feat image load

Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj

@@ -147,6 +147,7 @@
     <ClCompile Include="io_ctl.cpp" />
     <ClCompile Include="kernel_api.cpp" />
     <ClCompile Include="kernel_function.cpp" />
+    <ClCompile Include="load_Image_callback.cpp" />
     <ClCompile Include="ob_reg_callback.cpp" />
     <ClCompile Include="utils.cpp" />
   </ItemGroup>
@@ -157,6 +158,7 @@
     <ClInclude Include="io_ctl.h" />
     <ClInclude Include="kernel_api.h" />
     <ClInclude Include="kernel_function.h" />
+    <ClInclude Include="load_Image_callback.h" />
     <ClInclude Include="ob_reg_callback.h" />
     <ClInclude Include="utils.h" />
   </ItemGroup>

Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj.filters

@@ -61,6 +61,9 @@
     <ClCompile Include="create_thread_callback.cpp">
       <Filter>kernel_callback</Filter>
     </ClCompile>
+    <ClCompile Include="load_Image_callback.cpp">
+      <Filter>kernel_callback</Filter>
+    </ClCompile>
   </ItemGroup>
   <ItemGroup>
     <ClInclude Include="Base.h">
@@ -87,5 +90,8 @@
     <ClInclude Include="create_thread_callback.h">
       <Filter>kernel_callback</Filter>
     </ClInclude>
+    <ClInclude Include="load_Image_callback.h">
+      <Filter>kernel_callback</Filter>
+    </ClInclude>
   </ItemGroup>
 </Project>

Anti-Cheat_Driver/create_thread_callback.cpp

@@ -7,7 +7,7 @@
 namespace thread_notify_routine
 {
 	//保护的进程ID
-	auto protect_id = ULongToHandle(3460);
+	auto protect_id = ULongToHandle(8976);
 
 
 	void thread_notify_routine(HANDLE ProcessId, HANDLE ThreadId, BOOLEAN Create)
@@ -28,12 +28,18 @@ namespace thread_notify_routine
 				goto end;
 
 			auto cutor_process_id = PsGetCurrentProcessId();
+			if (HandleToLong(cutor_process_id) == 4)
+				goto end;
+
 			if (ProcessId != cutor_process_id)
 			{
 				DbgPrintEx(77, 0, "[!] 恶意远程线程检测！\n");
-				DbgPrintEx(77, 0, "[!] 目标进程: %d\n", ProcessId);
+
-				DbgPrintEx(77, 0, "[!] 被创建线程: %d\n", ThreadId);
+				DbgPrintEx(77, 0, "[!] 目标进程ID: %d\n", ProcessId);
-				DbgPrintEx(77, 0, "[!] 创建者进程: %d\n", cutor_process_id);
+
+				DbgPrintEx(77, 0, "[!] 创建者进程ID: %d\n", cutor_process_id);
+
+				DbgPrintEx(77, 0, "[!] 被创建线程ID: %d\n", ThreadId);
 			}
 
 

Anti-Cheat_Driver/driver_main.cpp

@@ -1,6 +1,7 @@
 #include "ob_reg_callback.h"
 #include "anit_screen_grap.h"
 #include "create_thread_callback.h"
+#include "load_Image_callback.h"
 
 EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING)
 {
@@ -8,11 +9,15 @@ EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING)
 	{
 		ob_call_back::uninstall_ob_callback();
 		thread_notify_routine::unload_thread_routine();
+		load_image_notify_routine::remove_image_load_notify_routine();
 	};
 
 	kernel_api::kernel_api_init();
+
 	thread_notify_routine::create_thread_routine();
 	ob_call_back::register_ob_reg_callback();
+	load_image_notify_routine::create_image_load_notify_routine();
+	
 
 	
 	return STATUS_SUCCESS;

Anti-Cheat_Driver/load_Image_callback.cpp

@@ -0,0 +1,30 @@
+#include "load_Image_callback.h"
+
+namespace load_image_notify_routine
+{
+	VOID load_image_notify_routine(
+		PUNICODE_STRING FullImageName,
+		HANDLE ProcessId,
+		PIMAGE_INFO ImageInfo
+	)
+	{	
+		UNREFERENCED_PARAMETER(ProcessId);
+		UNREFERENCED_PARAMETER(ImageInfo);
+
+		if(FullImageName->Buffer)
+			DbgPrintEx(77, 0, "[+] %ws\n", FullImageName->Buffer);
+		
+	}
+
+
+
+	auto create_image_load_notify_routine() -> NTSTATUS
+	{
+		return PsSetLoadImageNotifyRoutine(load_image_notify_routine);
+	}
+	auto remove_image_load_notify_routine() -> NTSTATUS
+	{
+		return PsRemoveLoadImageNotifyRoutine(load_image_notify_routine);
+	}
+}
+

Anti-Cheat_Driver/load_Image_callback.h

@@ -0,0 +1,11 @@
+#pragma once
+#include "Base.h"
+
+namespace load_image_notify_routine
+{
+	auto create_image_load_notify_routine() -> NTSTATUS;
+
+	auto remove_image_load_notify_routine() -> NTSTATUS;
+
+
+}