From 93417ef72802c689b4bb57835c08420906a1233e Mon Sep 17 00:00:00 2001
From: maowenrui <3505719167@qq.com>
Date: Mon, 1 Jun 2026 09:20:02 +0800
Subject: [PATCH] feat image load

---
 Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj   |  2 ++
 .../Anti-Cheat_Driver.vcxproj.filters         |  6 ++++
 Anti-Cheat_Driver/create_thread_callback.cpp  | 14 ++++++---
 Anti-Cheat_Driver/driver_main.cpp             |  5 ++++
 Anti-Cheat_Driver/load_Image_callback.cpp     | 30 +++++++++++++++++++
 Anti-Cheat_Driver/load_Image_callback.h       | 11 +++++++
 6 files changed, 64 insertions(+), 4 deletions(-)
 create mode 100644 Anti-Cheat_Driver/load_Image_callback.cpp
 create mode 100644 Anti-Cheat_Driver/load_Image_callback.h

diff --git a/Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj b/Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj
index bc97148..95ac8ca 100644
--- a/Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj
+++ b/Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj
@@ -147,6 +147,7 @@
     <ClCompile Include="io_ctl.cpp" />
     <ClCompile Include="kernel_api.cpp" />
     <ClCompile Include="kernel_function.cpp" />
+    <ClCompile Include="load_Image_callback.cpp" />
     <ClCompile Include="ob_reg_callback.cpp" />
     <ClCompile Include="utils.cpp" />
   </ItemGroup>
@@ -157,6 +158,7 @@
     <ClInclude Include="io_ctl.h" />
     <ClInclude Include="kernel_api.h" />
     <ClInclude Include="kernel_function.h" />
+    <ClInclude Include="load_Image_callback.h" />
     <ClInclude Include="ob_reg_callback.h" />
     <ClInclude Include="utils.h" />
   </ItemGroup>
diff --git a/Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj.filters b/Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj.filters
index e203ec0..191f3f8 100644
--- a/Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj.filters
+++ b/Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj.filters
@@ -61,6 +61,9 @@
     <ClCompile Include="create_thread_callback.cpp">
       <Filter>kernel_callback</Filter>
     </ClCompile>
+    <ClCompile Include="load_Image_callback.cpp">
+      <Filter>kernel_callback</Filter>
+    </ClCompile>
   </ItemGroup>
   <ItemGroup>
     <ClInclude Include="Base.h">
@@ -87,5 +90,8 @@
     <ClInclude Include="create_thread_callback.h">
       <Filter>kernel_callback</Filter>
     </ClInclude>
+    <ClInclude Include="load_Image_callback.h">
+      <Filter>kernel_callback</Filter>
+    </ClInclude>
   </ItemGroup>
 </Project>
\ No newline at end of file
diff --git a/Anti-Cheat_Driver/create_thread_callback.cpp b/Anti-Cheat_Driver/create_thread_callback.cpp
index ecb121f..e746e10 100644
--- a/Anti-Cheat_Driver/create_thread_callback.cpp
+++ b/Anti-Cheat_Driver/create_thread_callback.cpp
@@ -7,7 +7,7 @@
 namespace thread_notify_routine
 {
 	//保护的进程ID
-	auto protect_id = ULongToHandle(3460);
+	auto protect_id = ULongToHandle(8976);
 
 
 	void thread_notify_routine(HANDLE ProcessId, HANDLE ThreadId, BOOLEAN Create)
@@ -28,12 +28,18 @@ namespace thread_notify_routine
 				goto end;
 
 			auto cutor_process_id = PsGetCurrentProcessId();
+			if (HandleToLong(cutor_process_id) == 4)
+				goto end;
+
 			if (ProcessId != cutor_process_id)
 			{
 				DbgPrintEx(77, 0, "[!] 恶意远程线程检测！\n");
-				DbgPrintEx(77, 0, "[!] 目标进程: %d\n", ProcessId);
-				DbgPrintEx(77, 0, "[!] 被创建线程: %d\n", ThreadId);
-				DbgPrintEx(77, 0, "[!] 创建者进程: %d\n", cutor_process_id);
+
+				DbgPrintEx(77, 0, "[!] 目标进程ID: %d\n", ProcessId);
+
+				DbgPrintEx(77, 0, "[!] 创建者进程ID: %d\n", cutor_process_id);
+
+				DbgPrintEx(77, 0, "[!] 被创建线程ID: %d\n", ThreadId);
 			}
 
 
diff --git a/Anti-Cheat_Driver/driver_main.cpp b/Anti-Cheat_Driver/driver_main.cpp
index 730a4e3..10a2c37 100644
--- a/Anti-Cheat_Driver/driver_main.cpp
+++ b/Anti-Cheat_Driver/driver_main.cpp
@@ -1,6 +1,7 @@
 #include "ob_reg_callback.h"
 #include "anit_screen_grap.h"
 #include "create_thread_callback.h"
+#include "load_Image_callback.h"
 
 EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING)
 {
@@ -8,11 +9,15 @@ EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING)
 	{
 		ob_call_back::uninstall_ob_callback();
 		thread_notify_routine::unload_thread_routine();
+		load_image_notify_routine::remove_image_load_notify_routine();
 	};
 
 	kernel_api::kernel_api_init();
+
 	thread_notify_routine::create_thread_routine();
 	ob_call_back::register_ob_reg_callback();
+	load_image_notify_routine::create_image_load_notify_routine();
+	
 
 	
 	return STATUS_SUCCESS;
diff --git a/Anti-Cheat_Driver/load_Image_callback.cpp b/Anti-Cheat_Driver/load_Image_callback.cpp
new file mode 100644
index 0000000..6250e2e
--- /dev/null
+++ b/Anti-Cheat_Driver/load_Image_callback.cpp
@@ -0,0 +1,30 @@
+#include "load_Image_callback.h"
+
+namespace load_image_notify_routine
+{
+	VOID load_image_notify_routine(
+		PUNICODE_STRING FullImageName,
+		HANDLE ProcessId,
+		PIMAGE_INFO ImageInfo
+	)
+	{	
+		UNREFERENCED_PARAMETER(ProcessId);
+		UNREFERENCED_PARAMETER(ImageInfo);
+
+		if(FullImageName->Buffer)
+			DbgPrintEx(77, 0, "[+] %ws\n", FullImageName->Buffer);
+		
+	}
+
+
+
+	auto create_image_load_notify_routine() -> NTSTATUS
+	{
+		return PsSetLoadImageNotifyRoutine(load_image_notify_routine);
+	}
+	auto remove_image_load_notify_routine() -> NTSTATUS
+	{
+		return PsRemoveLoadImageNotifyRoutine(load_image_notify_routine);
+	}
+}
+
diff --git a/Anti-Cheat_Driver/load_Image_callback.h b/Anti-Cheat_Driver/load_Image_callback.h
new file mode 100644
index 0000000..f4d330a
--- /dev/null
+++ b/Anti-Cheat_Driver/load_Image_callback.h
@@ -0,0 +1,11 @@
+#pragma once
+#include "Base.h"
+
+namespace load_image_notify_routine
+{
+	auto create_image_load_notify_routine() -> NTSTATUS;
+
+	auto remove_image_load_notify_routine() -> NTSTATUS;
+
+
+}
\ No newline at end of file