From 52a29890d2d6e548f2be30824614f8d0653857e1 Mon Sep 17 00:00:00 2001 From: maowenrui <3505719167@qq.com> Date: Mon, 29 Jun 2026 09:10:42 +0800 Subject: [PATCH] fix win7 getNtSendInput --- Anti-Cheat_Driver/driver_main.cpp | 5 +- Anti-Cheat_Driver/mouse_key_win10.cpp | 13 +++-- Anti-Cheat_Driver/mouse_key_win7.cpp | 17 +++++++ Anti-Cheat_Driver/mouse_key_win7.h | 9 ++++ Anti-Cheat_Driver/mouse_keybord_hook.cpp | 11 ++-- Anti-Cheat_Driver/process_notify_callback.cpp | 10 +++- Anti-Cheat_Driver/protect_filter.cpp | 51 +++++++++++++++---- Anti-Cheat_Driver/protect_filter.h | 9 +++- 8 files changed, 100 insertions(+), 25 deletions(-) diff --git a/Anti-Cheat_Driver/driver_main.cpp b/Anti-Cheat_Driver/driver_main.cpp index 8cacb71..9176a4c 100644 --- a/Anti-Cheat_Driver/driver_main.cpp +++ b/Anti-Cheat_Driver/driver_main.cpp @@ -38,7 +38,7 @@ NTSTATUS NTAPI hkNtOpenProcess( ) { - DbgPrintEx(77, 0, "NtOpenProcess\n"); + DbgPrintEx(77, 0, "NtOpenProcess\n"); return origon_ntOpenProcess(ProcessHandle, DesiredAccess, ObjectAttributes, ClientId); } @@ -90,7 +90,10 @@ EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING) kernel_api::kernel_api_init(); kernel_comm_create::Init(); + //protect_filter::add_protect_list(9624, 0, FALSE); + + //protect_filter::add_protect_list(2356, 0, TRUE); //inline_hooks_manager::fn_get_instance()->inline_install_hook(NtOpenProcess, hkNtOpenProcess, (void**)&origon_ntOpenProcess); //inline_hooks_manager::fn_get_instance()->inline_install_hook(NtCreateFile, hkNtCreateFile, (void**)&origon_ntCreatFile); diff --git a/Anti-Cheat_Driver/mouse_key_win10.cpp b/Anti-Cheat_Driver/mouse_key_win10.cpp index 56a84af..667d0e3 100644 --- a/Anti-Cheat_Driver/mouse_key_win10.cpp +++ b/Anti-Cheat_Driver/mouse_key_win10.cpp @@ -1,20 +1,19 @@ #include "mouse_key_win10.h" -#include "mouse_keybord_hook.h" -#include "inline_hooks.h" - +#include "protect_filter.h" fnNtUserSendInput_win10 origon_NtUserSendInput_win10; - namespace mouse_key_win10 { __int64 __fastcall hkNtUserSendInput(unsigned int a1, volatile void* a2, int a3, int a4) { + auto pid = PsGetCurrentProcessId(); + if (protect_filter::is_white_pid(HandleToLong(pid), NULL)) + return origon_NtUserSendInput_win10(a1, a2, a3, a4); + - DbgPrintEx(77, 0, "%d\n", PsGetCurrentProcessId()); - - return origon_NtUserSendInput_win10(a1, a2, a3, a4); + return NULL; } } \ No newline at end of file diff --git a/Anti-Cheat_Driver/mouse_key_win7.cpp b/Anti-Cheat_Driver/mouse_key_win7.cpp index e69de29..1b5519f 100644 --- a/Anti-Cheat_Driver/mouse_key_win7.cpp +++ b/Anti-Cheat_Driver/mouse_key_win7.cpp @@ -0,0 +1,17 @@ +#include "mouse_key_win7.h" +#include "protect_filter.h" +fnNtUserSendInput_win7 origon_NtUserSendInput_win7; + +namespace mouse_key_win7 +{ + __int64 __fastcall hkNtUserSendInput(unsigned int a1, unsigned __int64 a2, int a3) + { + auto pid = PsGetCurrentProcessId(); + + if(protect_filter::is_white_pid(HandleToLong(pid), NULL)) + return origon_NtUserSendInput_win7(a1, a2, a3); + + return NULL; + } + +} \ No newline at end of file diff --git a/Anti-Cheat_Driver/mouse_key_win7.h b/Anti-Cheat_Driver/mouse_key_win7.h index 6f70f09..b708d02 100644 --- a/Anti-Cheat_Driver/mouse_key_win7.h +++ b/Anti-Cheat_Driver/mouse_key_win7.h @@ -1 +1,10 @@ #pragma once +#include "Base.h" + +typedef __int64(__fastcall* fnNtUserSendInput_win7)(unsigned int a1, unsigned __int64 a2, int a3); +extern fnNtUserSendInput_win7 origon_NtUserSendInput_win7; + +namespace mouse_key_win7 +{ + __int64 __fastcall hkNtUserSendInput(unsigned int a1, unsigned __int64 a2, int a3); +} \ No newline at end of file diff --git a/Anti-Cheat_Driver/mouse_keybord_hook.cpp b/Anti-Cheat_Driver/mouse_keybord_hook.cpp index d8d35d7..e5fb13a 100644 --- a/Anti-Cheat_Driver/mouse_keybord_hook.cpp +++ b/Anti-Cheat_Driver/mouse_keybord_hook.cpp @@ -6,8 +6,6 @@ #include "mouse_key_win10.h" #include "mouse_key_win7.h" - - namespace mouse_keybord_hook { unsigned char* _ntSendInput; @@ -17,7 +15,12 @@ namespace mouse_keybord_hook auto os = utils::GetVersion(); if (os.dwBuildNumber == 7600 || os.dwBuildNumber == 7601) { - return NULL; + auto win32k = kernel_function::GetKernelModule("win32k.sys"); + + auto ntSendInput = (unsigned char*)utils::FindSectionsCode(win32k, "\x48\x8B\xC4\x48\x89\x58\x08\x48\x89\x70\x10\x48\x89\x78\x18\x41\x54\x48\x83\xEC\x60\x41\x8B\xD8", + "xxxxxxxxxxxxxxxxxxxxxxxx", ".text"); + + return ntSendInput; } else if (os.dwBuildNumber >= 26100) { @@ -60,7 +63,7 @@ namespace mouse_keybord_hook auto os = utils::GetVersion(); if (os.dwBuildNumber == 7600 || os.dwBuildNumber == 7601) { - + inline_hooks_manager::fn_get_instance()->inline_install_hook(_ntSendInput, mouse_key_win7::hkNtUserSendInput, (void**)&origon_NtUserSendInput_win7); } else { diff --git a/Anti-Cheat_Driver/process_notify_callback.cpp b/Anti-Cheat_Driver/process_notify_callback.cpp index ef5a910..e55a8af 100644 --- a/Anti-Cheat_Driver/process_notify_callback.cpp +++ b/Anti-Cheat_Driver/process_notify_callback.cpp @@ -13,9 +13,17 @@ namespace process_notify_callback UNREFERENCED_PARAMETER(ParentId); if (!Create) { + //进程退出时进行 对插链的清理操作 if (protect_filter::is_protect_pid(HandleToLong(ProcessId), nullptr)) - protect_filter::remove_list(HandleToLong(ProcessId), nullptr); + protect_filter::remove_protect_list(g_protect_list, HandleToLong(ProcessId), nullptr); + + if (protect_filter::is_white_pid(HandleToLong(ProcessId), nullptr)) + { + + DbgBreakPoint(); + protect_filter::remove_protect_list(g_white_list, HandleToLong(ProcessId), nullptr); + } } /*DbgPrintEx(77, 0, "ParentId:%d | ProcessId:%d | Create:%d\n", diff --git a/Anti-Cheat_Driver/protect_filter.cpp b/Anti-Cheat_Driver/protect_filter.cpp index ab695ad..eacb495 100644 --- a/Anti-Cheat_Driver/protect_filter.cpp +++ b/Anti-Cheat_Driver/protect_filter.cpp @@ -1,15 +1,17 @@ #include "protect_filter.h" LIST_ENTRY g_protect_list; +LIST_ENTRY g_white_list; namespace protect_filter { auto Init() -> VOID { InitializeListHead(&g_protect_list); + InitializeListHead(&g_white_list); } - auto add_list(ULONG Pid, HWND hwnd) -> BOOL + auto add_protect_list(ULONG Pid, HWND hwnd, BOOL is_white)->BOOL { auto PFilter = reinterpret_cast(ExAllocatePoolWithTag(PagedPool, sizeof(FILTER), 'wag')); if (!PFilter) @@ -31,14 +33,15 @@ namespace protect_filter PFilter->hWnd = hwnd; } - InsertTailList(&g_protect_list, &PFilter->List); + if (is_white) + InsertTailList(&g_white_list, &PFilter->List); + else InsertTailList(&g_protect_list, &PFilter->List); return TRUE; } auto is_protect_pid(ULONG Pid, PEPROCESS Eprocess)->BOOL { - UNREFERENCED_PARAMETER(Pid); if (IsListEmpty(&g_protect_list)) return NULL; @@ -60,20 +63,47 @@ namespace protect_filter } } - return NULL; + return FALSE; } - auto remove_list(ULONG Pid, HWND hwnd) -> BOOL + auto is_white_pid(ULONG Pid, PEPROCESS Eprocess)->BOOL + { + if (IsListEmpty(&g_white_list)) + return NULL; + + auto list_head = g_white_list.Flink; + while (list_head != &g_white_list) + { + auto list_data = reinterpret_cast(CONTAINING_RECORD(list_head, FILTER, List)); + list_head = list_head->Flink; + + if (Pid) + { + if (list_data->Pid == Pid) + return TRUE; + } + if (Eprocess) + { + if (list_data->Eprocess == Eprocess) + return TRUE; + } + + } + + return FALSE; + } + + auto remove_protect_list(LIST_ENTRY list_entry, ULONG Pid, HWND hwnd)->BOOL { UNREFERENCED_PARAMETER(hwnd); BOOL is_remove_list = FALSE; - if (IsListEmpty(&g_protect_list)) - return NULL; + if (IsListEmpty(&list_entry)) + return FALSE; - auto list_head = g_protect_list.Flink; - while (list_head != &g_protect_list) + auto list_head = list_entry.Flink; + while (list_head != &list_entry) { auto list_data = reinterpret_cast(CONTAINING_RECORD(list_head, FILTER, List)); list_head = list_head->Flink; @@ -88,9 +118,10 @@ namespace protect_filter if (is_remove_list) { ExFreePoolWithTag(list_data, 'wag'); + return TRUE; } } + return FALSE; - return TRUE; } } \ No newline at end of file diff --git a/Anti-Cheat_Driver/protect_filter.h b/Anti-Cheat_Driver/protect_filter.h index f3ee553..92d2c2c 100644 --- a/Anti-Cheat_Driver/protect_filter.h +++ b/Anti-Cheat_Driver/protect_filter.h @@ -1,5 +1,6 @@ #pragma once #include "Base.h" + typedef struct _FILTER { LIST_ENTRY List; @@ -8,14 +9,18 @@ typedef struct _FILTER HWND hWnd; }FILTER,*PFILTER; +extern LIST_ENTRY g_protect_list; +extern LIST_ENTRY g_white_list; namespace protect_filter { auto Init()->VOID; - auto add_list(ULONG Pid, HWND hwnd)->BOOL; + auto add_protect_list(ULONG Pid, HWND hwnd, BOOL is_white)->BOOL; auto is_protect_pid(ULONG Pid, PEPROCESS Eprocess) -> BOOL; - auto remove_list(ULONG Pid, HWND hwnd)->BOOL; + auto is_white_pid(ULONG Pid, PEPROCESS Eprocess)->BOOL; + + auto remove_protect_list(LIST_ENTRY list_entry, ULONG Pid, HWND hwnd)->BOOL; } \ No newline at end of file