From 8dc46d22ff39d77515e6d13ad67808f344ce1989 Mon Sep 17 00:00:00 2001
From: maowenrui <3505719167@qq.com>
Date: Tue, 23 Jun 2026 13:16:04 +0800
Subject: [PATCH] init

---
 Anti-Cheat_Driver/process_notify_callback.cpp | 59 +++++++++++++++++++
 Anti-Cheat_Driver/process_notify_callback.h   | 10 ++++
 2 files changed, 69 insertions(+)
 create mode 100644 Anti-Cheat_Driver/process_notify_callback.cpp
 create mode 100644 Anti-Cheat_Driver/process_notify_callback.h

diff --git a/Anti-Cheat_Driver/process_notify_callback.cpp b/Anti-Cheat_Driver/process_notify_callback.cpp
new file mode 100644
index 0000000..ef5a910
--- /dev/null
+++ b/Anti-Cheat_Driver/process_notify_callback.cpp
@@ -0,0 +1,59 @@
+#include "process_notify_callback.h"
+#include "kernel_function.h"
+#include "protect_filter.h"
+#include "utils.h"
+#pragma warning(disable : 4309 4838)
+namespace process_notify_callback
+{
+	auto process_notify_routine(
+		_In_ HANDLE ParentId,
+		_In_ HANDLE ProcessId,
+		_In_ BOOLEAN Create) -> VOID
+	{
+		UNREFERENCED_PARAMETER(ParentId);
+		if (!Create)	
+		{
+			//进程退出时进行 对插链的清理操作
+			if (protect_filter::is_protect_pid(HandleToLong(ProcessId), nullptr))
+				protect_filter::remove_list(HandleToLong(ProcessId), nullptr);
+		}
+
+		/*DbgPrintEx(77, 0, "ParentId:%d | ProcessId:%d | Create:%d\n",
+			ParentId, ProcessId, Create);*/
+	}
+
+	uintptr_t beep_trampoline_ptr;
+
+	auto install_process_notify() -> NTSTATUS
+	{
+		beep_trampoline_ptr = utils::get_beep_trampoline_ptr();
+		if (!beep_trampoline_ptr)
+			return STATUS_UNSUCCESSFUL;
+
+		char jmprax[] = { 0x48, 0xB8, 0x13, 0x09, 0xFC, 0xD6, 0xFC, 0x7F, 0x00, 0x00, 0xFF, 0xE0 };
+		*(uintptr_t*)&jmprax[2] = (uintptr_t)process_notify_routine;
+		auto status = kernel_function::MmMDLPagesCopy((PVOID)beep_trampoline_ptr, &jmprax, sizeof(jmprax), 0x0000002, KernelMode);
+		if (!NT_SUCCESS(status))
+			return status;
+
+		return PsSetCreateProcessNotifyRoutine((PCREATE_PROCESS_NOTIFY_ROUTINE)beep_trampoline_ptr, FALSE);
+	}
+
+	auto remov_process_notify() -> NTSTATUS
+	{
+		if (!beep_trampoline_ptr)
+			return STATUS_UNSUCCESSFUL;
+
+		auto status = PsSetCreateProcessNotifyRoutine((PCREATE_PROCESS_NOTIFY_ROUTINE)beep_trampoline_ptr, TRUE);
+		if (!NT_SUCCESS(status))
+			return status;
+
+		char nullcode[12]{ 0 };
+		status = kernel_function::MmMDLPagesCopy((PVOID)beep_trampoline_ptr, &nullcode, sizeof(nullcode), 0x0000002, KernelMode);
+		if (!NT_SUCCESS(status))
+			return status;
+
+		return status;
+	}
+
+}
diff --git a/Anti-Cheat_Driver/process_notify_callback.h b/Anti-Cheat_Driver/process_notify_callback.h
new file mode 100644
index 0000000..f3029bf
--- /dev/null
+++ b/Anti-Cheat_Driver/process_notify_callback.h
@@ -0,0 +1,10 @@
+#pragma once
+#include "Base.h"
+
+namespace process_notify_callback
+{
+	auto install_process_notify()->NTSTATUS;
+
+	auto remov_process_notify()->NTSTATUS;
+
+}
\ No newline at end of file