maowengrui/anit-cheat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

init

Browse Source
This commit is contained in:
maowenrui
2026-07-28 15:11:25 +08:00
parent 7ce2ded971
commit 9b00c5f6eb
16 changed files with 233 additions and 73 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Anti-Cheat_Driver/create_thread_callback.cpp
+15 -13
View File
@@ -15,9 +15,10 @@ EXTERN_C NTKERNELAPI NTSTATUS ZwOpenThread(
_In_ PCLIENT_ID ClientId
);
namespace thread_notify_routine
{
PKEVENT g_UserEvent = NULL; // 用户态传入的事件对象
BOOL g_thread_protect;
// 打开线程句柄并终止
NTSTATUS TerminateThreadByHandle(
@@ -69,7 +70,6 @@ namespace thread_notify_routine
{
if (Create)
{
PEPROCESS process{ 0 };
auto status = PsLookupProcessByProcessId(ProcessId, &process);
if (!NT_SUCCESS(status))
@@ -80,7 +80,7 @@ namespace thread_notify_routine
if (!NT_SUCCESS(status))
goto end;*/
if(!protect_filter::is_protect_pid(0, process))
if (!protect_filter::is_protect_pid(HandleToLong(ProcessId)))
goto end;
/*if (protect_process != process)
@@ -94,17 +94,19 @@ namespace thread_notify_routine
{
//DbgBreakPoint();
DbgPrintEx(77, 0, "[!] 恶意远程线程检测！\n");
//DbgPrintEx(77, 0, "[!] 恶意远程线程检测！\n");
//
//DbgPrintEx(77, 0, "[!] 目标进程ID: %d\n", ProcessId);
//
//DbgPrintEx(77, 0, "[!] 创建者进程ID: %d\n", cutor_process_id);
//
//DbgPrintEx(77, 0, "[!] 被创建线程ID: %d\n", ThreadId);
DbgPrintEx(77, 0, "[!] 目标进程ID: %d\n", ProcessId);
DbgPrintEx(77, 0, "[!] 创建者进程ID: %d\n", cutor_process_id);
DbgPrintEx(77, 0, "[!] 被创建线程ID: %d\n", ThreadId);
TerminateThreadByHandle(ProcessId, ThreadId);
if (g_thread_protect)
{
TerminateThreadByHandle(ProcessId, ThreadId);
}
//KeSetEvent(g_UserEvent, IO_NO_INCREMENT, FALSE);
}
end:
ObDereferenceObject(process);