maowengrui/anit-cheat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

style

Browse Source
This commit is contained in:
maowenrui
2026-06-16 10:24:37 +08:00
parent 70d9a8d4cd
commit 91bd5436f6
4 changed files with 47 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Anti-Cheat_Driver/create_thread_callback.cpp
+4 -22
View File
@@ -1,6 +1,7 @@
#include "create_thread_callback.h"
#include "protect_filter.h"
#include "kernel_function.h"
#include "utils.h"
#pragma warning(disable : 4309)
#pragma warning(disable : 4838)
@@ -53,28 +54,9 @@ namespace thread_notify_routine
}
}
auto get_beep_trampoline_ptr() -> uintptr_t
{
uintptr_t trampoline_ptr = NULL;
auto beep = kernel_function::GetKernelModule("beep.sys");
auto nt_header = reinterpret_cast<PIMAGE_NT_HEADERS>(beep + reinterpret_cast<PIMAGE_DOS_HEADER>(beep)->e_lfanew);
auto file_header = &nt_header->FileHeader;
auto section_header = IMAGE_FIRST_SECTION(nt_header);
for (size_t i = 0; i < file_header->NumberOfSections; i++)
{
if (!strcmp((char*)section_header[i].Name, ".text"))
{
trampoline_ptr = ((beep + section_header[i].VirtualAddress) + section_header[i].Misc.VirtualSize);
}
}
return trampoline_ptr;
}
auto create_thread_routine() -> NTSTATUS
{
auto trampoline_ptr = get_beep_trampoline_ptr();
auto trampoline_ptr = utils::get_beep_trampoline_ptr();
if (trampoline_ptr)
{
char jmprax[] = { 0x48, 0xB8, 0xA0, 0x9A, 0xD5, 0x3E, 0xFE, 0x7F, 0x00, 0x00, 0xFF, 0xE0 };
@@ -92,8 +74,8 @@ namespace thread_notify_routine
auto unload_thread_routine() -> NTSTATUS
{
auto trampoline_ptr = get_beep_trampoline_ptr();
return PsRemoveCreateThreadNotifyRoutine((PCREATE_PROCESS_NOTIFY_ROUTINE)trampoline_ptr);
//auto trampoline_ptr = utils::get_beep_trampoline_ptr();
return PsRemoveCreateThreadNotifyRoutine(thread_notify_routine);
}