maowengrui/anit-cheat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat api func

Browse Source
This commit is contained in:
maowenrui
2026-06-11 15:20:41 +08:00
parent c8aeddb902
commit 698c55a49f
2 changed files with 22 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Anti-Cheat_Driver/kernel_api.cpp
+16 -3
View File
@@ -11,9 +11,14 @@ namespace kernel_api
RtlInitUnicodeString(&unFuncName, L"ZwQuerySystemInformation"); RtlInitUnicodeString(&unFuncName, L"ZwQuerySystemInformation");
imported.nt_querysystem_information = (ULONG64)MmGetSystemRoutineAddress(&unFuncName); imported.nt_querysystem_information = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
RtlInitUnicodeString(&unFuncName, L"PsGetProcessImageFileName"); RtlInitUnicodeString(&unFuncName, L"PsGetProcessImageFileName");
imported.ps_getprocessimage_filname = (ULONG64)MmGetSystemRoutineAddress(&unFuncName); imported.ps_getprocessimage_filname = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
RtlInitUnicodeString(&unFuncName, L"PsGetProcessId");
imported.ps_getprocess_id = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
RtlInitUnicodeString(&unFuncName, L"SeLocateProcessImageName");
imported.se_locateprocess_imagename = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
} }
NTSTATUS ntquerysysteminformation(ULONG SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength) NTSTATUS ntquerysysteminformation(ULONG SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength)
@@ -28,6 +33,14 @@ namespace kernel_api
(imported.ps_getprocessimage_filname)(Process); (imported.ps_getprocessimage_filname)(Process);
} }
HANDLE psgetprocessid(PEPROCESS process)
{
return reinterpret_cast<HANDLE(*)(PEPROCESS)>(imported.ps_getprocess_id)(process);
}
NTSTATUS selocate_process_imagename(PEPROCESS Process, PUNICODE_STRING* pImageFileName)
{
return reinterpret_cast<NTSTATUS(*)(PEPROCESS, PUNICODE_STRING*)>
(imported.se_locateprocess_imagename)(Process, pImageFileName);
}
} }
Anti-Cheat_Driver/kernel_api.h
+6
View File
@@ -17,6 +17,8 @@ struct imported_
ULONG64 io_getcurrent_process; ULONG64 io_getcurrent_process;
ULONG64 mm_copy_memory; ULONG64 mm_copy_memory;
ULONG64 ps_getprocess_section_baseaddress; ULONG64 ps_getprocess_section_baseaddress;
ULONG64 ps_getprocess_id;
ULONG64 se_locateprocess_imagename;
}; };
namespace kernel_api namespace kernel_api
@@ -32,4 +34,8 @@ namespace kernel_api
UCHAR* psgetprocessimagefilname(PEPROCESS Process); UCHAR* psgetprocessimagefilname(PEPROCESS Process);
HANDLE psgetprocessid(PEPROCESS process);
NTSTATUS selocate_process_imagename(PEPROCESS Process, PUNICODE_STRING* pImageFileName);
} }