maowengrui/anit-cheat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

init

Browse Source
This commit is contained in:
maowenrui
2026-07-28 15:11:25 +08:00
parent 7ce2ded971
commit 9b00c5f6eb
16 changed files with 233 additions and 73 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj
+8 -1
View File
@@ -42,6 +42,7 @@
<Configuration>Debug</Configuration>
<Platform Condition="'$(Platform)' == ''">Win32</Platform>
<RootNamespace>Anti_Cheat_Driver</RootNamespace>
<WindowsTargetPlatformVersion>$(LatestTargetPlatformVersion)</WindowsTargetPlatformVersion>
</PropertyGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
@@ -71,7 +72,7 @@
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
<ConfigurationType>Driver</ConfigurationType>
<DriverType>WDM</DriverType>
<Driver_SpectreMitigation>Spectre</Driver_SpectreMitigation>
<Driver_SpectreMitigation>false</Driver_SpectreMitigation>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'" Label="Configuration">
<TargetVersion>Windows10</TargetVersion>
@@ -114,12 +115,18 @@
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
<TargetName>$(TargetName.Replace(' ',''))</TargetName>
<OutDir>$(SolutionDir)Bin\$(Platform)\</OutDir>
<IntDir>$(Platform)\</IntDir>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
<TargetName>Anti_Cheat_Driver</TargetName>
<OutDir>$(SolutionDir)Bin\$(Platform)\</OutDir>
<IntDir>$(Platform)\</IntDir>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'">
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
Anti-Cheat_Driver/comm_dispatch.cpp
+46
View File
@@ -1,11 +1,15 @@
#include "comm_dispatch.h"
#include "protect_filter.h"
#include "anit_screen_grap.h"
#include "create_thread_callback.h"
#include "mouse_keybord_hook.h"
namespace comm_dispatch
{
auto dispatch(CMD_COMM* data) -> NTSTATUS
{
auto status = STATUS_UNSUCCESSFUL;
switch (data->CommID)
{
case CMD::DRIVER_COMM_TEST:
@@ -19,6 +23,12 @@ namespace comm_dispatch
status = protect_filter::add_protect_list((ULONG)process_data->Pid, NULL, FALSE);
break;
}
case CMD::DRIVER_CANCEL_PROTECT_PROCESS:
{
auto process_data = (IOCTL_PROCESS*)data->Buf;
status = protect_filter::remove_protect_list((ULONG)process_data->Pid, NULL);
break;
}
case CMD::ADD_WHITE_PROCESS:
{
auto process_data = (IOCTL_PROCESS*)data->Buf;
@@ -34,6 +44,42 @@ namespace comm_dispatch
break;
}
case CMD::USER_EVENT_HANDLE:
{
auto user_handle = (HANDLE*)data->Buf;
status = ObReferenceObjectByHandle(
*user_handle,
EVENT_MODIFY_STATE,
*ExEventObjectType,
UserMode,
(PVOID*)&thread_notify_routine::g_UserEvent,
NULL);
DbgPrintEx(77, 0, "ObReferenceObjectByHandle[status]:%x\n", status);
DbgPrintEx(77, 0, "g_UserEvent:%p\n", thread_notify_routine::g_UserEvent);
break;
}
case CMD::PROTECT_THREAD_CONTRL:
{
auto process_data = (IOCTL_PROCESS*)data->Buf;
thread_notify_routine::g_thread_protect = process_data->is_no_create_remote_thread;
status = STATUS_SUCCESS;
break;
}
case CMD::INSTALL_MOUSE_KEYBOARD:
{
status = mouse_keybord_hook::install_mouse_keybord_hook();
break;
}
case CMD::UNLOAD_MOUSE_KEYBOARD:
{
status = mouse_keybord_hook::remove_mouse_keybord_hook();
break;
}
default:
break;
}
Anti-Cheat_Driver/comm_dispatch.h
+6
View File
@@ -11,6 +11,7 @@ struct CMD_COMM
struct IOCTL_PROCESS
{
DWORD64 Pid;
BOOL is_no_create_remote_thread;
};
struct IOCTL_WINDOW
@@ -23,8 +24,13 @@ enum CMD
MSG_BASE = 0x10000,
DRIVER_COMM_TEST,
DRIVER_PROTECT_PROCESS,
DRIVER_CANCEL_PROTECT_PROCESS,
ADD_WHITE_PROCESS,
WINDOW_ANIT_SCREEN,
USER_EVENT_HANDLE,
PROTECT_THREAD_CONTRL,
INSTALL_MOUSE_KEYBOARD,
UNLOAD_MOUSE_KEYBOARD,
};
namespace comm_dispatch
Anti-Cheat_Driver/create_thread_callback.cpp
+15 -13
View File
@@ -15,9 +15,10 @@ EXTERN_C NTKERNELAPI NTSTATUS ZwOpenThread(
_In_ PCLIENT_ID ClientId
);
namespace thread_notify_routine
{
PKEVENT g_UserEvent = NULL; // 用户态传入的事件对象
BOOL g_thread_protect;
// 打开线程句柄并终止
NTSTATUS TerminateThreadByHandle(
@@ -69,7 +70,6 @@ namespace thread_notify_routine
{
if (Create)
{
PEPROCESS process{ 0 };
auto status = PsLookupProcessByProcessId(ProcessId, &process);
if (!NT_SUCCESS(status))
@@ -80,7 +80,7 @@ namespace thread_notify_routine
if (!NT_SUCCESS(status))
goto end;*/
if(!protect_filter::is_protect_pid(0, process))
if (!protect_filter::is_protect_pid(HandleToLong(ProcessId)))
goto end;
/*if (protect_process != process)
@@ -94,17 +94,19 @@ namespace thread_notify_routine
{
//DbgBreakPoint();
DbgPrintEx(77, 0, "[!] 恶意远程线程检测！\n");
//DbgPrintEx(77, 0, "[!] 恶意远程线程检测！\n");
//
//DbgPrintEx(77, 0, "[!] 目标进程ID: %d\n", ProcessId);
//
//DbgPrintEx(77, 0, "[!] 创建者进程ID: %d\n", cutor_process_id);
//
//DbgPrintEx(77, 0, "[!] 被创建线程ID: %d\n", ThreadId);
DbgPrintEx(77, 0, "[!] 目标进程ID: %d\n", ProcessId);
DbgPrintEx(77, 0, "[!] 创建者进程ID: %d\n", cutor_process_id);
DbgPrintEx(77, 0, "[!] 被创建线程ID: %d\n", ThreadId);
TerminateThreadByHandle(ProcessId, ThreadId);
if (g_thread_protect)
{
TerminateThreadByHandle(ProcessId, ThreadId);
}
//KeSetEvent(g_UserEvent, IO_NO_INCREMENT, FALSE);
}
end:
ObDereferenceObject(process);
Anti-Cheat_Driver/create_thread_callback.h
+4
View File
@@ -3,9 +3,13 @@
namespace thread_notify_routine
{
extern BOOL g_thread_protect;
extern PKEVENT g_UserEvent;
auto create_thread_routine()->NTSTATUS;
auto unload_thread_routine()->NTSTATUS;
}
Anti-Cheat_Driver/driver_main.cpp
+6 -7
View File
@@ -20,8 +20,6 @@ EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING)
process_notify_callback::remov_process_notify();
thread_notify_routine::unload_thread_routine();
mouse_keybord_hook::remove_mouse_keybord_hook();
//load_image_notify_routine::remove_image_load_notify_routine();
};
}
@@ -30,15 +28,16 @@ EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING)
kernel_api::kernel_api_init();
kernel_comm_create::Init();
protect_filter::add_protect_list(3632, 0, FALSE);
//把保护的进程插入到链表中
//protect_filter::add_protect_list(12204, 0, FALSE);
mouse_keybord_hook::install_mouse_keybord_hook();
//DbgPrintEx(77, 0, "[+]ob_reg_callback status:%x\n", ob_call_back::register_ob_reg_callback());
//mouse_keybord_hook::install_mouse_keybord_hook();
DbgPrintEx(77, 0, "[+]ob_reg_callback status:%x\n", ob_call_back::register_ob_reg_callback());
DbgPrintEx(77, 0, "[+]process_notify_callback status:%x\n", process_notify_callback::install_process_notify());
DbgPrintEx(77, 0, "[+]create_thread_routine status:%x\n", thread_notify_routine::create_thread_routine());
//load_image_notify_routine::create_image_load_notify_routine();
//我过滤了那个任务管理器 所以看不了结束进程效果 直接看能不能读搜索就行了 没有图标吧
//也搜索不了 我这个就是内存加载 也不会蓝屏啊
return STATUS_SUCCESS;
}
Anti-Cheat_Driver/kernel_api.cpp
+8
View File
@@ -25,6 +25,9 @@ namespace kernel_api
RtlInitUnicodeString(&unFuncName, L"ZwOpenThread");
imported.nt_open_thread = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
RtlInitUnicodeString(&unFuncName, L"ObOpenObjectByName");
imported.ob_open_object_by_name = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
}
NTSTATUS ntquerysysteminformation(ULONG SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength)
@@ -60,5 +63,10 @@ namespace kernel_api
return reinterpret_cast<NTSTATUS(*)(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, PCLIENT_ID)>(imported.nt_open_thread)
(ThreadHandle, DesiredAccess, ObjectAttributes, ClientId);
}
NTSTATUS obopenobjectbyname(POBJECT_ATTRIBUTES ObjectAttributes, POBJECT_TYPE ObjectType, KPROCESSOR_MODE AccessMode, PACCESS_STATE AccessState, ACCESS_MASK DesiredAccess, PVOID ParseContext, PHANDLE Handle)
{
return reinterpret_cast<NTSTATUS(*)(POBJECT_ATTRIBUTES, POBJECT_TYPE, KPROCESSOR_MODE, PACCESS_STATE, ACCESS_MASK, PVOID, PHANDLE)>
(imported.ob_open_object_by_name)(ObjectAttributes, ObjectType, AccessMode, AccessState, DesiredAccess, ParseContext, Handle);
}
}
Anti-Cheat_Driver/kernel_api.h
+11
View File
@@ -20,6 +20,7 @@ struct imported_
ULONG64 ps_getprocess_id;
ULONG64 se_locateprocess_imagename;
ULONG64 nt_open_thread;
ULONG64 ob_open_object_by_name;
};
namespace kernel_api
@@ -42,4 +43,14 @@ namespace kernel_api
PVOID rtlfindexportedroutinebyname(PVOID ImageBase, PCCH RoutineName);
NTSTATUS ntopenthread(PHANDLE ThreadHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId);
NTSTATUS obopenobjectbyname(
POBJECT_ATTRIBUTES ObjectAttributes,
POBJECT_TYPE ObjectType,
KPROCESSOR_MODE AccessMode,
PACCESS_STATE AccessState,
ACCESS_MASK DesiredAccess,
PVOID ParseContext,
PHANDLE Handle
);
}
Anti-Cheat_Driver/mouse_key_win10.cpp
+1 -1
View File
@@ -9,7 +9,7 @@ namespace mouse_key_win10
__int64 __fastcall hkNtUserSendInput(unsigned int a1, volatile void* a2, int a3, int a4)
{
auto pid = PsGetCurrentProcessId();
if (protect_filter::is_white_pid(HandleToLong(pid), NULL))
if (protect_filter::is_white_pid(HandleToLong(pid)))
return origon_NtUserSendInput_win10(a1, a2, a3, a4);
Anti-Cheat_Driver/mouse_key_win7.cpp
+1 -1
View File
@@ -8,7 +8,7 @@ namespace mouse_key_win7
{
auto pid = PsGetCurrentProcessId();
if(protect_filter::is_white_pid(HandleToLong(pid), NULL))
if(protect_filter::is_white_pid(HandleToLong(pid)))
return origon_NtUserSendInput_win7(a1, a2, a3);
return NULL;
Anti-Cheat_Driver/mouse_keybord_hook.cpp
+19 -11
View File
@@ -52,14 +52,22 @@ namespace mouse_keybord_hook
auto install_mouse_keybord_hook() -> BOOL
{
auto _eprocess_process = kernel_function::FindProcess("winlogon.exe");
if (!_eprocess_process)
return FALSE;
auto apc_state = kernel_function::ke_stack_attch_process(_eprocess_process);
_ntSendInput = get_sendinput_hook_addr();
//auto _eprocess_process = kernel_function::FindProcess("winlogon.exe");
//if (!_eprocess_process)
// return FALSE;
//
//auto apc_state = kernel_function::ke_stack_attch_process(_eprocess_process);
if (!_ntSendInput)
{
_ntSendInput = get_sendinput_hook_addr();
}
else
{
if (_ntSendInput[0] == 0xff || _ntSendInput[1] == 0x25)
return TRUE;
}
auto os = utils::GetVersion();
if (os.dwBuildNumber == 7600 || os.dwBuildNumber == 7601)
{
@@ -70,8 +78,8 @@ namespace mouse_keybord_hook
inline_hooks_manager::fn_get_instance()->inline_install_hook(_ntSendInput, mouse_key_win10::hkNtUserSendInput, (void**)&origon_NtUserSendInput_win10);
}
kernel_function::ke_unstack_detach_process(apc_state);
ObDereferenceObject(_eprocess_process);
//kernel_function::ke_unstack_detach_process(apc_state);
//ObDereferenceObject(_eprocess_process);
return 0;
}
@@ -83,11 +91,11 @@ namespace mouse_keybord_hook
auto apc_state = kernel_function::ke_stack_attch_process(_eprocess_process);
inline_hooks_manager::fn_get_instance()->inline_remov_hook((void**)_ntSendInput);
auto status = inline_hooks_manager::fn_get_instance()->inline_remov_hook((void**)_ntSendInput);
kernel_function::ke_unstack_detach_process(apc_state);
ObDereferenceObject(_eprocess_process);
return 0;
return status;
}
}
Anti-Cheat_Driver/ob_reg_callback.cpp
+1 -1
View File
@@ -37,7 +37,7 @@ auto ob_call_back::register_ob_reg_callback() -> NTSTATUS
if(is_allow_process(image_file_name))
goto end;
if (protect_filter::is_protect_pid(HandleToLong(dwPid), nullptr))
if (protect_filter::is_protect_pid(HandleToLong(dwPid)))
{
pOperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess = 0;
pOperationInformation->Parameters->DuplicateHandleInformation.OriginalDesiredAccess = 0;
Anti-Cheat_Driver/process_notify_callback.cpp
+8 -6
View File
@@ -15,15 +15,17 @@ namespace process_notify_callback
{
//进程退出时进行 对插链的清理操作
if (protect_filter::is_protect_pid(HandleToLong(ProcessId), nullptr))
protect_filter::remove_protect_list(g_protect_list, HandleToLong(ProcessId), nullptr);
if (protect_filter::is_protect_pid(HandleToLong(ProcessId))) {
if (protect_filter::is_white_pid(HandleToLong(ProcessId), nullptr))
{
//DbgPrintEx(77, 0, "%p\n", ProcessId);
protect_filter::remove_protect_list(HandleToLong(ProcessId), nullptr);
DbgBreakPoint();
protect_filter::remove_protect_list(g_white_list, HandleToLong(ProcessId), nullptr);
}
if (protect_filter::is_white_pid(HandleToLong(ProcessId)))
protect_filter::remove_white_list( HandleToLong(ProcessId), nullptr);
}
/*DbgPrintEx(77, 0, "ParentId:%d | ProcessId:%d | Create:%d\n",
Anti-Cheat_Driver/protect_filter.cpp
+65 -28
View File
@@ -1,7 +1,7 @@
#include "protect_filter.h"
LIST_ENTRY g_protect_list;
LIST_ENTRY g_white_list;
LIST_ENTRY g_protect_list = { 0 };
LIST_ENTRY g_white_list = { 0 };
namespace protect_filter
{
@@ -13,6 +13,12 @@ namespace protect_filter
auto add_protect_list(ULONG Pid, HWND hwnd, BOOL is_white)->BOOL
{
PEPROCESS process{ 0 };
if (!NT_SUCCESS(PsLookupProcessByProcessId(UlongToHandle(Pid), &process)))
return FALSE;
ObDereferenceObject(process);
auto PFilter = reinterpret_cast<PFILTER>(ExAllocatePoolWithTag(PagedPool, sizeof(FILTER), 'wag'));
if (!PFilter)
return FALSE;
@@ -21,12 +27,7 @@ namespace protect_filter
if (Pid)
{
PEPROCESS eprocess{ 0 };
if (!NT_SUCCESS(PsLookupProcessByProcessId(ULongToHandle(Pid), &eprocess)))
return FALSE;
PFilter->Pid = Pid;
PFilter->Eprocess = eprocess;
}
if (hwnd)
{
@@ -40,7 +41,7 @@ namespace protect_filter
return TRUE;
}
auto is_protect_pid(ULONG Pid, PEPROCESS Eprocess)->BOOL
auto is_protect_pid(ULONG Pid)->BOOL
{
if (IsListEmpty(&g_protect_list))
return NULL;
@@ -51,22 +52,20 @@ namespace protect_filter
auto list_data = reinterpret_cast<PFILTER>(CONTAINING_RECORD(list_head, FILTER, List));
list_head = list_head->Flink;
if (Pid)
if (MmIsAddressValid(list_data))
{
if (list_data->Pid == Pid)
return TRUE;
}
if (Eprocess)
{
if (list_data->Eprocess == Eprocess)
return TRUE;
if (Pid)
{
if (list_data->Pid == Pid)
return TRUE;
}
}
}
return FALSE;
}
auto is_white_pid(ULONG Pid, PEPROCESS Eprocess)->BOOL
auto is_white_pid(ULONG Pid)->BOOL
{
if (IsListEmpty(&g_white_list))
return NULL;
@@ -82,35 +81,35 @@ namespace protect_filter
if (list_data->Pid == Pid)
return TRUE;
}
if (Eprocess)
{
if (list_data->Eprocess == Eprocess)
return TRUE;
}
}
return FALSE;
}
auto remove_protect_list(LIST_ENTRY list_entry, ULONG Pid, HWND hwnd)->BOOL
auto remove_protect_list(ULONG Pid, HWND hwnd)->BOOL
{
UNREFERENCED_PARAMETER(hwnd);
BOOL is_remove_list = FALSE;
if (IsListEmpty(&list_entry))
//auto List_Entry = list_entry;
if (IsListEmpty(&g_protect_list))
return FALSE;
auto list_head = list_entry.Flink;
while (list_head != &list_entry)
auto list_head = g_protect_list.Flink;
while (list_head != &g_protect_list)
{
auto list_data = reinterpret_cast<PFILTER>(CONTAINING_RECORD(list_head, FILTER, List));
list_head = list_head->Flink;
//DbgPrintEx(77, 0, "[+]list_head:%p | list_entry:%p\n", list_head, list_head);
if (list_data->Pid == Pid)
{
//DbgPrintEx(77, 0, "[+]%d\n", list_data->Pid);
RemoveEntryList(list_head->Blink);
is_remove_list = TRUE;
}
@@ -124,4 +123,42 @@ namespace protect_filter
return FALSE;
}
auto remove_white_list(ULONG Pid, HWND hwnd)->BOOL
{
UNREFERENCED_PARAMETER(hwnd);
BOOL is_remove_list = FALSE;
//auto List_Entry = list_entry;
if (IsListEmpty(&g_white_list))
return FALSE;
auto list_head = g_white_list.Flink;
while (list_head != &g_white_list)
{
auto list_data = reinterpret_cast<PFILTER>(CONTAINING_RECORD(list_head, FILTER, List));
list_head = list_head->Flink;
//DbgPrintEx(77, 0, "[+]list_head:%p | list_entry:%p\n", list_head, list_head);
if (list_data->Pid == Pid)
{
//DbgPrintEx(77, 0, "[+]%d\n", list_data->Pid);
RemoveEntryList(list_head->Blink);
is_remove_list = TRUE;
}
if (is_remove_list)
{
ExFreePoolWithTag(list_data, 'wag');
return TRUE;
}
}
return FALSE;
}
}
Anti-Cheat_Driver/protect_filter.h
+6 -4
View File
@@ -4,7 +4,7 @@
typedef struct _FILTER
{
LIST_ENTRY List;
PEPROCESS Eprocess;
//PEPROCESS Eprocess;
ULONG Pid;
HWND hWnd;
}FILTER,*PFILTER;
@@ -18,9 +18,11 @@ namespace protect_filter
auto add_protect_list(ULONG Pid, HWND hwnd, BOOL is_white)->BOOL;
auto is_protect_pid(ULONG Pid, PEPROCESS Eprocess) -> BOOL;
auto is_protect_pid(ULONG Pid) -> BOOL;
auto is_white_pid(ULONG Pid, PEPROCESS Eprocess)->BOOL;
auto is_white_pid(ULONG Pid)->BOOL;
auto remove_protect_list(LIST_ENTRY list_entry, ULONG Pid, HWND hwnd)->BOOL;
auto remove_protect_list(ULONG Pid, HWND hwnd)->BOOL;
auto remove_white_list(ULONG Pid, HWND hwnd)->BOOL;
}