maowengrui/anit-cheat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat api func

Browse Source
This commit is contained in:
maowenrui
2026-06-11 15:20:41 +08:00
parent c8aeddb902
commit 698c55a49f
2 changed files with 22 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Anti-Cheat_Driver/kernel_api.cpp
+16 -3
View File
@@ -11,9 +11,14 @@ namespace kernel_api
RtlInitUnicodeString(&unFuncName, L"ZwQuerySystemInformation");
imported.nt_querysystem_information = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
RtlInitUnicodeString(&unFuncName, L"PsGetProcessImageFileName");
imported.ps_getprocessimage_filname = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
RtlInitUnicodeString(&unFuncName, L"PsGetProcessId");
imported.ps_getprocess_id = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
RtlInitUnicodeString(&unFuncName, L"SeLocateProcessImageName");
imported.se_locateprocess_imagename = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
}
NTSTATUS ntquerysysteminformation(ULONG SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength)
@@ -28,6 +33,14 @@ namespace kernel_api
(imported.ps_getprocessimage_filname)(Process);
}
HANDLE psgetprocessid(PEPROCESS process)
{
return reinterpret_cast<HANDLE(*)(PEPROCESS)>(imported.ps_getprocess_id)(process);
}
NTSTATUS selocate_process_imagename(PEPROCESS Process, PUNICODE_STRING* pImageFileName)
{
return reinterpret_cast<NTSTATUS(*)(PEPROCESS, PUNICODE_STRING*)>
(imported.se_locateprocess_imagename)(Process, pImageFileName);
}
}
Anti-Cheat_Driver/kernel_api.h
+6
View File
@@ -17,6 +17,8 @@ struct imported_
ULONG64 io_getcurrent_process;
ULONG64 mm_copy_memory;
ULONG64 ps_getprocess_section_baseaddress;
ULONG64 ps_getprocess_id;
ULONG64 se_locateprocess_imagename;
};
namespace kernel_api
@@ -32,4 +34,8 @@ namespace kernel_api
UCHAR* psgetprocessimagefilname(PEPROCESS Process);
HANDLE psgetprocessid(PEPROCESS process);
NTSTATUS selocate_process_imagename(PEPROCESS Process, PUNICODE_STRING* pImageFileName);
}