(unsigned int a1, unsigned __int64 a2, int a3);
extern fnNtUserSendInput_win7 origon_NtUserSendInput_win7;
namespace mouse_key_win7
{
__int64 __fastcall hkNtUserSendInput(unsigned int a1, unsigned __int64 a2, int a3);
}
Anti-Cheat_Driver/mouse_keybord_hook.cpp
+7 -4
View File
@@ -6,8 +6,6 @@
#include "mouse_key_win10.h"
#include "mouse_key_win7.h"
namespace mouse_keybord_hook
{
unsigned char* _ntSendInput;
@@ -17,7 +15,12 @@ namespace mouse_keybord_hook
auto os = utils::GetVersion();
if (os.dwBuildNumber == 7600 || os.dwBuildNumber == 7601)
{
return NULL;
auto win32k = kernel_function::GetKernelModule("win32k.sys");
auto ntSendInput = (unsigned char*)utils::FindSectionsCode(win32k, "\x48\x8B\xC4\x48\x89\x58\x08\x48\x89\x70\x10\x48\x89\x78\x18\x41\x54\x48\x83\xEC\x60\x41\x8B\xD8",
"xxxxxxxxxxxxxxxxxxxxxxxx", ".text");
return ntSendInput;
}
else if (os.dwBuildNumber >= 26100)
{
@@ -60,7 +63,7 @@ namespace mouse_keybord_hook
auto os = utils::GetVersion();
if (os.dwBuildNumber == 7600 || os.dwBuildNumber == 7601)
{
inline_hooks_manager::fn_get_instance()->inline_install_hook(_ntSendInput, mouse_key_win7::hkNtUserSendInput, (void**)&origon_NtUserSendInput_win7);
}
else
{
Anti-Cheat_Driver/process_notify_callback.cpp
+9 -1
View File
@@ -13,9 +13,17 @@ namespace process_notify_callback
UNREFERENCED_PARAMETER(ParentId);
if (!Create)
{
//进程退出时进行 对插链的清理操作
if (protect_filter::is_protect_pid(HandleToLong(ProcessId), nullptr))
protect_filter::remove_list(HandleToLong(ProcessId), nullptr);
protect_filter::remove_protect_list(g_protect_list, HandleToLong(ProcessId), nullptr);
if (protect_filter::is_white_pid(HandleToLong(ProcessId), nullptr))
{
DbgBreakPoint();
protect_filter::remove_protect_list(g_white_list, HandleToLong(ProcessId), nullptr);
}
}
/*DbgPrintEx(77, 0, "ParentId:%d | ProcessId:%d | Create:%d\n",
Anti-Cheat_Driver/protect_filter.cpp
+41 -10
View File
@@ -1,15 +1,17 @@
#include "protect_filter.h"
LIST_ENTRY g_protect_list;
LIST_ENTRY g_white_list;
namespace protect_filter
{
auto Init() -> VOID
{
InitializeListHead(&g_protect_list);
InitializeListHead(&g_white_list);
}
auto add_list(ULONG Pid, HWND hwnd) -> BOOL
auto add_protect_list(ULONG Pid, HWND hwnd, BOOL is_white)->BOOL
{
auto PFilter = reinterpret_cast<PFILTER>(ExAllocatePoolWithTag(PagedPool, sizeof(FILTER), 'wag'));
if (!PFilter)
@@ -31,14 +33,15 @@ namespace protect_filter
PFilter->hWnd = hwnd;
}
InsertTailList(&g_protect_list, &PFilter->List);
if (is_white)
InsertTailList(&g_white_list, &PFilter->List);
else InsertTailList(&g_protect_list, &PFilter->List);
return TRUE;
}
auto is_protect_pid(ULONG Pid, PEPROCESS Eprocess)->BOOL
{
UNREFERENCED_PARAMETER(Pid);
if (IsListEmpty(&g_protect_list))
return NULL;
@@ -60,20 +63,47 @@ namespace protect_filter
}
}
return NULL;
return FALSE;
}
auto remove_list(ULONG Pid, HWND hwnd) -> BOOL
auto is_white_pid(ULONG Pid, PEPROCESS Eprocess)->BOOL
{
if (IsListEmpty(&g_white_list))
return NULL;
auto list_head = g_white_list.Flink;
while (list_head != &g_white_list)
{
auto list_data = reinterpret_cast<PFILTER>(CONTAINING_RECORD(list_head, FILTER, List));
list_head = list_head->Flink;
if (Pid)
{
if (list_data->Pid == Pid)
return TRUE;
}
if (Eprocess)
{
if (list_data->Eprocess == Eprocess)
return TRUE;
}
}
return FALSE;
}
auto remove_protect_list(LIST_ENTRY list_entry, ULONG Pid, HWND hwnd)->BOOL
{
UNREFERENCED_PARAMETER(hwnd);
BOOL is_remove_list = FALSE;
if (IsListEmpty(&g_protect_list))
return NULL;
if (IsListEmpty(&list_entry))
return FALSE;
auto list_head = g_protect_list.Flink;
while (list_head != &g_protect_list)
auto list_head = list_entry.Flink;
while (list_head != &list_entry)
{
auto list_data = reinterpret_cast<PFILTER>(CONTAINING_RECORD(list_head, FILTER, List));
list_head = list_head->Flink;
@@ -88,9 +118,10 @@ namespace protect_filter
if (is_remove_list)
{
ExFreePoolWithTag(list_data, 'wag');
return TRUE;
}
}
return FALSE;
return TRUE;
}
}
Anti-Cheat_Driver/protect_filter.h
+7 -2
View File
@@ -1,5 +1,6 @@
#pragma once
#include "Base.h"
typedef struct _FILTER
{
LIST_ENTRY List;
@@ -8,14 +9,18 @@ typedef struct _FILTER
HWND hWnd;
}FILTER,*PFILTER;
extern LIST_ENTRY g_protect_list;
extern LIST_ENTRY g_white_list;
namespace protect_filter
{
auto Init()->VOID;
auto add_list(ULONG Pid, HWND hwnd)->BOOL;
auto add_protect_list(ULONG Pid, HWND hwnd, BOOL is_white)->BOOL;
auto is_protect_pid(ULONG Pid, PEPROCESS Eprocess) -> BOOL;
auto remove_list(ULONG Pid, HWND hwnd)->BOOL;
auto is_white_pid(ULONG Pid, PEPROCESS Eprocess)->BOOL;
auto remove_protect_list(LIST_ENTRY list_entry, ULONG Pid, HWND hwnd)->BOOL;
}