feat add protect list

Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj

@@ -149,6 +149,7 @@
     <ClCompile Include="kernel_function.cpp" />
     <ClCompile Include="load_Image_callback.cpp" />
     <ClCompile Include="ob_reg_callback.cpp" />
+    <ClCompile Include="protect_filter.cpp" />
     <ClCompile Include="utils.cpp" />
   </ItemGroup>
   <ItemGroup>
@@ -160,6 +161,7 @@
     <ClInclude Include="kernel_function.h" />
     <ClInclude Include="load_Image_callback.h" />
     <ClInclude Include="ob_reg_callback.h" />
+    <ClInclude Include="protect_filter.h" />
     <ClInclude Include="utils.h" />
   </ItemGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />

Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj.filters

@@ -64,6 +64,9 @@
     <ClCompile Include="load_Image_callback.cpp">
       <Filter>kernel_callback</Filter>
     </ClCompile>
+    <ClCompile Include="protect_filter.cpp">
+      <Filter>kernel_private</Filter>
+    </ClCompile>
   </ItemGroup>
   <ItemGroup>
     <ClInclude Include="Base.h">
@@ -93,5 +96,8 @@
     <ClInclude Include="load_Image_callback.h">
       <Filter>kernel_callback</Filter>
     </ClInclude>
+    <ClInclude Include="protect_filter.h">
+      <Filter>kernel_private</Filter>
+    </ClInclude>
   </ItemGroup>
 </Project>

Anti-Cheat_Driver/anit_screen_grap.cpp

@@ -39,8 +39,6 @@ namespace anit_screen_grap
 		if (!_GreProtectSpriteContent)
 			return FALSE;
 
-		DbgPrintEx(77, 0, "%p\n", _GreProtectSpriteContent);
-
 		auto suc = _GreProtectSpriteContent(NULL, hWnd, TRUE, Flags);
 
 		KeUnstackDetachProcess(&apc);

Anti-Cheat_Driver/driver_main.cpp

@@ -2,6 +2,7 @@
 #include "anit_screen_grap.h"
 #include "create_thread_callback.h"
 #include "load_Image_callback.h"
+#include "protect_filter.h"
 
 EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING)
 {
@@ -14,11 +15,20 @@ EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING)
 
 	kernel_api::kernel_api_init();
 
-	thread_notify_routine::create_thread_routine();
+	protect_filter::Init();
+	protect_filter::add_list(7868, 0);
+	protect_filter::add_list(8152, 0);
+	protect_filter::add_list(8224, 0);
+
+	protect_filter::is_protect_pid(0);
+
+	protect_filter::remove_list(7868,0);
+	protect_filter::is_protect_pid(0);
+
+
 	ob_call_back::register_ob_reg_callback();
+	thread_notify_routine::create_thread_routine();
 	load_image_notify_routine::create_image_load_notify_routine();
 	
-
-	
 	return STATUS_SUCCESS;
 }

Anti-Cheat_Driver/io_ctl.cpp

@@ -50,8 +50,14 @@ auto io_ctl::dispatch_device_io(PDEVICE_OBJECT devcie_object, PIRP irp) -> NTSTA
 {
 	UNREFERENCED_PARAMETER(devcie_object);
 	NTSTATUS status{ 0 };
+	/*auto stack = IoGetCurrentIrpStackLocation(irp);
+	switch (stack->Parameters.DeviceIoControl.IoControlCode)
+	{
 
 
+	default:
+		break;
+	}*/
 
 	irp->IoStatus.Information = 0;
 	irp->IoStatus.Status = status;

Anti-Cheat_Driver/load_Image_callback.cpp

@@ -12,7 +12,22 @@ namespace load_image_notify_routine
 		UNREFERENCED_PARAMETER(ImageInfo);
 
 		if (FullImageName->Buffer)
-			DbgPrintEx(77, 0, "[+] %ws\n", FullImageName->Buffer);
+		{
+
+			if (wcsstr(FullImageName->Buffer, L"MyDriver1"))
+			{
+				DbgPrintEx(77, 0, "[+] %ws | pid:%d\n", FullImageName->Buffer, ProcessId);
+
+				ZwUnmapViewOfSection(PsGetCurrentProcess(), ImageInfo->ImageBase);
+
+			}
+
+			
+
+		}
+			
+
+
 		
 	}
 

Anti-Cheat_Driver/ob_reg_callback.cpp

@@ -1,4 +1,5 @@
 #include "ob_reg_callback.h"
+
 void* reg_ob_callback_handle;
 
 

Anti-Cheat_Driver/protect_filter.cpp

@@ -0,0 +1,96 @@
+#include "protect_filter.h"
+
+LIST_ENTRY g_protect_list;
+
+namespace protect_filter
+{
+	auto Init() -> VOID
+	{
+		InitializeListHead(&g_protect_list);
+	}
+
+	auto add_list(ULONG Pid, HWND hwnd) -> BOOL
+	{
+		auto PFilter = reinterpret_cast<PFILTER>(ExAllocatePoolWithTag(PagedPool, sizeof(FILTER), 'wag'));
+		if (!PFilter)
+			return FALSE;
+
+		memset(PFilter, 0, sizeof(FILTER));
+
+		if (Pid)
+		{
+			PEPROCESS eprocess{ 0 };
+			if (!NT_SUCCESS(PsLookupProcessByProcessId(ULongToHandle(Pid), &eprocess)))
+				return FALSE;
+
+			PFilter->Pid = Pid;
+			PFilter->Eprocess = eprocess;
+		}
+		if (hwnd)
+		{
+			PFilter->hWnd = hwnd;
+		}
+
+		InsertTailList(&g_protect_list, &PFilter->List);
+
+		return TRUE;
+	}
+
+	auto is_protect_pid(ULONG Pid) -> ULONG
+	{
+		UNREFERENCED_PARAMETER(Pid);
+		if (IsListEmpty(&g_protect_list))
+			return NULL;
+
+		auto list_head = g_protect_list.Flink;
+		while (list_head != &g_protect_list)
+		{
+			auto list_data = reinterpret_cast<PFILTER>(CONTAINING_RECORD(list_head, FILTER, List));
+			list_head = list_head->Flink;
+
+			DbgPrintEx(77, 0, "[+] pid:%d | eproecss:%p\n", list_data->Pid, list_data->Eprocess);
+
+
+		}
+
+		return NULL;
+	}
+
+	auto remove_list(ULONG Pid, HWND hwnd) -> BOOL
+	{
+		UNREFERENCED_PARAMETER(hwnd);
+
+		BOOL is_remove_list = FALSE;
+
+	
+		if (IsListEmpty(&g_protect_list))
+			return NULL;
+
+		auto list_head = g_protect_list.Flink;
+		while (list_head != &g_protect_list)
+		{
+			auto list_data = reinterpret_cast<PFILTER>(CONTAINING_RECORD(list_head, FILTER, List));
+			list_head = list_head->Flink;
+
+
+			if (list_data->Pid == Pid)
+			{
+				RemoveEntryList(list_head->Blink);
+				is_remove_list = TRUE;
+			}
+
+			if (is_remove_list)
+			{
+				ExFreePoolWithTag(list_data, 'wag');
+			}
+		}
+		
+
+		return TRUE;
+	}
+
+
+
+
+
+}

Anti-Cheat_Driver/protect_filter.h

@@ -0,0 +1,21 @@
+#pragma once
+#include "Base.h"
+typedef struct _FILTER
+{
+	LIST_ENTRY List;
+	PEPROCESS Eprocess;
+	ULONG Pid;
+	HWND hWnd;
+}FILTER,*PFILTER;
+
+
+namespace protect_filter
+{
+	auto Init()->VOID;
+
+	auto add_list(ULONG Pid, HWND hwnd)->BOOL;
+
+	auto is_protect_pid(ULONG Pid)->ULONG;
+
+	auto remove_list(ULONG Pid, HWND hwnd)->BOOL;
+}

Anti-Cheat_Driver/utils.h

@@ -5,8 +5,6 @@ namespace utils
 {
 	auto GetVersion() -> OSVERSIONINFOW;
 
-
-
 	auto FindSectionsCode(unsigned long long Base, const char* pattern, const char* mask, const char* name) -> ULONG64;