From 762cedc015326a92134f3f717d26b4105b966f66 Mon Sep 17 00:00:00 2001
From: maowenrui <3505719167@qq.com>
Date: Wed, 3 Jun 2026 10:03:26 +0800
Subject: [PATCH] feat add protect list
---
Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj | 2 +
.../Anti-Cheat_Driver.vcxproj.filters | 6 ++
Anti-Cheat_Driver/anit_screen_grap.cpp | 2 -
Anti-Cheat_Driver/driver_main.cpp | 18 +++-
Anti-Cheat_Driver/io_ctl.cpp | 6 ++
Anti-Cheat_Driver/load_Image_callback.cpp | 19 +++-
Anti-Cheat_Driver/ob_reg_callback.cpp | 1 +
Anti-Cheat_Driver/protect_filter.cpp | 96 +++++++++++++++++++
Anti-Cheat_Driver/protect_filter.h | 21 ++++
Anti-Cheat_Driver/utils.h | 2 -
10 files changed, 163 insertions(+), 10 deletions(-)
create mode 100644 Anti-Cheat_Driver/protect_filter.cpp
create mode 100644 Anti-Cheat_Driver/protect_filter.h
diff --git a/Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj b/Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj
index 95ac8ca..be1f86d 100644
--- a/Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj
+++ b/Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj
@@ -149,6 +149,7 @@
+
@@ -160,6 +161,7 @@
+
diff --git a/Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj.filters b/Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj.filters
index 191f3f8..625bb0b 100644
--- a/Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj.filters
+++ b/Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj.filters
@@ -64,6 +64,9 @@
kernel_callback
+
+ kernel_private
+
@@ -93,5 +96,8 @@
kernel_callback
+
+ kernel_private
+
\ No newline at end of file
diff --git a/Anti-Cheat_Driver/anit_screen_grap.cpp b/Anti-Cheat_Driver/anit_screen_grap.cpp
index 793fa6f..0964776 100644
--- a/Anti-Cheat_Driver/anit_screen_grap.cpp
+++ b/Anti-Cheat_Driver/anit_screen_grap.cpp
@@ -39,8 +39,6 @@ namespace anit_screen_grap
if (!_GreProtectSpriteContent)
return FALSE;
- DbgPrintEx(77, 0, "%p\n", _GreProtectSpriteContent);
-
auto suc = _GreProtectSpriteContent(NULL, hWnd, TRUE, Flags);
KeUnstackDetachProcess(&apc);
diff --git a/Anti-Cheat_Driver/driver_main.cpp b/Anti-Cheat_Driver/driver_main.cpp
index 10a2c37..e951872 100644
--- a/Anti-Cheat_Driver/driver_main.cpp
+++ b/Anti-Cheat_Driver/driver_main.cpp
@@ -2,6 +2,7 @@
#include "anit_screen_grap.h"
#include "create_thread_callback.h"
#include "load_Image_callback.h"
+#include "protect_filter.h"
EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING)
{
@@ -14,11 +15,20 @@ EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING)
kernel_api::kernel_api_init();
- thread_notify_routine::create_thread_routine();
- ob_call_back::register_ob_reg_callback();
- load_image_notify_routine::create_image_load_notify_routine();
-
+ protect_filter::Init();
+ protect_filter::add_list(7868, 0);
+ protect_filter::add_list(8152, 0);
+ protect_filter::add_list(8224, 0);
+ protect_filter::is_protect_pid(0);
+
+ protect_filter::remove_list(7868,0);
+ protect_filter::is_protect_pid(0);
+
+
+ ob_call_back::register_ob_reg_callback();
+ thread_notify_routine::create_thread_routine();
+ load_image_notify_routine::create_image_load_notify_routine();
return STATUS_SUCCESS;
}
\ No newline at end of file
diff --git a/Anti-Cheat_Driver/io_ctl.cpp b/Anti-Cheat_Driver/io_ctl.cpp
index 3a8a3e6..83e5127 100644
--- a/Anti-Cheat_Driver/io_ctl.cpp
+++ b/Anti-Cheat_Driver/io_ctl.cpp
@@ -50,8 +50,14 @@ auto io_ctl::dispatch_device_io(PDEVICE_OBJECT devcie_object, PIRP irp) -> NTSTA
{
UNREFERENCED_PARAMETER(devcie_object);
NTSTATUS status{ 0 };
+ /*auto stack = IoGetCurrentIrpStackLocation(irp);
+ switch (stack->Parameters.DeviceIoControl.IoControlCode)
+ {
+ default:
+ break;
+ }*/
irp->IoStatus.Information = 0;
irp->IoStatus.Status = status;
diff --git a/Anti-Cheat_Driver/load_Image_callback.cpp b/Anti-Cheat_Driver/load_Image_callback.cpp
index 6250e2e..2dec44c 100644
--- a/Anti-Cheat_Driver/load_Image_callback.cpp
+++ b/Anti-Cheat_Driver/load_Image_callback.cpp
@@ -11,8 +11,23 @@ namespace load_image_notify_routine
UNREFERENCED_PARAMETER(ProcessId);
UNREFERENCED_PARAMETER(ImageInfo);
- if(FullImageName->Buffer)
- DbgPrintEx(77, 0, "[+] %ws\n", FullImageName->Buffer);
+ if (FullImageName->Buffer)
+ {
+
+ if (wcsstr(FullImageName->Buffer, L"MyDriver1"))
+ {
+ DbgPrintEx(77, 0, "[+] %ws | pid:%d\n", FullImageName->Buffer, ProcessId);
+
+ ZwUnmapViewOfSection(PsGetCurrentProcess(), ImageInfo->ImageBase);
+
+ }
+
+
+
+ }
+
+
+
}
diff --git a/Anti-Cheat_Driver/ob_reg_callback.cpp b/Anti-Cheat_Driver/ob_reg_callback.cpp
index ec614a2..9aaa047 100644
--- a/Anti-Cheat_Driver/ob_reg_callback.cpp
+++ b/Anti-Cheat_Driver/ob_reg_callback.cpp
@@ -1,4 +1,5 @@
#include "ob_reg_callback.h"
+
void* reg_ob_callback_handle;
diff --git a/Anti-Cheat_Driver/protect_filter.cpp b/Anti-Cheat_Driver/protect_filter.cpp
new file mode 100644
index 0000000..fc57da6
--- /dev/null
+++ b/Anti-Cheat_Driver/protect_filter.cpp
@@ -0,0 +1,96 @@
+#include "protect_filter.h"
+
+LIST_ENTRY g_protect_list;
+
+namespace protect_filter
+{
+ auto Init() -> VOID
+ {
+ InitializeListHead(&g_protect_list);
+ }
+
+ auto add_list(ULONG Pid, HWND hwnd) -> BOOL
+ {
+ auto PFilter = reinterpret_cast(ExAllocatePoolWithTag(PagedPool, sizeof(FILTER), 'wag'));
+ if (!PFilter)
+ return FALSE;
+
+ memset(PFilter, 0, sizeof(FILTER));
+
+ if (Pid)
+ {
+ PEPROCESS eprocess{ 0 };
+ if (!NT_SUCCESS(PsLookupProcessByProcessId(ULongToHandle(Pid), &eprocess)))
+ return FALSE;
+
+ PFilter->Pid = Pid;
+ PFilter->Eprocess = eprocess;
+ }
+ if (hwnd)
+ {
+ PFilter->hWnd = hwnd;
+ }
+
+ InsertTailList(&g_protect_list, &PFilter->List);
+
+ return TRUE;
+ }
+
+ auto is_protect_pid(ULONG Pid) -> ULONG
+ {
+ UNREFERENCED_PARAMETER(Pid);
+ if (IsListEmpty(&g_protect_list))
+ return NULL;
+
+ auto list_head = g_protect_list.Flink;
+ while (list_head != &g_protect_list)
+ {
+ auto list_data = reinterpret_cast(CONTAINING_RECORD(list_head, FILTER, List));
+ list_head = list_head->Flink;
+
+ DbgPrintEx(77, 0, "[+] pid:%d | eproecss:%p\n", list_data->Pid, list_data->Eprocess);
+
+
+ }
+
+ return NULL;
+ }
+
+ auto remove_list(ULONG Pid, HWND hwnd) -> BOOL
+ {
+ UNREFERENCED_PARAMETER(hwnd);
+
+ BOOL is_remove_list = FALSE;
+
+
+ if (IsListEmpty(&g_protect_list))
+ return NULL;
+
+ auto list_head = g_protect_list.Flink;
+ while (list_head != &g_protect_list)
+ {
+ auto list_data = reinterpret_cast(CONTAINING_RECORD(list_head, FILTER, List));
+ list_head = list_head->Flink;
+
+
+ if (list_data->Pid == Pid)
+ {
+ RemoveEntryList(list_head->Blink);
+ is_remove_list = TRUE;
+ }
+
+ if (is_remove_list)
+ {
+ ExFreePoolWithTag(list_data, 'wag');
+ }
+ }
+
+
+ return TRUE;
+ }
+
+
+
+
+
+}
\ No newline at end of file
diff --git a/Anti-Cheat_Driver/protect_filter.h b/Anti-Cheat_Driver/protect_filter.h
new file mode 100644
index 0000000..a2d630d
--- /dev/null
+++ b/Anti-Cheat_Driver/protect_filter.h
@@ -0,0 +1,21 @@
+#pragma once
+#include "Base.h"
+typedef struct _FILTER
+{
+ LIST_ENTRY List;
+ PEPROCESS Eprocess;
+ ULONG Pid;
+ HWND hWnd;
+}FILTER,*PFILTER;
+
+
+namespace protect_filter
+{
+ auto Init()->VOID;
+
+ auto add_list(ULONG Pid, HWND hwnd)->BOOL;
+
+ auto is_protect_pid(ULONG Pid)->ULONG;
+
+ auto remove_list(ULONG Pid, HWND hwnd)->BOOL;
+}
\ No newline at end of file
diff --git a/Anti-Cheat_Driver/utils.h b/Anti-Cheat_Driver/utils.h
index ccb7feb..8298204 100644
--- a/Anti-Cheat_Driver/utils.h
+++ b/Anti-Cheat_Driver/utils.h
@@ -5,8 +5,6 @@ namespace utils
{
auto GetVersion() -> OSVERSIONINFOW;
-
-
auto FindSectionsCode(unsigned long long Base, const char* pattern, const char* mask, const char* name) -> ULONG64;