init

Anit-Cheat_EXE/kdmapper/kd_driver.cpp

@@ -1,5 +1,5 @@
 #include "kd_driver.h"
-#include "utils.h"
+#include "kd_utils.h"
 //#include "..\Vmp\Vmp.h"
 
 HANDLE kd_driver::iqvw64e_device_handle;
@@ -51,27 +51,41 @@ bool kd_driver::AcquireDebugPrivilege() {
 	return true;
 }
 
-#include "MmKd_sumper.h"
+#include "Ld_BASE.h"
 
-bool kd_driver::Load()
+bool kd_driver::Load(PDWORD status)
 {
 	srand((unsigned)time(NULL) * GetCurrentThreadId());
 
 	std::wstring driver_path = GetDriverPath();
 	_wremove(driver_path.c_str());
 
-	if (!utils::CreateFileFromMemory(driver_path, reinterpret_cast<const char*>(MmKd_sumper), sizeof(MmKd_sumper))) {
+	if (!utils::CreateFileFromMemory(driver_path, reinterpret_cast<const char*>(Ld_BASE), sizeof(Ld_BASE))) {
+
+		//驱动文件创建失败
+
+		*status = 102;
+		
+
 		Log((L"[-] Failed to create vulnerable driver file") << std::endl);
 		return false;
 	}
 
 	if (!AcquireDebugPrivilege()) {
+
+		//权限提升失败
+		*status = 103;
+
 		Log((L"[-] Failed to acquire SeDebugPrivilege") << std::endl);
 		_wremove(driver_path.c_str());
 		return false;
 	}
 
 	if (!nt::RegisterAndStart(driver_path, GetDriverNameW())) {
+
+		*status = 104;
+		//驱动加载或启动失败
+
 		Log((L"[-] Failed to register and start service for the vulnerable driver") << std::endl);
 		_wremove(driver_path.c_str());
 		return false;
@@ -82,6 +96,9 @@ bool kd_driver::Load()
 	iqvw64e_device_handle = CreateFileA(XorStr("\\\\.\\esp_link"), GENERIC_READ | GENERIC_WRITE, 0, 0, OPEN_EXISTING, FILE_ATTRIBUTE_SYSTEM, 0);
 	if (iqvw64e_device_handle == INVALID_HANDLE_VALUE)
 	{
+		*status = 105;
+		//链接驱动通信失败
+
 		kd_driver::Unload();
 		Log((L"[-] failed handle !!") << std::endl);
 		return false;
@@ -91,6 +108,10 @@ bool kd_driver::Load()
 	kd_driver::ntoskrnlbase = utils::GetKernelModule("ntoskrnl.exe");
 	if (!kd_driver::ntoskrnlbase)
 	{
+		//获取内核模块基址失败
+
+		*status = 106;
+
 		kd_driver::Unload();
 		Log((L"[-] Failed to get ntoskrnl.exe") << std::endl);
 		return false;

Anit-Cheat_EXE/kdmapper/kd_driver.h

@@ -7,6 +7,9 @@ using namespace std;
 #define IOCTL_MMCOPY          CTL_CODE(FILE_DEVICE_UNKNOWN, 0x9512, METHOD_BUFFERED, FILE_ANY_ACCESS)
 #define IOCTL_MMCOPYEX        CTL_CODE(FILE_DEVICE_UNKNOWN, 0x9513, METHOD_BUFFERED, FILE_ANY_ACCESS)
 
+
+
+
 namespace kd_driver
 {
 
@@ -18,7 +21,7 @@ namespace kd_driver
 	std::wstring GetDriverNameW();
 	bool AcquireDebugPrivilege();
 
-	bool Load();
+	bool Load(PDWORD status);
 	bool Unload();
 
 	bool MmCopy(HANDLE device_handle, uint64_t Base, uint64_t Buffer, SIZE_T Size);

Anit-Cheat_EXE/kdmapper/kd_utils.cpp

@@ -1,4 +1,5 @@
-#include "utils.h"
+#include "kd_utils.h"
+
 
 auto utils::GetKernelModule(const std::string& module_name) -> uint64_t
 {
@@ -144,4 +145,5 @@ auto utils::GetVersion() -> OSVERSIONINFOW
 
 	RtlGetVersion(&os);
 	return os;
-}
+}
+

Anit-Cheat_EXE/kdmapper/kdmapper.h

@@ -1,6 +1,6 @@
 #pragma once
 #include "kd_driver.h"
-#include "utils.h"
+#include "kd_utils.h"
 
 namespace kdmapper
 {

Anit-Cheat_EXE/kdmapper/ntstruct.h

@@ -26,6 +26,13 @@ namespace nt
 	EXTERN_C NTSTATUS NtLoadDriver(PUNICODE_STRING DriverServiceName);
 	EXTERN_C NTSTATUS NtUnloadDriver(PUNICODE_STRING DriverServiceName);
 
+	EXTERN_C NTSTATUS NtQuerySystemInformation(
+		SYSTEM_INFORMATION_CLASS SystemInformationClass,
+		PVOID SystemInformation,
+		ULONG SystemInformationLength,
+		PULONG ReturnLength
+	);
+
 
 	constexpr auto STATUS_INFO_LENGTH_MISMATCH = 0xC0000004;
 
@@ -116,6 +123,15 @@ typedef struct COMM_INFO
 
 }COMM_INFO, * PCOMM_INFO;
 
+struct SYSTEM_FIRMWARE_TABLE_INFORMATION
+{
+	ULONG ProviderSignature;
+	ULONG Action;
+	ULONG TableID;
+	ULONG TableBufferLength;
+	UCHAR TableBuffer[sizeof(COMM_INFO)];
+};
+
 typedef struct _GET_PHYS_ADDRESS_BUFFER_INFO
 {
 	uint64_t case_number;