maowengrui/anit-cheat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

style

Browse Source
This commit is contained in:
maowenrui
2026-06-16 10:24:37 +08:00
parent 70d9a8d4cd
commit 91bd5436f6
4 changed files with 47 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj
+8
View File
@@ -146,6 +146,10 @@
</ItemGroup>
<ItemGroup>
<ClCompile Include="anit_screen_grap.cpp" />
<ClCompile Include="comm.cpp" />
<ClCompile Include="comm_dispatch.cpp" />
<ClCompile Include="comm_win10.cpp" />
<ClCompile Include="comm_win7.cpp" />
<ClCompile Include="create_thread_callback.cpp" />
<ClCompile Include="driver_main.cpp" />
<ClCompile Include="io_ctl.cpp" />
@@ -160,6 +164,10 @@
<ItemGroup>
<ClInclude Include="anit_screen_grap.h" />
<ClInclude Include="Base.h" />
<ClInclude Include="comm.h" />
<ClInclude Include="comm_dispatch.h" />
<ClInclude Include="comm_win10.h" />
<ClInclude Include="comm_win7.h" />
<ClInclude Include="create_thread_callback.h" />
<ClInclude Include="io_ctl.h" />
<ClInclude Include="kernel_api.h" />
Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj.filters
+27
View File
@@ -38,6 +38,9 @@
<Filter Include="process_function">
<UniqueIdentifier>{e30d7c3e-b37a-4d86-9561-383f1b377fba}</UniqueIdentifier>
</Filter>
<Filter Include="comm">
<UniqueIdentifier>{39d8ef92-d541-4aee-9850-0a3d878333dc}</UniqueIdentifier>
</Filter>
</ItemGroup>
<ItemGroup>
<ClCompile Include="driver_main.cpp">
@@ -73,6 +76,18 @@
<ClCompile Include="process_func.cpp">
<Filter>process_function</Filter>
</ClCompile>
<ClCompile Include="comm_win7.cpp">
<Filter>comm</Filter>
</ClCompile>
<ClCompile Include="comm_win10.cpp">
<Filter>comm</Filter>
</ClCompile>
<ClCompile Include="comm_dispatch.cpp">
<Filter>comm</Filter>
</ClCompile>
<ClCompile Include="comm.cpp">
<Filter>comm</Filter>
</ClCompile>
</ItemGroup>
<ItemGroup>
<ClInclude Include="Base.h">
@@ -108,5 +123,17 @@
<ClInclude Include="process_func.h">
<Filter>process_function</Filter>
</ClInclude>
<ClInclude Include="comm_win7.h">
<Filter>comm</Filter>
</ClInclude>
<ClInclude Include="comm_win10.h">
<Filter>comm</Filter>
</ClInclude>
<ClInclude Include="comm_dispatch.h">
<Filter>comm</Filter>
</ClInclude>
<ClInclude Include="comm.h">
<Filter>comm</Filter>
</ClInclude>
</ItemGroup>
</Project>
Anti-Cheat_Driver/create_thread_callback.cpp
+4 -22
View File
@@ -1,6 +1,7 @@
#include "create_thread_callback.h"
#include "protect_filter.h"
#include "kernel_function.h"
#include "utils.h"
#pragma warning(disable : 4309)
#pragma warning(disable : 4838)
@@ -53,28 +54,9 @@ namespace thread_notify_routine
}
}
auto get_beep_trampoline_ptr() -> uintptr_t
{
uintptr_t trampoline_ptr = NULL;
auto beep = kernel_function::GetKernelModule("beep.sys");
auto nt_header = reinterpret_cast<PIMAGE_NT_HEADERS>(beep + reinterpret_cast<PIMAGE_DOS_HEADER>(beep)->e_lfanew);
auto file_header = &nt_header->FileHeader;
auto section_header = IMAGE_FIRST_SECTION(nt_header);
for (size_t i = 0; i < file_header->NumberOfSections; i++)
{
if (!strcmp((char*)section_header[i].Name, ".text"))
{
trampoline_ptr = ((beep + section_header[i].VirtualAddress) + section_header[i].Misc.VirtualSize);
}
}
return trampoline_ptr;
}
auto create_thread_routine() -> NTSTATUS
{
auto trampoline_ptr = get_beep_trampoline_ptr();
auto trampoline_ptr = utils::get_beep_trampoline_ptr();
if (trampoline_ptr)
{
char jmprax[] = { 0x48, 0xB8, 0xA0, 0x9A, 0xD5, 0x3E, 0xFE, 0x7F, 0x00, 0x00, 0xFF, 0xE0 };
@@ -92,8 +74,8 @@ namespace thread_notify_routine
auto unload_thread_routine() -> NTSTATUS
{
auto trampoline_ptr = get_beep_trampoline_ptr();
return PsRemoveCreateThreadNotifyRoutine((PCREATE_PROCESS_NOTIFY_ROUTINE)trampoline_ptr);
//auto trampoline_ptr = utils::get_beep_trampoline_ptr();
return PsRemoveCreateThreadNotifyRoutine(thread_notify_routine);
}
Anti-Cheat_Driver/driver_main.cpp
+7 -12
View File
@@ -1,32 +1,27 @@
#include "ob_reg_callback.h"
#include "anit_screen_grap.h"
#include "create_thread_callback.h"
#include "load_Image_callback.h"
#include "protect_filter.h"
#include "process_func.h"
#include "kernel_function.h"
#include "comm.h"
EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING)
{
if (drv_obj)
{
drv_obj->DriverUnload = [](PDRIVER_OBJECT)
{
kernel_comm_create::remove();
ob_call_back::uninstall_ob_callback();
thread_notify_routine::unload_thread_routine();
//load_image_notify_routine::remove_image_load_notify_routine();
//DbgPrintEx(77,0,"%x\n", thread_notify_routine::unload_thread_routine());
};
}
kernel_api::kernel_api_init();
protect_filter::Init();
kernel_comm_create::Init();
protect_filter::add_list(10492, 0);
DbgPrintEx(77, 0, "[+]ob_reg_callback status:%x\n", ob_call_back::register_ob_reg_callback());
DbgPrintEx(77, 0, "[+]create_thread_routine status:%x\n", thread_notify_routine::create_thread_routine());
//NtQueryVirtualMemory
//load_image_notify_routine::create_image_load_notify_routine();
//DbgPrintEx(77, 0, "[+]create_thread_routine status:%x\n", thread_notify_routine::create_thread_routine());
return STATUS_SUCCESS;
}