From 698c55a49f4fe2d863386fb7d3e2dd220736a370 Mon Sep 17 00:00:00 2001 From: maowenrui <3505719167@qq.com> Date: Thu, 11 Jun 2026 15:20:41 +0800 Subject: [PATCH] feat api func --- Anti-Cheat_Driver/kernel_api.cpp | 19 ++++++++++++++++--- Anti-Cheat_Driver/kernel_api.h | 6 ++++++ 2 files changed, 22 insertions(+), 3 deletions(-) diff --git a/Anti-Cheat_Driver/kernel_api.cpp b/Anti-Cheat_Driver/kernel_api.cpp index 1547aea..7cd53e3 100644 --- a/Anti-Cheat_Driver/kernel_api.cpp +++ b/Anti-Cheat_Driver/kernel_api.cpp @@ -11,14 +11,19 @@ namespace kernel_api RtlInitUnicodeString(&unFuncName, L"ZwQuerySystemInformation"); imported.nt_querysystem_information = (ULONG64)MmGetSystemRoutineAddress(&unFuncName); - RtlInitUnicodeString(&unFuncName, L"PsGetProcessImageFileName"); imported.ps_getprocessimage_filname = (ULONG64)MmGetSystemRoutineAddress(&unFuncName); + + RtlInitUnicodeString(&unFuncName, L"PsGetProcessId"); + imported.ps_getprocess_id = (ULONG64)MmGetSystemRoutineAddress(&unFuncName); + + RtlInitUnicodeString(&unFuncName, L"SeLocateProcessImageName"); + imported.se_locateprocess_imagename = (ULONG64)MmGetSystemRoutineAddress(&unFuncName); } NTSTATUS ntquerysysteminformation(ULONG SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength) { - return reinterpret_cast(imported.nt_querysystem_information) + return reinterpret_cast(imported.nt_querysystem_information) (SystemInformationClass, SystemInformation, SystemInformationLength, ReturnLength); } @@ -28,6 +33,14 @@ namespace kernel_api (imported.ps_getprocessimage_filname)(Process); } + HANDLE psgetprocessid(PEPROCESS process) + { + return reinterpret_cast(imported.ps_getprocess_id)(process); + } - + NTSTATUS selocate_process_imagename(PEPROCESS Process, PUNICODE_STRING* pImageFileName) + { + return reinterpret_cast + (imported.se_locateprocess_imagename)(Process, pImageFileName); + } } diff --git a/Anti-Cheat_Driver/kernel_api.h b/Anti-Cheat_Driver/kernel_api.h index ec3e145..063f2cd 100644 --- a/Anti-Cheat_Driver/kernel_api.h +++ b/Anti-Cheat_Driver/kernel_api.h @@ -17,6 +17,8 @@ struct imported_ ULONG64 io_getcurrent_process; ULONG64 mm_copy_memory; ULONG64 ps_getprocess_section_baseaddress; + ULONG64 ps_getprocess_id; + ULONG64 se_locateprocess_imagename; }; namespace kernel_api @@ -32,4 +34,8 @@ namespace kernel_api UCHAR* psgetprocessimagefilname(PEPROCESS Process); + HANDLE psgetprocessid(PEPROCESS process); + + NTSTATUS selocate_process_imagename(PEPROCESS Process, PUNICODE_STRING* pImageFileName); + } \ No newline at end of file