init

Anit-Cheat_DLL/active_check.cpp

@@ -1,6 +1,9 @@
 #include "active_check.h"
 #include "utils.h"
 
+
+static const NTSTATUS StatusInfoLengthMismatch = 0xC0000004L;
+
 namespace active_check
 {
 	auto check_awesun_process() -> bool
@@ -65,4 +68,175 @@ namespace active_check
 		return false;
 	}
 
+    DWORD GetProcessIdFromHandle(
+        HANDLE ProcessHandle
+    )
+    {
+        PROCESS_BASIC_INFORMATION_CUSTOM
+            _ProcessBasicInformation{};
+
+        ULONG ReturnLength = 0;
+
+
+        NTSTATUS Status =
+            NtQueryInformationProcess(
+                ProcessHandle,
+                ProcessBasicInformation,
+                &_ProcessBasicInformation,
+                sizeof(_ProcessBasicInformation),
+                &ReturnLength
+            );
+
+
+        if (Status < 0)
+            return 0;
+
+
+        return _ProcessBasicInformation.UniqueProcessId;
+    }
+
+    auto ScanProcessHandles(DWORD CurrentProcessId, PROCESS_HANDLE_RESULTS* Results) -> BOOL
+    {
+        if (!Results)
+            return FALSE;
+
+        ZeroMemory(
+            Results,
+            sizeof(PROCESS_HANDLE_RESULTS)
+        );
+
+        ULONG BufferSize = 1024 * 1024;
+        ULONG ReturnLength = 0;
+        PVOID Buffer = nullptr;
+        NTSTATUS Status;
+
+
+        while (true)
+        {
+            Buffer = HeapAlloc(
+                GetProcessHeap(),
+                HEAP_ZERO_MEMORY,
+                BufferSize
+            );
+
+            if (!Buffer)
+                return FALSE;
+
+
+            Status = NtQuerySystemInformation(
+                SystemExtendedHandleInformation,
+                Buffer,
+                BufferSize,
+                &ReturnLength
+            );
+
+
+            if (Status != StatusInfoLengthMismatch)
+                break;
+
+
+            HeapFree(GetProcessHeap(), 0, Buffer);
+
+            Buffer = nullptr;
+
+            BufferSize =
+                ReturnLength > BufferSize
+                ? ReturnLength + 0x10000
+                : BufferSize * 2;
+        }
+
+
+        if (Status < 0)
+        {
+            HeapFree(GetProcessHeap(), 0, Buffer);
+            return FALSE;
+        }
+
+
+        SYSTEM_HANDLE_INFORMATION_EX*
+            HandleInformation =
+            (SYSTEM_HANDLE_INFORMATION_EX*)Buffer;
+
+
+        for (ULONG_PTR Index = 0;
+            Index < HandleInformation->NumberOfHandles;
+            ++Index)
+        {
+            SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX*
+                HandleEntry =
+                &HandleInformation->Handles[Index];
+
+
+            auto OwnerProcessId = HandleEntry->UniqueProcessId;
+
+            if (OwnerProcessId == CurrentProcessId)
+                continue;
+
+
+            HANDLE OwnerProcessHandle = OpenProcess(PROCESS_DUP_HANDLE, FALSE, OwnerProcessId);
+
+
+            if (!OwnerProcessHandle)
+                continue;
+
+
+            HANDLE DuplicatedHandle = nullptr;
+
+
+            BOOL DuplicateResult =
+                DuplicateHandle(
+                    OwnerProcessHandle,
+                    (HANDLE)HandleEntry->HandleValue,
+                    GetCurrentProcess(),
+                    &DuplicatedHandle,
+                    0,
+                    FALSE,
+                    DUPLICATE_SAME_ACCESS
+                );
+
+
+            if (DuplicateResult)
+            {
+                auto TargetProcessId = GetProcessIdFromHandle(DuplicatedHandle);
+
+                if (TargetProcessId == CurrentProcessId)
+                {
+                    if (Results->Count < MAX_PROCESS_HANDLE_RESULTS)
+                    {
+                        auto Result = &Results->Items[Results->Count];
+
+
+                        Result->ProcessId = OwnerProcessId;
+
+                        Result->TargetProcessId = TargetProcessId;
+
+                        Result->HandleValue = HandleEntry->HandleValue;
+
+                        Result->GrantedAccess = HandleEntry->GrantedAccess;
+
+
+                        utils::GetProcessName(
+                            OwnerProcessId,
+                            Result->ProcessName,
+                            sizeof(Result->ProcessName)
+                        );
+
+
+                        Results->Count++;
+                    }
+                }
+                CloseHandle(DuplicatedHandle);
+            }
+            CloseHandle(OwnerProcessHandle);
+        }
+
+
+        HeapFree(GetProcessHeap(), 0, Buffer);
+
+
+        return TRUE;
+    }
+
+
+
 }