From 56cab2868b00a6521454c755f9008464851f44dc Mon Sep 17 00:00:00 2001
From: maowenrui <3505719167@qq.com>
Date: Tue, 30 Jun 2026 17:03:39 +0800
Subject: [PATCH] test

---
 Anti-Cheat_Driver/driver_main.cpp | 81 +++----------------------------
 1 file changed, 8 insertions(+), 73 deletions(-)

diff --git a/Anti-Cheat_Driver/driver_main.cpp b/Anti-Cheat_Driver/driver_main.cpp
index 9176a4c..84f52f4 100644
--- a/Anti-Cheat_Driver/driver_main.cpp
+++ b/Anti-Cheat_Driver/driver_main.cpp
@@ -1,72 +1,13 @@
 #include "ob_reg_callback.h"
 #include "create_thread_callback.h"
 #include "process_notify_callback.h"
+#include "load_Image_callback.h"
 #include "protect_filter.h"
 #include "comm.h"
 #include "inline_hooks.h"
 #include "mouse_keybord_hook.h"
+#include "ssdt.h"
 
-typedef NTSTATUS (NTAPI* fnNtOpenProcess)(
-	_Out_ PHANDLE ProcessHandle,
-	_In_ ACCESS_MASK DesiredAccess,
-	_In_ POBJECT_ATTRIBUTES ObjectAttributes,
-	_In_opt_ PCLIENT_ID ClientId);
-
-typedef NTSTATUS(NTAPI* fnNtCreateFile)(
-	_Out_ PHANDLE FileHandle,
-	_In_ ACCESS_MASK DesiredAccess,
-	_In_ POBJECT_ATTRIBUTES ObjectAttributes,
-	_Out_ PIO_STATUS_BLOCK IoStatusBlock,
-	_In_opt_ PLARGE_INTEGER AllocationSize,
-	_In_ ULONG FileAttributes,
-	_In_ ULONG ShareAccess,
-	_In_ ULONG CreateDisposition,
-	_In_ ULONG CreateOptions,
-	_In_reads_bytes_opt_(EaLength) PVOID EaBuffer,
-	_In_ ULONG EaLength
-	);
-
-
-fnNtOpenProcess origon_ntOpenProcess;
-fnNtCreateFile origon_ntCreatFile;
-
-NTSTATUS NTAPI hkNtOpenProcess(
-	_Out_ PHANDLE ProcessHandle,
-	_In_ ACCESS_MASK DesiredAccess,
-	_In_ POBJECT_ATTRIBUTES ObjectAttributes,
-	_In_opt_ PCLIENT_ID ClientId
-)
-{
-
-	DbgPrintEx(77, 0, "NtOpenProcess\n"); 
-
-	return origon_ntOpenProcess(ProcessHandle, DesiredAccess, ObjectAttributes, ClientId);
-}
-
-
-NTSTATUS
-NTAPI
-hkNtCreateFile(
-	_Out_ PHANDLE FileHandle,
-	_In_ ACCESS_MASK DesiredAccess,
-	_In_ POBJECT_ATTRIBUTES ObjectAttributes,
-	_Out_ PIO_STATUS_BLOCK IoStatusBlock,
-	_In_opt_ PLARGE_INTEGER AllocationSize,
-	_In_ ULONG FileAttributes,
-	_In_ ULONG ShareAccess,
-	_In_ ULONG CreateDisposition,
-	_In_ ULONG CreateOptions,
-	_In_reads_bytes_opt_(EaLength) PVOID EaBuffer,
-	_In_ ULONG EaLength
-)
-
-{
-
-	DbgPrintEx(77, 0, "NtCreateFile\n");
-
-
-	return origon_ntCreatFile(FileHandle, DesiredAccess, ObjectAttributes, IoStatusBlock, AllocationSize, FileAttributes, ShareAccess, CreateDisposition, CreateOptions, EaBuffer, EaLength);
-}
 
 EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING)
 {
@@ -75,14 +16,13 @@ EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING)
 		drv_obj->DriverUnload = [](PDRIVER_OBJECT)
 		{
 			kernel_comm_create::remove();
-			ob_call_back::uninstall_ob_callback();
+			//ob_call_back::uninstall_ob_callback();
 			process_notify_callback::remov_process_notify();
 			thread_notify_routine::unload_thread_routine();
 
-			inline_hooks_manager::fn_get_instance()->inline_remov_hook((void**)NtOpenProcess);
-			inline_hooks_manager::fn_get_instance()->inline_remov_hook((void**)NtCreateFile);
-
 			mouse_keybord_hook::remove_mouse_keybord_hook();
+
+			//load_image_notify_routine::remove_image_load_notify_routine();
 		};
 	}
 
@@ -90,20 +30,15 @@ EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING)
 	kernel_api::kernel_api_init();
 	kernel_comm_create::Init();
 
-	//protect_filter::add_protect_list(9624, 0, FALSE);
-
-
-	//protect_filter::add_protect_list(2356, 0, TRUE);
-	//inline_hooks_manager::fn_get_instance()->inline_install_hook(NtOpenProcess, hkNtOpenProcess, (void**)&origon_ntOpenProcess);
-	//inline_hooks_manager::fn_get_instance()->inline_install_hook(NtCreateFile, hkNtCreateFile, (void**)&origon_ntCreatFile);
+	protect_filter::add_protect_list(3632, 0, FALSE);
 
 
 	mouse_keybord_hook::install_mouse_keybord_hook();
-	DbgPrintEx(77, 0, "[+]ob_reg_callback status:%x\n", ob_call_back::register_ob_reg_callback());
+	//DbgPrintEx(77, 0, "[+]ob_reg_callback status:%x\n", ob_call_back::register_ob_reg_callback());
 	DbgPrintEx(77, 0, "[+]process_notify_callback status:%x\n", process_notify_callback::install_process_notify());
 	DbgPrintEx(77, 0, "[+]create_thread_routine status:%x\n", thread_notify_routine::create_thread_routine());
 
-
+	//load_image_notify_routine::create_image_load_notify_routine();
 
 	return STATUS_SUCCESS;
 }
\ No newline at end of file