maowengrui/anit-cheat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat api func

Browse Source
This commit is contained in:
maowenrui
2026-06-11 15:20:41 +08:00
parent c8aeddb902
commit 698c55a49f
2 changed files with 22 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Anti-Cheat_Driver/kernel_api.cpp
+16 -3
View File
@@ -11,14 +11,19 @@ namespace kernel_api
RtlInitUnicodeString(&unFuncName, L"ZwQuerySystemInformation");
imported.nt_querysystem_information = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
RtlInitUnicodeString(&unFuncName, L"PsGetProcessImageFileName");
imported.ps_getprocessimage_filname = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
RtlInitUnicodeString(&unFuncName, L"PsGetProcessId");
imported.ps_getprocess_id = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
RtlInitUnicodeString(&unFuncName, L"SeLocateProcessImageName");
imported.se_locateprocess_imagename = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
}
NTSTATUS ntquerysysteminformation(ULONG SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength)
{
return reinterpret_cast<NTSTATUS(*)(ULONG, PVOID, ULONG, PULONG)>(imported.nt_querysystem_information)
return reinterpret_cast<NTSTATUS(*)(ULONG, PVOID, ULONG, PULONG)>(imported.nt_querysystem_information)
(SystemInformationClass, SystemInformation, SystemInformationLength, ReturnLength);
}
@@ -28,6 +33,14 @@ namespace kernel_api
(imported.ps_getprocessimage_filname)(Process);
}
HANDLE psgetprocessid(PEPROCESS process)
{
return reinterpret_cast<HANDLE(*)(PEPROCESS)>(imported.ps_getprocess_id)(process);
}
NTSTATUS selocate_process_imagename(PEPROCESS Process, PUNICODE_STRING* pImageFileName)
{
return reinterpret_cast<NTSTATUS(*)(PEPROCESS, PUNICODE_STRING*)>
(imported.se_locateprocess_imagename)(Process, pImageFileName);
}
}