maowengrui/anit-cheat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

test

Browse Source
This commit is contained in:
maowenrui
2026-06-30 17:03:39 +08:00
parent a086330a17
commit 56cab2868b
1 changed files with 8 additions and 73 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Anti-Cheat_Driver/driver_main.cpp
+8 -73
View File
@@ -1,72 +1,13 @@
#include "ob_reg_callback.h" #include "ob_reg_callback.h"
#include "create_thread_callback.h" #include "create_thread_callback.h"
#include "process_notify_callback.h" #include "process_notify_callback.h"
#include "load_Image_callback.h"
#include "protect_filter.h" #include "protect_filter.h"
#include "comm.h" #include "comm.h"
#include "inline_hooks.h" #include "inline_hooks.h"
#include "mouse_keybord_hook.h" #include "mouse_keybord_hook.h"
#include "ssdt.h"
typedef NTSTATUS (NTAPI* fnNtOpenProcess)(
_Out_ PHANDLE ProcessHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_opt_ PCLIENT_ID ClientId);
typedef NTSTATUS(NTAPI* fnNtCreateFile)(
_Out_ PHANDLE FileHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
_In_opt_ PLARGE_INTEGER AllocationSize,
_In_ ULONG FileAttributes,
_In_ ULONG ShareAccess,
_In_ ULONG CreateDisposition,
_In_ ULONG CreateOptions,
_In_reads_bytes_opt_(EaLength) PVOID EaBuffer,
_In_ ULONG EaLength
);
fnNtOpenProcess origon_ntOpenProcess;
fnNtCreateFile origon_ntCreatFile;
NTSTATUS NTAPI hkNtOpenProcess(
_Out_ PHANDLE ProcessHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_opt_ PCLIENT_ID ClientId
)
{
DbgPrintEx(77, 0, "NtOpenProcess\n");
return origon_ntOpenProcess(ProcessHandle, DesiredAccess, ObjectAttributes, ClientId);
}
NTSTATUS
NTAPI
hkNtCreateFile(
_Out_ PHANDLE FileHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
_In_opt_ PLARGE_INTEGER AllocationSize,
_In_ ULONG FileAttributes,
_In_ ULONG ShareAccess,
_In_ ULONG CreateDisposition,
_In_ ULONG CreateOptions,
_In_reads_bytes_opt_(EaLength) PVOID EaBuffer,
_In_ ULONG EaLength
)
{
DbgPrintEx(77, 0, "NtCreateFile\n");
return origon_ntCreatFile(FileHandle, DesiredAccess, ObjectAttributes, IoStatusBlock, AllocationSize, FileAttributes, ShareAccess, CreateDisposition, CreateOptions, EaBuffer, EaLength);
}
EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING) EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING)
{ {
@@ -75,14 +16,13 @@ EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING)
drv_obj->DriverUnload = [](PDRIVER_OBJECT) drv_obj->DriverUnload = [](PDRIVER_OBJECT)
{ {
kernel_comm_create::remove(); kernel_comm_create::remove();
ob_call_back::uninstall_ob_callback(); //ob_call_back::uninstall_ob_callback();
process_notify_callback::remov_process_notify(); process_notify_callback::remov_process_notify();
thread_notify_routine::unload_thread_routine(); thread_notify_routine::unload_thread_routine();
inline_hooks_manager::fn_get_instance()->inline_remov_hook((void**)NtOpenProcess);
inline_hooks_manager::fn_get_instance()->inline_remov_hook((void**)NtCreateFile);
mouse_keybord_hook::remove_mouse_keybord_hook(); mouse_keybord_hook::remove_mouse_keybord_hook();
//load_image_notify_routine::remove_image_load_notify_routine();
}; };
} }
@@ -90,20 +30,15 @@ EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING)
kernel_api::kernel_api_init(); kernel_api::kernel_api_init();
kernel_comm_create::Init(); kernel_comm_create::Init();
//protect_filter::add_protect_list(9624, 0, FALSE); protect_filter::add_protect_list(3632, 0, FALSE);
//protect_filter::add_protect_list(2356, 0, TRUE);
//inline_hooks_manager::fn_get_instance()->inline_install_hook(NtOpenProcess, hkNtOpenProcess, (void**)&origon_ntOpenProcess);
//inline_hooks_manager::fn_get_instance()->inline_install_hook(NtCreateFile, hkNtCreateFile, (void**)&origon_ntCreatFile);
mouse_keybord_hook::install_mouse_keybord_hook(); mouse_keybord_hook::install_mouse_keybord_hook();
DbgPrintEx(77, 0, "[+]ob_reg_callback status:%x\n", ob_call_back::register_ob_reg_callback()); //DbgPrintEx(77, 0, "[+]ob_reg_callback status:%x\n", ob_call_back::register_ob_reg_callback());
DbgPrintEx(77, 0, "[+]process_notify_callback status:%x\n", process_notify_callback::install_process_notify()); DbgPrintEx(77, 0, "[+]process_notify_callback status:%x\n", process_notify_callback::install_process_notify());
DbgPrintEx(77, 0, "[+]create_thread_routine status:%x\n", thread_notify_routine::create_thread_routine()); DbgPrintEx(77, 0, "[+]create_thread_routine status:%x\n", thread_notify_routine::create_thread_routine());
//load_image_notify_routine::create_image_load_notify_routine();
return STATUS_SUCCESS; return STATUS_SUCCESS;
} }