From 9b00c5f6eb35ae16971878ecd25abd0b6098c292 Mon Sep 17 00:00:00 2001 From: maowenrui <3505719167@qq.com> Date: Tue, 28 Jul 2026 15:11:25 +0800 Subject: [PATCH] init --- Anti-Cheat_Driver.sln | 28 ++++++ Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj | 9 +- Anti-Cheat_Driver/comm_dispatch.cpp | 46 +++++++++ Anti-Cheat_Driver/comm_dispatch.h | 6 ++ Anti-Cheat_Driver/create_thread_callback.cpp | 28 +++--- Anti-Cheat_Driver/create_thread_callback.h | 4 + Anti-Cheat_Driver/driver_main.cpp | 13 ++- Anti-Cheat_Driver/kernel_api.cpp | 8 ++ Anti-Cheat_Driver/kernel_api.h | 11 +++ Anti-Cheat_Driver/mouse_key_win10.cpp | 2 +- Anti-Cheat_Driver/mouse_key_win7.cpp | 2 +- Anti-Cheat_Driver/mouse_keybord_hook.cpp | 30 +++--- Anti-Cheat_Driver/ob_reg_callback.cpp | 2 +- Anti-Cheat_Driver/process_notify_callback.cpp | 14 +-- Anti-Cheat_Driver/protect_filter.cpp | 93 +++++++++++++------ Anti-Cheat_Driver/protect_filter.h | 10 +- 16 files changed, 233 insertions(+), 73 deletions(-) diff --git a/Anti-Cheat_Driver.sln b/Anti-Cheat_Driver.sln index d9d0768..751814f 100644 --- a/Anti-Cheat_Driver.sln +++ b/Anti-Cheat_Driver.sln @@ -5,6 +5,10 @@ VisualStudioVersion = 16.0.37206.5 MinimumVisualStudioVersion = 10.0.40219.1 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Anti-Cheat_Driver", "Anti-Cheat_Driver\Anti-Cheat_Driver.vcxproj", "{E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}" EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Anit-Cheat_EXE", "Anit-Cheat_EXE\Anit-Cheat_EXE.vcxproj", "{17DDE567-4EAA-4E85-B533-02C4E6451072}" +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Anit-Cheat_DLL", "Anit-Cheat_DLL\Anit-Cheat_DLL.vcxproj", "{5CABFAE0-D81B-47A9-A7BA-BC7510BE19DF}" +EndProject Global GlobalSection(SolutionConfigurationPlatforms) = preSolution Debug|ARM = Debug|ARM @@ -41,6 +45,30 @@ Global {E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Release|x86.ActiveCfg = Release|Win32 {E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Release|x86.Build.0 = Release|Win32 {E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Release|x86.Deploy.0 = Release|Win32 + {17DDE567-4EAA-4E85-B533-02C4E6451072}.Debug|ARM.ActiveCfg = Debug|Win32 + {17DDE567-4EAA-4E85-B533-02C4E6451072}.Debug|ARM64.ActiveCfg = Debug|Win32 + {17DDE567-4EAA-4E85-B533-02C4E6451072}.Debug|x64.ActiveCfg = Debug|x64 + {17DDE567-4EAA-4E85-B533-02C4E6451072}.Debug|x64.Build.0 = Debug|x64 + {17DDE567-4EAA-4E85-B533-02C4E6451072}.Debug|x86.ActiveCfg = Debug|Win32 + {17DDE567-4EAA-4E85-B533-02C4E6451072}.Debug|x86.Build.0 = Debug|Win32 + {17DDE567-4EAA-4E85-B533-02C4E6451072}.Release|ARM.ActiveCfg = Release|Win32 + {17DDE567-4EAA-4E85-B533-02C4E6451072}.Release|ARM64.ActiveCfg = Release|Win32 + {17DDE567-4EAA-4E85-B533-02C4E6451072}.Release|x64.ActiveCfg = Release|x64 + {17DDE567-4EAA-4E85-B533-02C4E6451072}.Release|x64.Build.0 = Release|x64 + {17DDE567-4EAA-4E85-B533-02C4E6451072}.Release|x86.ActiveCfg = Release|Win32 + {17DDE567-4EAA-4E85-B533-02C4E6451072}.Release|x86.Build.0 = Release|Win32 + {5CABFAE0-D81B-47A9-A7BA-BC7510BE19DF}.Debug|ARM.ActiveCfg = Debug|Win32 + {5CABFAE0-D81B-47A9-A7BA-BC7510BE19DF}.Debug|ARM64.ActiveCfg = Debug|Win32 + {5CABFAE0-D81B-47A9-A7BA-BC7510BE19DF}.Debug|x64.ActiveCfg = Debug|x64 + {5CABFAE0-D81B-47A9-A7BA-BC7510BE19DF}.Debug|x64.Build.0 = Debug|x64 + {5CABFAE0-D81B-47A9-A7BA-BC7510BE19DF}.Debug|x86.ActiveCfg = Debug|Win32 + {5CABFAE0-D81B-47A9-A7BA-BC7510BE19DF}.Debug|x86.Build.0 = Debug|Win32 + {5CABFAE0-D81B-47A9-A7BA-BC7510BE19DF}.Release|ARM.ActiveCfg = Release|Win32 + {5CABFAE0-D81B-47A9-A7BA-BC7510BE19DF}.Release|ARM64.ActiveCfg = Release|Win32 + {5CABFAE0-D81B-47A9-A7BA-BC7510BE19DF}.Release|x64.ActiveCfg = Release|x64 + {5CABFAE0-D81B-47A9-A7BA-BC7510BE19DF}.Release|x64.Build.0 = Release|x64 + {5CABFAE0-D81B-47A9-A7BA-BC7510BE19DF}.Release|x86.ActiveCfg = Release|Win32 + {5CABFAE0-D81B-47A9-A7BA-BC7510BE19DF}.Release|x86.Build.0 = Release|Win32 EndGlobalSection GlobalSection(SolutionProperties) = preSolution HideSolutionNode = FALSE diff --git a/Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj b/Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj index bfd8978..3326583 100644 --- a/Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj +++ b/Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj @@ -42,6 +42,7 @@ Debug Win32 Anti_Cheat_Driver + $(LatestTargetPlatformVersion) @@ -71,7 +72,7 @@ WindowsKernelModeDriver10.0 Driver WDM - Spectre + false Windows10 @@ -114,12 +115,18 @@ DbgengKernelDebugger + $(TargetName.Replace(' ','')) + $(SolutionDir)Bin\$(Platform)\ + $(Platform)\ DbgengKernelDebugger DbgengKernelDebugger + Anti_Cheat_Driver + $(SolutionDir)Bin\$(Platform)\ + $(Platform)\ DbgengKernelDebugger diff --git a/Anti-Cheat_Driver/comm_dispatch.cpp b/Anti-Cheat_Driver/comm_dispatch.cpp index bbf9123..f59fd2f 100644 --- a/Anti-Cheat_Driver/comm_dispatch.cpp +++ b/Anti-Cheat_Driver/comm_dispatch.cpp @@ -1,11 +1,15 @@ #include "comm_dispatch.h" #include "protect_filter.h" #include "anit_screen_grap.h" +#include "create_thread_callback.h" +#include "mouse_keybord_hook.h" + namespace comm_dispatch { auto dispatch(CMD_COMM* data) -> NTSTATUS { auto status = STATUS_UNSUCCESSFUL; + switch (data->CommID) { case CMD::DRIVER_COMM_TEST: @@ -19,6 +23,12 @@ namespace comm_dispatch status = protect_filter::add_protect_list((ULONG)process_data->Pid, NULL, FALSE); break; } + case CMD::DRIVER_CANCEL_PROTECT_PROCESS: + { + auto process_data = (IOCTL_PROCESS*)data->Buf; + status = protect_filter::remove_protect_list((ULONG)process_data->Pid, NULL); + break; + } case CMD::ADD_WHITE_PROCESS: { auto process_data = (IOCTL_PROCESS*)data->Buf; @@ -34,6 +44,42 @@ namespace comm_dispatch break; } + case CMD::USER_EVENT_HANDLE: + { + auto user_handle = (HANDLE*)data->Buf; + + status = ObReferenceObjectByHandle( + *user_handle, + EVENT_MODIFY_STATE, + *ExEventObjectType, + UserMode, + (PVOID*)&thread_notify_routine::g_UserEvent, + NULL); + + + DbgPrintEx(77, 0, "ObReferenceObjectByHandle[status]:%x\n", status); + DbgPrintEx(77, 0, "g_UserEvent:%p\n", thread_notify_routine::g_UserEvent); + + + break; + } + case CMD::PROTECT_THREAD_CONTRL: + { + auto process_data = (IOCTL_PROCESS*)data->Buf; + thread_notify_routine::g_thread_protect = process_data->is_no_create_remote_thread; + status = STATUS_SUCCESS; + break; + } + case CMD::INSTALL_MOUSE_KEYBOARD: + { + status = mouse_keybord_hook::install_mouse_keybord_hook(); + break; + } + case CMD::UNLOAD_MOUSE_KEYBOARD: + { + status = mouse_keybord_hook::remove_mouse_keybord_hook(); + break; + } default: break; } diff --git a/Anti-Cheat_Driver/comm_dispatch.h b/Anti-Cheat_Driver/comm_dispatch.h index f6593b1..ec0d79a 100644 --- a/Anti-Cheat_Driver/comm_dispatch.h +++ b/Anti-Cheat_Driver/comm_dispatch.h @@ -11,6 +11,7 @@ struct CMD_COMM struct IOCTL_PROCESS { DWORD64 Pid; + BOOL is_no_create_remote_thread; }; struct IOCTL_WINDOW @@ -23,8 +24,13 @@ enum CMD MSG_BASE = 0x10000, DRIVER_COMM_TEST, DRIVER_PROTECT_PROCESS, + DRIVER_CANCEL_PROTECT_PROCESS, ADD_WHITE_PROCESS, WINDOW_ANIT_SCREEN, + USER_EVENT_HANDLE, + PROTECT_THREAD_CONTRL, + INSTALL_MOUSE_KEYBOARD, + UNLOAD_MOUSE_KEYBOARD, }; namespace comm_dispatch diff --git a/Anti-Cheat_Driver/create_thread_callback.cpp b/Anti-Cheat_Driver/create_thread_callback.cpp index 332779d..23868f8 100644 --- a/Anti-Cheat_Driver/create_thread_callback.cpp +++ b/Anti-Cheat_Driver/create_thread_callback.cpp @@ -15,9 +15,10 @@ EXTERN_C NTKERNELAPI NTSTATUS ZwOpenThread( _In_ PCLIENT_ID ClientId ); - namespace thread_notify_routine { + PKEVENT g_UserEvent = NULL; // 用户态传入的事件对象 + BOOL g_thread_protect; // 打开线程句柄并终止 NTSTATUS TerminateThreadByHandle( @@ -69,7 +70,6 @@ namespace thread_notify_routine { if (Create) { - PEPROCESS process{ 0 }; auto status = PsLookupProcessByProcessId(ProcessId, &process); if (!NT_SUCCESS(status)) @@ -80,7 +80,7 @@ namespace thread_notify_routine if (!NT_SUCCESS(status)) goto end;*/ - if(!protect_filter::is_protect_pid(0, process)) + if (!protect_filter::is_protect_pid(HandleToLong(ProcessId))) goto end; /*if (protect_process != process) @@ -94,17 +94,19 @@ namespace thread_notify_routine { //DbgBreakPoint(); - DbgPrintEx(77, 0, "[!] 恶意远程线程检测！\n"); + //DbgPrintEx(77, 0, "[!] 恶意远程线程检测！\n"); + // + //DbgPrintEx(77, 0, "[!] 目标进程ID: %d\n", ProcessId); + // + //DbgPrintEx(77, 0, "[!] 创建者进程ID: %d\n", cutor_process_id); + // + //DbgPrintEx(77, 0, "[!] 被创建线程ID: %d\n", ThreadId); - DbgPrintEx(77, 0, "[!] 目标进程ID: %d\n", ProcessId); - - DbgPrintEx(77, 0, "[!] 创建者进程ID: %d\n", cutor_process_id); - - DbgPrintEx(77, 0, "[!] 被创建线程ID: %d\n", ThreadId); - - - TerminateThreadByHandle(ProcessId, ThreadId); - + if (g_thread_protect) + { + TerminateThreadByHandle(ProcessId, ThreadId); + } + //KeSetEvent(g_UserEvent, IO_NO_INCREMENT, FALSE); } end: ObDereferenceObject(process); diff --git a/Anti-Cheat_Driver/create_thread_callback.h b/Anti-Cheat_Driver/create_thread_callback.h index 11d4355..bb04fbf 100644 --- a/Anti-Cheat_Driver/create_thread_callback.h +++ b/Anti-Cheat_Driver/create_thread_callback.h @@ -3,9 +3,13 @@ namespace thread_notify_routine { + extern BOOL g_thread_protect; + + extern PKEVENT g_UserEvent; auto create_thread_routine()->NTSTATUS; auto unload_thread_routine()->NTSTATUS; + } \ No newline at end of file diff --git a/Anti-Cheat_Driver/driver_main.cpp b/Anti-Cheat_Driver/driver_main.cpp index 84f52f4..cf54a55 100644 --- a/Anti-Cheat_Driver/driver_main.cpp +++ b/Anti-Cheat_Driver/driver_main.cpp @@ -20,8 +20,6 @@ EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING) process_notify_callback::remov_process_notify(); thread_notify_routine::unload_thread_routine(); - mouse_keybord_hook::remove_mouse_keybord_hook(); - //load_image_notify_routine::remove_image_load_notify_routine(); }; } @@ -30,15 +28,16 @@ EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING) kernel_api::kernel_api_init(); kernel_comm_create::Init(); - protect_filter::add_protect_list(3632, 0, FALSE); + //把保护的进程插入到链表中 + //protect_filter::add_protect_list(12204, 0, FALSE); - - mouse_keybord_hook::install_mouse_keybord_hook(); - //DbgPrintEx(77, 0, "[+]ob_reg_callback status:%x\n", ob_call_back::register_ob_reg_callback()); + //mouse_keybord_hook::install_mouse_keybord_hook(); + DbgPrintEx(77, 0, "[+]ob_reg_callback status:%x\n", ob_call_back::register_ob_reg_callback()); DbgPrintEx(77, 0, "[+]process_notify_callback status:%x\n", process_notify_callback::install_process_notify()); DbgPrintEx(77, 0, "[+]create_thread_routine status:%x\n", thread_notify_routine::create_thread_routine()); - //load_image_notify_routine::create_image_load_notify_routine(); + //我过滤了那个任务管理器 所以看不了结束进程效果 直接看能不能读搜索就行了 没有图标吧 + //也搜索不了 我这个就是内存加载 也不会蓝屏啊 return STATUS_SUCCESS; } \ No newline at end of file diff --git a/Anti-Cheat_Driver/kernel_api.cpp b/Anti-Cheat_Driver/kernel_api.cpp index 8501830..0590162 100644 --- a/Anti-Cheat_Driver/kernel_api.cpp +++ b/Anti-Cheat_Driver/kernel_api.cpp @@ -25,6 +25,9 @@ namespace kernel_api RtlInitUnicodeString(&unFuncName, L"ZwOpenThread"); imported.nt_open_thread = (ULONG64)MmGetSystemRoutineAddress(&unFuncName); + + RtlInitUnicodeString(&unFuncName, L"ObOpenObjectByName"); + imported.ob_open_object_by_name = (ULONG64)MmGetSystemRoutineAddress(&unFuncName); } NTSTATUS ntquerysysteminformation(ULONG SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength) @@ -60,5 +63,10 @@ namespace kernel_api return reinterpret_cast(imported.nt_open_thread) (ThreadHandle, DesiredAccess, ObjectAttributes, ClientId); } + NTSTATUS obopenobjectbyname(POBJECT_ATTRIBUTES ObjectAttributes, POBJECT_TYPE ObjectType, KPROCESSOR_MODE AccessMode, PACCESS_STATE AccessState, ACCESS_MASK DesiredAccess, PVOID ParseContext, PHANDLE Handle) + { + return reinterpret_cast + (imported.ob_open_object_by_name)(ObjectAttributes, ObjectType, AccessMode, AccessState, DesiredAccess, ParseContext, Handle); + } } \ No newline at end of file diff --git a/Anti-Cheat_Driver/kernel_api.h b/Anti-Cheat_Driver/kernel_api.h index e342a80..dad09b7 100644 --- a/Anti-Cheat_Driver/kernel_api.h +++ b/Anti-Cheat_Driver/kernel_api.h @@ -20,6 +20,7 @@ struct imported_ ULONG64 ps_getprocess_id; ULONG64 se_locateprocess_imagename; ULONG64 nt_open_thread; + ULONG64 ob_open_object_by_name; }; namespace kernel_api @@ -42,4 +43,14 @@ namespace kernel_api PVOID rtlfindexportedroutinebyname(PVOID ImageBase, PCCH RoutineName); NTSTATUS ntopenthread(PHANDLE ThreadHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId); + + NTSTATUS obopenobjectbyname( + POBJECT_ATTRIBUTES ObjectAttributes, + POBJECT_TYPE ObjectType, + KPROCESSOR_MODE AccessMode, + PACCESS_STATE AccessState, + ACCESS_MASK DesiredAccess, + PVOID ParseContext, + PHANDLE Handle + ); } \ No newline at end of file diff --git a/Anti-Cheat_Driver/mouse_key_win10.cpp b/Anti-Cheat_Driver/mouse_key_win10.cpp index 667d0e3..ed38e37 100644 --- a/Anti-Cheat_Driver/mouse_key_win10.cpp +++ b/Anti-Cheat_Driver/mouse_key_win10.cpp @@ -9,7 +9,7 @@ namespace mouse_key_win10 __int64 __fastcall hkNtUserSendInput(unsigned int a1, volatile void* a2, int a3, int a4) { auto pid = PsGetCurrentProcessId(); - if (protect_filter::is_white_pid(HandleToLong(pid), NULL)) + if (protect_filter::is_white_pid(HandleToLong(pid))) return origon_NtUserSendInput_win10(a1, a2, a3, a4); diff --git a/Anti-Cheat_Driver/mouse_key_win7.cpp b/Anti-Cheat_Driver/mouse_key_win7.cpp index 1b5519f..9a07de5 100644 --- a/Anti-Cheat_Driver/mouse_key_win7.cpp +++ b/Anti-Cheat_Driver/mouse_key_win7.cpp @@ -8,7 +8,7 @@ namespace mouse_key_win7 { auto pid = PsGetCurrentProcessId(); - if(protect_filter::is_white_pid(HandleToLong(pid), NULL)) + if(protect_filter::is_white_pid(HandleToLong(pid))) return origon_NtUserSendInput_win7(a1, a2, a3); return NULL; diff --git a/Anti-Cheat_Driver/mouse_keybord_hook.cpp b/Anti-Cheat_Driver/mouse_keybord_hook.cpp index e5fb13a..1abed12 100644 --- a/Anti-Cheat_Driver/mouse_keybord_hook.cpp +++ b/Anti-Cheat_Driver/mouse_keybord_hook.cpp @@ -52,14 +52,22 @@ namespace mouse_keybord_hook auto install_mouse_keybord_hook() -> BOOL { - auto _eprocess_process = kernel_function::FindProcess("winlogon.exe"); - if (!_eprocess_process) - return FALSE; - - auto apc_state = kernel_function::ke_stack_attch_process(_eprocess_process); - - _ntSendInput = get_sendinput_hook_addr(); + //auto _eprocess_process = kernel_function::FindProcess("winlogon.exe"); + //if (!_eprocess_process) + // return FALSE; + // + //auto apc_state = kernel_function::ke_stack_attch_process(_eprocess_process); + if (!_ntSendInput) + { + _ntSendInput = get_sendinput_hook_addr(); + } + else + { + if (_ntSendInput[0] == 0xff || _ntSendInput[1] == 0x25) + return TRUE; + } + auto os = utils::GetVersion(); if (os.dwBuildNumber == 7600 || os.dwBuildNumber == 7601) { @@ -70,8 +78,8 @@ namespace mouse_keybord_hook inline_hooks_manager::fn_get_instance()->inline_install_hook(_ntSendInput, mouse_key_win10::hkNtUserSendInput, (void**)&origon_NtUserSendInput_win10); } - kernel_function::ke_unstack_detach_process(apc_state); - ObDereferenceObject(_eprocess_process); + //kernel_function::ke_unstack_detach_process(apc_state); + //ObDereferenceObject(_eprocess_process); return 0; } @@ -83,11 +91,11 @@ namespace mouse_keybord_hook auto apc_state = kernel_function::ke_stack_attch_process(_eprocess_process); - inline_hooks_manager::fn_get_instance()->inline_remov_hook((void**)_ntSendInput); + auto status = inline_hooks_manager::fn_get_instance()->inline_remov_hook((void**)_ntSendInput); kernel_function::ke_unstack_detach_process(apc_state); ObDereferenceObject(_eprocess_process); - return 0; + return status; } } \ No newline at end of file diff --git a/Anti-Cheat_Driver/ob_reg_callback.cpp b/Anti-Cheat_Driver/ob_reg_callback.cpp index 5c2f696..293160f 100644 --- a/Anti-Cheat_Driver/ob_reg_callback.cpp +++ b/Anti-Cheat_Driver/ob_reg_callback.cpp @@ -37,7 +37,7 @@ auto ob_call_back::register_ob_reg_callback() -> NTSTATUS if(is_allow_process(image_file_name)) goto end; - if (protect_filter::is_protect_pid(HandleToLong(dwPid), nullptr)) + if (protect_filter::is_protect_pid(HandleToLong(dwPid))) { pOperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess = 0; pOperationInformation->Parameters->DuplicateHandleInformation.OriginalDesiredAccess = 0; diff --git a/Anti-Cheat_Driver/process_notify_callback.cpp b/Anti-Cheat_Driver/process_notify_callback.cpp index e55a8af..5d413fc 100644 --- a/Anti-Cheat_Driver/process_notify_callback.cpp +++ b/Anti-Cheat_Driver/process_notify_callback.cpp @@ -15,15 +15,17 @@ namespace process_notify_callback { //进程退出时进行 对插链的清理操作 - if (protect_filter::is_protect_pid(HandleToLong(ProcessId), nullptr)) - protect_filter::remove_protect_list(g_protect_list, HandleToLong(ProcessId), nullptr); + if (protect_filter::is_protect_pid(HandleToLong(ProcessId))) { - if (protect_filter::is_white_pid(HandleToLong(ProcessId), nullptr)) - { + //DbgPrintEx(77, 0, "%p\n", ProcessId); + + protect_filter::remove_protect_list(HandleToLong(ProcessId), nullptr); - DbgBreakPoint(); - protect_filter::remove_protect_list(g_white_list, HandleToLong(ProcessId), nullptr); } + + + if (protect_filter::is_white_pid(HandleToLong(ProcessId))) + protect_filter::remove_white_list( HandleToLong(ProcessId), nullptr); } /*DbgPrintEx(77, 0, "ParentId:%d | ProcessId:%d | Create:%d\n", diff --git a/Anti-Cheat_Driver/protect_filter.cpp b/Anti-Cheat_Driver/protect_filter.cpp index eacb495..5ee2f1e 100644 --- a/Anti-Cheat_Driver/protect_filter.cpp +++ b/Anti-Cheat_Driver/protect_filter.cpp @@ -1,7 +1,7 @@ #include "protect_filter.h" -LIST_ENTRY g_protect_list; -LIST_ENTRY g_white_list; +LIST_ENTRY g_protect_list = { 0 }; +LIST_ENTRY g_white_list = { 0 }; namespace protect_filter { @@ -13,6 +13,12 @@ namespace protect_filter auto add_protect_list(ULONG Pid, HWND hwnd, BOOL is_white)->BOOL { + PEPROCESS process{ 0 }; + if (!NT_SUCCESS(PsLookupProcessByProcessId(UlongToHandle(Pid), &process))) + return FALSE; + + ObDereferenceObject(process); + auto PFilter = reinterpret_cast(ExAllocatePoolWithTag(PagedPool, sizeof(FILTER), 'wag')); if (!PFilter) return FALSE; @@ -21,12 +27,7 @@ namespace protect_filter if (Pid) { - PEPROCESS eprocess{ 0 }; - if (!NT_SUCCESS(PsLookupProcessByProcessId(ULongToHandle(Pid), &eprocess))) - return FALSE; - PFilter->Pid = Pid; - PFilter->Eprocess = eprocess; } if (hwnd) { @@ -40,7 +41,7 @@ namespace protect_filter return TRUE; } - auto is_protect_pid(ULONG Pid, PEPROCESS Eprocess)->BOOL + auto is_protect_pid(ULONG Pid)->BOOL { if (IsListEmpty(&g_protect_list)) return NULL; @@ -51,22 +52,20 @@ namespace protect_filter auto list_data = reinterpret_cast(CONTAINING_RECORD(list_head, FILTER, List)); list_head = list_head->Flink; - if (Pid) + if (MmIsAddressValid(list_data)) { - if (list_data->Pid == Pid) - return TRUE; - } - if (Eprocess) - { - if (list_data->Eprocess == Eprocess) - return TRUE; + if (Pid) + { + if (list_data->Pid == Pid) + return TRUE; + } } } return FALSE; } - auto is_white_pid(ULONG Pid, PEPROCESS Eprocess)->BOOL + auto is_white_pid(ULONG Pid)->BOOL { if (IsListEmpty(&g_white_list)) return NULL; @@ -82,35 +81,35 @@ namespace protect_filter if (list_data->Pid == Pid) return TRUE; } - if (Eprocess) - { - if (list_data->Eprocess == Eprocess) - return TRUE; - } - } return FALSE; } - auto remove_protect_list(LIST_ENTRY list_entry, ULONG Pid, HWND hwnd)->BOOL + auto remove_protect_list(ULONG Pid, HWND hwnd)->BOOL { UNREFERENCED_PARAMETER(hwnd); - BOOL is_remove_list = FALSE; - if (IsListEmpty(&list_entry)) + //auto List_Entry = list_entry; + + if (IsListEmpty(&g_protect_list)) return FALSE; - auto list_head = list_entry.Flink; - while (list_head != &list_entry) + auto list_head = g_protect_list.Flink; + while (list_head != &g_protect_list) { auto list_data = reinterpret_cast(CONTAINING_RECORD(list_head, FILTER, List)); + list_head = list_head->Flink; + //DbgPrintEx(77, 0, "[+]list_head:%p | list_entry:%p\n", list_head, list_head); + if (list_data->Pid == Pid) { + + //DbgPrintEx(77, 0, "[+]%d\n", list_data->Pid); RemoveEntryList(list_head->Blink); is_remove_list = TRUE; } @@ -124,4 +123,42 @@ namespace protect_filter return FALSE; } + + auto remove_white_list(ULONG Pid, HWND hwnd)->BOOL + { + UNREFERENCED_PARAMETER(hwnd); + BOOL is_remove_list = FALSE; + + //auto List_Entry = list_entry; + + if (IsListEmpty(&g_white_list)) + return FALSE; + + auto list_head = g_white_list.Flink; + while (list_head != &g_white_list) + { + auto list_data = reinterpret_cast(CONTAINING_RECORD(list_head, FILTER, List)); + + list_head = list_head->Flink; + + + //DbgPrintEx(77, 0, "[+]list_head:%p | list_entry:%p\n", list_head, list_head); + + if (list_data->Pid == Pid) + { + + //DbgPrintEx(77, 0, "[+]%d\n", list_data->Pid); + RemoveEntryList(list_head->Blink); + is_remove_list = TRUE; + } + + if (is_remove_list) + { + ExFreePoolWithTag(list_data, 'wag'); + return TRUE; + } + } + return FALSE; + + } } \ No newline at end of file diff --git a/Anti-Cheat_Driver/protect_filter.h b/Anti-Cheat_Driver/protect_filter.h index 92d2c2c..8d36a2d 100644 --- a/Anti-Cheat_Driver/protect_filter.h +++ b/Anti-Cheat_Driver/protect_filter.h @@ -4,7 +4,7 @@ typedef struct _FILTER { LIST_ENTRY List; - PEPROCESS Eprocess; + //PEPROCESS Eprocess; ULONG Pid; HWND hWnd; }FILTER,*PFILTER; @@ -18,9 +18,11 @@ namespace protect_filter auto add_protect_list(ULONG Pid, HWND hwnd, BOOL is_white)->BOOL; - auto is_protect_pid(ULONG Pid, PEPROCESS Eprocess) -> BOOL; + auto is_protect_pid(ULONG Pid) -> BOOL; - auto is_white_pid(ULONG Pid, PEPROCESS Eprocess)->BOOL; + auto is_white_pid(ULONG Pid)->BOOL; - auto remove_protect_list(LIST_ENTRY list_entry, ULONG Pid, HWND hwnd)->BOOL; + auto remove_protect_list(ULONG Pid, HWND hwnd)->BOOL; + + auto remove_white_list(ULONG Pid, HWND hwnd)->BOOL; } \ No newline at end of file