diff --git a/Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj b/Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj index 00535b2..3ef5f31 100644 --- a/Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj +++ b/Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj @@ -146,6 +146,10 @@ + + + + @@ -160,6 +164,10 @@ + + + + diff --git a/Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj.filters b/Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj.filters index fe5c7f7..848284c 100644 --- a/Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj.filters +++ b/Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj.filters @@ -38,6 +38,9 @@ {e30d7c3e-b37a-4d86-9561-383f1b377fba} + + {39d8ef92-d541-4aee-9850-0a3d878333dc} + @@ -73,6 +76,18 @@ process_function + + comm + + + comm + + + comm + + + comm + @@ -108,5 +123,17 @@ process_function + + comm + + + comm + + + comm + + + comm + \ No newline at end of file diff --git a/Anti-Cheat_Driver/create_thread_callback.cpp b/Anti-Cheat_Driver/create_thread_callback.cpp index f5eef3f..34785b8 100644 --- a/Anti-Cheat_Driver/create_thread_callback.cpp +++ b/Anti-Cheat_Driver/create_thread_callback.cpp @@ -1,6 +1,7 @@ #include "create_thread_callback.h" #include "protect_filter.h" #include "kernel_function.h" +#include "utils.h" #pragma warning(disable : 4309) #pragma warning(disable : 4838) @@ -53,28 +54,9 @@ namespace thread_notify_routine } } - auto get_beep_trampoline_ptr() -> uintptr_t - { - uintptr_t trampoline_ptr = NULL; - - auto beep = kernel_function::GetKernelModule("beep.sys"); - auto nt_header = reinterpret_cast(beep + reinterpret_cast(beep)->e_lfanew); - auto file_header = &nt_header->FileHeader; - - auto section_header = IMAGE_FIRST_SECTION(nt_header); - for (size_t i = 0; i < file_header->NumberOfSections; i++) - { - if (!strcmp((char*)section_header[i].Name, ".text")) - { - trampoline_ptr = ((beep + section_header[i].VirtualAddress) + section_header[i].Misc.VirtualSize); - } - } - return trampoline_ptr; - } - auto create_thread_routine() -> NTSTATUS { - auto trampoline_ptr = get_beep_trampoline_ptr(); + auto trampoline_ptr = utils::get_beep_trampoline_ptr(); if (trampoline_ptr) { char jmprax[] = { 0x48, 0xB8, 0xA0, 0x9A, 0xD5, 0x3E, 0xFE, 0x7F, 0x00, 0x00, 0xFF, 0xE0 }; @@ -92,8 +74,8 @@ namespace thread_notify_routine auto unload_thread_routine() -> NTSTATUS { - auto trampoline_ptr = get_beep_trampoline_ptr(); - return PsRemoveCreateThreadNotifyRoutine((PCREATE_PROCESS_NOTIFY_ROUTINE)trampoline_ptr); + //auto trampoline_ptr = utils::get_beep_trampoline_ptr(); + return PsRemoveCreateThreadNotifyRoutine(thread_notify_routine); } diff --git a/Anti-Cheat_Driver/driver_main.cpp b/Anti-Cheat_Driver/driver_main.cpp index 87dee58..a6cd779 100644 --- a/Anti-Cheat_Driver/driver_main.cpp +++ b/Anti-Cheat_Driver/driver_main.cpp @@ -1,32 +1,27 @@ #include "ob_reg_callback.h" -#include "anit_screen_grap.h" #include "create_thread_callback.h" -#include "load_Image_callback.h" #include "protect_filter.h" -#include "process_func.h" -#include "kernel_function.h" +#include "comm.h" + + EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING) { if (drv_obj) { drv_obj->DriverUnload = [](PDRIVER_OBJECT) { + kernel_comm_create::remove(); ob_call_back::uninstall_ob_callback(); - thread_notify_routine::unload_thread_routine(); - //load_image_notify_routine::remove_image_load_notify_routine(); + //DbgPrintEx(77,0,"%x\n", thread_notify_routine::unload_thread_routine()); }; } - kernel_api::kernel_api_init(); protect_filter::Init(); + kernel_comm_create::Init(); - protect_filter::add_list(10492, 0); DbgPrintEx(77, 0, "[+]ob_reg_callback status:%x\n", ob_call_back::register_ob_reg_callback()); - DbgPrintEx(77, 0, "[+]create_thread_routine status:%x\n", thread_notify_routine::create_thread_routine()); - - //NtQueryVirtualMemory - //load_image_notify_routine::create_image_load_notify_routine(); - + //DbgPrintEx(77, 0, "[+]create_thread_routine status:%x\n", thread_notify_routine::create_thread_routine()); + return STATUS_SUCCESS; } \ No newline at end of file