style

Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj

@@ -146,6 +146,10 @@
   </ItemGroup>
   <ItemGroup>
     <ClCompile Include="anit_screen_grap.cpp" />
+    <ClCompile Include="comm.cpp" />
+    <ClCompile Include="comm_dispatch.cpp" />
+    <ClCompile Include="comm_win10.cpp" />
+    <ClCompile Include="comm_win7.cpp" />
     <ClCompile Include="create_thread_callback.cpp" />
     <ClCompile Include="driver_main.cpp" />
     <ClCompile Include="io_ctl.cpp" />
@@ -160,6 +164,10 @@
   <ItemGroup>
     <ClInclude Include="anit_screen_grap.h" />
     <ClInclude Include="Base.h" />
+    <ClInclude Include="comm.h" />
+    <ClInclude Include="comm_dispatch.h" />
+    <ClInclude Include="comm_win10.h" />
+    <ClInclude Include="comm_win7.h" />
     <ClInclude Include="create_thread_callback.h" />
     <ClInclude Include="io_ctl.h" />
     <ClInclude Include="kernel_api.h" />

Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj.filters

@@ -38,6 +38,9 @@
     <Filter Include="process_function">
       <UniqueIdentifier>{e30d7c3e-b37a-4d86-9561-383f1b377fba}</UniqueIdentifier>
     </Filter>
+    <Filter Include="comm">
+      <UniqueIdentifier>{39d8ef92-d541-4aee-9850-0a3d878333dc}</UniqueIdentifier>
+    </Filter>
   </ItemGroup>
   <ItemGroup>
     <ClCompile Include="driver_main.cpp">
@@ -73,6 +76,18 @@
     <ClCompile Include="process_func.cpp">
       <Filter>process_function</Filter>
     </ClCompile>
+    <ClCompile Include="comm_win7.cpp">
+      <Filter>comm</Filter>
+    </ClCompile>
+    <ClCompile Include="comm_win10.cpp">
+      <Filter>comm</Filter>
+    </ClCompile>
+    <ClCompile Include="comm_dispatch.cpp">
+      <Filter>comm</Filter>
+    </ClCompile>
+    <ClCompile Include="comm.cpp">
+      <Filter>comm</Filter>
+    </ClCompile>
   </ItemGroup>
   <ItemGroup>
     <ClInclude Include="Base.h">
@@ -108,5 +123,17 @@
     <ClInclude Include="process_func.h">
       <Filter>process_function</Filter>
     </ClInclude>
+    <ClInclude Include="comm_win7.h">
+      <Filter>comm</Filter>
+    </ClInclude>
+    <ClInclude Include="comm_win10.h">
+      <Filter>comm</Filter>
+    </ClInclude>
+    <ClInclude Include="comm_dispatch.h">
+      <Filter>comm</Filter>
+    </ClInclude>
+    <ClInclude Include="comm.h">
+      <Filter>comm</Filter>
+    </ClInclude>
   </ItemGroup>
 </Project>

Anti-Cheat_Driver/create_thread_callback.cpp

@@ -1,6 +1,7 @@
 #include "create_thread_callback.h"
 #include "protect_filter.h"
 #include "kernel_function.h"
+#include "utils.h"
 
 #pragma warning(disable : 4309)
 #pragma warning(disable : 4838)
@@ -53,28 +54,9 @@ namespace thread_notify_routine
 		}
 	}
 
-	auto get_beep_trampoline_ptr() -> uintptr_t
-	{
-		uintptr_t trampoline_ptr = NULL;
-
-		auto beep = kernel_function::GetKernelModule("beep.sys");
-		auto nt_header = reinterpret_cast<PIMAGE_NT_HEADERS>(beep + reinterpret_cast<PIMAGE_DOS_HEADER>(beep)->e_lfanew);
-		auto file_header = &nt_header->FileHeader;
-
-		auto section_header = IMAGE_FIRST_SECTION(nt_header);
-		for (size_t i = 0; i < file_header->NumberOfSections; i++)
-		{
-			if (!strcmp((char*)section_header[i].Name, ".text"))
-			{
-				trampoline_ptr = ((beep + section_header[i].VirtualAddress) + section_header[i].Misc.VirtualSize);
-			}
-		}
-		return trampoline_ptr;
-	}
-
 	auto create_thread_routine() -> NTSTATUS
 	{
-		auto trampoline_ptr = get_beep_trampoline_ptr();
+		auto trampoline_ptr = utils::get_beep_trampoline_ptr();
 		if (trampoline_ptr)
 		{
 			char jmprax[] = { 0x48, 0xB8, 0xA0, 0x9A, 0xD5, 0x3E, 0xFE, 0x7F, 0x00, 0x00, 0xFF, 0xE0 };
@@ -92,8 +74,8 @@ namespace thread_notify_routine
 
 	auto unload_thread_routine() -> NTSTATUS
 	{
-		auto trampoline_ptr = get_beep_trampoline_ptr();
+		//auto trampoline_ptr = utils::get_beep_trampoline_ptr();
-		return PsRemoveCreateThreadNotifyRoutine((PCREATE_PROCESS_NOTIFY_ROUTINE)trampoline_ptr);
+		return PsRemoveCreateThreadNotifyRoutine(thread_notify_routine);
 	}
 
 

Anti-Cheat_Driver/driver_main.cpp

@@ -1,32 +1,27 @@
 #include "ob_reg_callback.h"
-#include "anit_screen_grap.h"
 #include "create_thread_callback.h"
-#include "load_Image_callback.h"
 #include "protect_filter.h"
-#include "process_func.h"
+#include "comm.h"
-#include "kernel_function.h"
+
+
 EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING)
 {
 	if (drv_obj)
 	{
 		drv_obj->DriverUnload = [](PDRIVER_OBJECT)
 		{
+			kernel_comm_create::remove();
 			ob_call_back::uninstall_ob_callback();
-			thread_notify_routine::unload_thread_routine();
+			//DbgPrintEx(77,0,"%x\n", thread_notify_routine::unload_thread_routine());
-			//load_image_notify_routine::remove_image_load_notify_routine();
 		};
 	}
 
-
 	kernel_api::kernel_api_init();
 	protect_filter::Init();
+	kernel_comm_create::Init();
 
-	protect_filter::add_list(10492, 0);
 	DbgPrintEx(77, 0, "[+]ob_reg_callback status:%x\n", ob_call_back::register_ob_reg_callback());
-	DbgPrintEx(77, 0, "[+]create_thread_routine status:%x\n", thread_notify_routine::create_thread_routine());
+	//DbgPrintEx(77, 0, "[+]create_thread_routine status:%x\n", thread_notify_routine::create_thread_routine());
-	
+
-	//NtQueryVirtualMemory
-	//load_image_notify_routine::create_image_load_notify_routine();
-	
 	return STATUS_SUCCESS;
 }