maowengrui/anit-cheat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

init

Browse Source
This commit is contained in:
maowenrui
2026-07-28 15:11:25 +08:00
parent 7ce2ded971
commit 9b00c5f6eb
16 changed files with 233 additions and 73 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Anti-Cheat_Driver.sln
+28
View File
@@ -5,6 +5,10 @@ VisualStudioVersion = 16.0.37206.5
MinimumVisualStudioVersion = 10.0.40219.1 MinimumVisualStudioVersion = 10.0.40219.1
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Anti-Cheat_Driver", "Anti-Cheat_Driver\Anti-Cheat_Driver.vcxproj", "{E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}" Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Anti-Cheat_Driver", "Anti-Cheat_Driver\Anti-Cheat_Driver.vcxproj", "{E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}"
EndProject EndProject
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Anit-Cheat_EXE", "Anit-Cheat_EXE\Anit-Cheat_EXE.vcxproj", "{17DDE567-4EAA-4E85-B533-02C4E6451072}"
EndProject
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Anit-Cheat_DLL", "Anit-Cheat_DLL\Anit-Cheat_DLL.vcxproj", "{5CABFAE0-D81B-47A9-A7BA-BC7510BE19DF}"
EndProject
Global Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|ARM = Debug|ARM Debug|ARM = Debug|ARM
@@ -41,6 +45,30 @@ Global
{E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Release|x86.ActiveCfg = Release|Win32 {E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Release|x86.ActiveCfg = Release|Win32
{E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Release|x86.Build.0 = Release|Win32 {E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Release|x86.Build.0 = Release|Win32
{E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Release|x86.Deploy.0 = Release|Win32 {E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Release|x86.Deploy.0 = Release|Win32
{17DDE567-4EAA-4E85-B533-02C4E6451072}.Debug|ARM.ActiveCfg = Debug|Win32
{17DDE567-4EAA-4E85-B533-02C4E6451072}.Debug|ARM64.ActiveCfg = Debug|Win32
{17DDE567-4EAA-4E85-B533-02C4E6451072}.Debug|x64.ActiveCfg = Debug|x64
{17DDE567-4EAA-4E85-B533-02C4E6451072}.Debug|x64.Build.0 = Debug|x64
{17DDE567-4EAA-4E85-B533-02C4E6451072}.Debug|x86.ActiveCfg = Debug|Win32
{17DDE567-4EAA-4E85-B533-02C4E6451072}.Debug|x86.Build.0 = Debug|Win32
{17DDE567-4EAA-4E85-B533-02C4E6451072}.Release|ARM.ActiveCfg = Release|Win32
{17DDE567-4EAA-4E85-B533-02C4E6451072}.Release|ARM64.ActiveCfg = Release|Win32
{17DDE567-4EAA-4E85-B533-02C4E6451072}.Release|x64.ActiveCfg = Release|x64
{17DDE567-4EAA-4E85-B533-02C4E6451072}.Release|x64.Build.0 = Release|x64
{17DDE567-4EAA-4E85-B533-02C4E6451072}.Release|x86.ActiveCfg = Release|Win32
{17DDE567-4EAA-4E85-B533-02C4E6451072}.Release|x86.Build.0 = Release|Win32
{5CABFAE0-D81B-47A9-A7BA-BC7510BE19DF}.Debug|ARM.ActiveCfg = Debug|Win32
{5CABFAE0-D81B-47A9-A7BA-BC7510BE19DF}.Debug|ARM64.ActiveCfg = Debug|Win32
{5CABFAE0-D81B-47A9-A7BA-BC7510BE19DF}.Debug|x64.ActiveCfg = Debug|x64
{5CABFAE0-D81B-47A9-A7BA-BC7510BE19DF}.Debug|x64.Build.0 = Debug|x64
{5CABFAE0-D81B-47A9-A7BA-BC7510BE19DF}.Debug|x86.ActiveCfg = Debug|Win32
{5CABFAE0-D81B-47A9-A7BA-BC7510BE19DF}.Debug|x86.Build.0 = Debug|Win32
{5CABFAE0-D81B-47A9-A7BA-BC7510BE19DF}.Release|ARM.ActiveCfg = Release|Win32
{5CABFAE0-D81B-47A9-A7BA-BC7510BE19DF}.Release|ARM64.ActiveCfg = Release|Win32
{5CABFAE0-D81B-47A9-A7BA-BC7510BE19DF}.Release|x64.ActiveCfg = Release|x64
{5CABFAE0-D81B-47A9-A7BA-BC7510BE19DF}.Release|x64.Build.0 = Release|x64
{5CABFAE0-D81B-47A9-A7BA-BC7510BE19DF}.Release|x86.ActiveCfg = Release|Win32
{5CABFAE0-D81B-47A9-A7BA-BC7510BE19DF}.Release|x86.Build.0 = Release|Win32
EndGlobalSection EndGlobalSection
GlobalSection(SolutionProperties) = preSolution GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE HideSolutionNode = FALSE
Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj
+8 -1
View File
@@ -42,6 +42,7 @@
<Configuration>Debug</Configuration> <Configuration>Debug</Configuration>
<Platform Condition="'$(Platform)' == ''">Win32</Platform> <Platform Condition="'$(Platform)' == ''">Win32</Platform>
<RootNamespace>Anti_Cheat_Driver</RootNamespace> <RootNamespace>Anti_Cheat_Driver</RootNamespace>
<WindowsTargetPlatformVersion>$(LatestTargetPlatformVersion)</WindowsTargetPlatformVersion>
</PropertyGroup> </PropertyGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" /> <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration"> <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
@@ -71,7 +72,7 @@
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset> <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
<ConfigurationType>Driver</ConfigurationType> <ConfigurationType>Driver</ConfigurationType>
<DriverType>WDM</DriverType> <DriverType>WDM</DriverType>
<Driver_SpectreMitigation>Spectre</Driver_SpectreMitigation> <Driver_SpectreMitigation>false</Driver_SpectreMitigation>
</PropertyGroup> </PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'" Label="Configuration"> <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'" Label="Configuration">
<TargetVersion>Windows10</TargetVersion> <TargetVersion>Windows10</TargetVersion>
@@ -114,12 +115,18 @@
</PropertyGroup> </PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor> <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
<TargetName>$(TargetName.Replace(' ',''))</TargetName>
<OutDir>$(SolutionDir)Bin\$(Platform)\</OutDir>
<IntDir>$(Platform)\</IntDir>
</PropertyGroup> </PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'"> <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor> <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
</PropertyGroup> </PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'"> <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor> <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
<TargetName>Anti_Cheat_Driver</TargetName>
<OutDir>$(SolutionDir)Bin\$(Platform)\</OutDir>
<IntDir>$(Platform)\</IntDir>
</PropertyGroup> </PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'"> <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'">
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor> <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
Anti-Cheat_Driver/comm_dispatch.cpp
+46
View File
@@ -1,11 +1,15 @@
#include "comm_dispatch.h" #include "comm_dispatch.h"
#include "protect_filter.h" #include "protect_filter.h"
#include "anit_screen_grap.h" #include "anit_screen_grap.h"
#include "create_thread_callback.h"
#include "mouse_keybord_hook.h"
namespace comm_dispatch namespace comm_dispatch
{ {
auto dispatch(CMD_COMM* data) -> NTSTATUS auto dispatch(CMD_COMM* data) -> NTSTATUS
{ {
auto status = STATUS_UNSUCCESSFUL; auto status = STATUS_UNSUCCESSFUL;
switch (data->CommID) switch (data->CommID)
{ {
case CMD::DRIVER_COMM_TEST: case CMD::DRIVER_COMM_TEST:
@@ -19,6 +23,12 @@ namespace comm_dispatch
status = protect_filter::add_protect_list((ULONG)process_data->Pid, NULL, FALSE); status = protect_filter::add_protect_list((ULONG)process_data->Pid, NULL, FALSE);
break; break;
} }
case CMD::DRIVER_CANCEL_PROTECT_PROCESS:
{
auto process_data = (IOCTL_PROCESS*)data->Buf;
status = protect_filter::remove_protect_list((ULONG)process_data->Pid, NULL);
break;
}
case CMD::ADD_WHITE_PROCESS: case CMD::ADD_WHITE_PROCESS:
{ {
auto process_data = (IOCTL_PROCESS*)data->Buf; auto process_data = (IOCTL_PROCESS*)data->Buf;
@@ -34,6 +44,42 @@ namespace comm_dispatch
break; break;
} }
case CMD::USER_EVENT_HANDLE:
{
auto user_handle = (HANDLE*)data->Buf;
status = ObReferenceObjectByHandle(
*user_handle,
EVENT_MODIFY_STATE,
*ExEventObjectType,
UserMode,
(PVOID*)&thread_notify_routine::g_UserEvent,
NULL);
DbgPrintEx(77, 0, "ObReferenceObjectByHandle[status]:%x\n", status);
DbgPrintEx(77, 0, "g_UserEvent:%p\n", thread_notify_routine::g_UserEvent);
break;
}
case CMD::PROTECT_THREAD_CONTRL:
{
auto process_data = (IOCTL_PROCESS*)data->Buf;
thread_notify_routine::g_thread_protect = process_data->is_no_create_remote_thread;
status = STATUS_SUCCESS;
break;
}
case CMD::INSTALL_MOUSE_KEYBOARD:
{
status = mouse_keybord_hook::install_mouse_keybord_hook();
break;
}
case CMD::UNLOAD_MOUSE_KEYBOARD:
{
status = mouse_keybord_hook::remove_mouse_keybord_hook();
break;
}
default: default:
break; break;
} }
Anti-Cheat_Driver/comm_dispatch.h
+6
View File
@@ -11,6 +11,7 @@ struct CMD_COMM
struct IOCTL_PROCESS struct IOCTL_PROCESS
{ {
DWORD64 Pid; DWORD64 Pid;
BOOL is_no_create_remote_thread;
}; };
struct IOCTL_WINDOW struct IOCTL_WINDOW
@@ -23,8 +24,13 @@ enum CMD
MSG_BASE = 0x10000, MSG_BASE = 0x10000,
DRIVER_COMM_TEST, DRIVER_COMM_TEST,
DRIVER_PROTECT_PROCESS, DRIVER_PROTECT_PROCESS,
DRIVER_CANCEL_PROTECT_PROCESS,
ADD_WHITE_PROCESS, ADD_WHITE_PROCESS,
WINDOW_ANIT_SCREEN, WINDOW_ANIT_SCREEN,
USER_EVENT_HANDLE,
PROTECT_THREAD_CONTRL,
INSTALL_MOUSE_KEYBOARD,
UNLOAD_MOUSE_KEYBOARD,
}; };
namespace comm_dispatch namespace comm_dispatch
Anti-Cheat_Driver/create_thread_callback.cpp
+15 -13
View File
@@ -15,9 +15,10 @@ EXTERN_C NTKERNELAPI NTSTATUS ZwOpenThread(
_In_ PCLIENT_ID ClientId _In_ PCLIENT_ID ClientId
); );
namespace thread_notify_routine namespace thread_notify_routine
{ {
PKEVENT g_UserEvent = NULL; // 用户态传入的事件对象
BOOL g_thread_protect;
// 打开线程句柄并终止 // 打开线程句柄并终止
NTSTATUS TerminateThreadByHandle( NTSTATUS TerminateThreadByHandle(
@@ -69,7 +70,6 @@ namespace thread_notify_routine
{ {
if (Create) if (Create)
{ {
PEPROCESS process{ 0 }; PEPROCESS process{ 0 };
auto status = PsLookupProcessByProcessId(ProcessId, &process); auto status = PsLookupProcessByProcessId(ProcessId, &process);
if (!NT_SUCCESS(status)) if (!NT_SUCCESS(status))
@@ -80,7 +80,7 @@ namespace thread_notify_routine
if (!NT_SUCCESS(status)) if (!NT_SUCCESS(status))
goto end;*/ goto end;*/
if(!protect_filter::is_protect_pid(0, process)) if (!protect_filter::is_protect_pid(HandleToLong(ProcessId)))
goto end; goto end;
/*if (protect_process != process) /*if (protect_process != process)
@@ -94,17 +94,19 @@ namespace thread_notify_routine
{ {
//DbgBreakPoint(); //DbgBreakPoint();
DbgPrintEx(77, 0, "[!] 恶意远程线程检测！\n"); //DbgPrintEx(77, 0, "[!] 恶意远程线程检测！\n");
//
DbgPrintEx(77, 0, "[!] 目标进程ID: %d\n", ProcessId); //DbgPrintEx(77, 0, "[!] 目标进程ID: %d\n", ProcessId);
//
DbgPrintEx(77, 0, "[!] 创建者进程ID: %d\n", cutor_process_id); //DbgPrintEx(77, 0, "[!] 创建者进程ID: %d\n", cutor_process_id);
//
DbgPrintEx(77, 0, "[!] 被创建线程ID: %d\n", ThreadId); //DbgPrintEx(77, 0, "[!] 被创建线程ID: %d\n", ThreadId);
TerminateThreadByHandle(ProcessId, ThreadId);
if (g_thread_protect)
{
TerminateThreadByHandle(ProcessId, ThreadId);
}
//KeSetEvent(g_UserEvent, IO_NO_INCREMENT, FALSE);
} }
end: end:
ObDereferenceObject(process); ObDereferenceObject(process);
Anti-Cheat_Driver/create_thread_callback.h
+4
View File
@@ -3,9 +3,13 @@
namespace thread_notify_routine namespace thread_notify_routine
{ {
extern BOOL g_thread_protect;
extern PKEVENT g_UserEvent;
auto create_thread_routine()->NTSTATUS; auto create_thread_routine()->NTSTATUS;
auto unload_thread_routine()->NTSTATUS; auto unload_thread_routine()->NTSTATUS;
} }
Anti-Cheat_Driver/driver_main.cpp
+6 -7
View File
@@ -20,8 +20,6 @@ EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING)
process_notify_callback::remov_process_notify(); process_notify_callback::remov_process_notify();
thread_notify_routine::unload_thread_routine(); thread_notify_routine::unload_thread_routine();
mouse_keybord_hook::remove_mouse_keybord_hook();
//load_image_notify_routine::remove_image_load_notify_routine(); //load_image_notify_routine::remove_image_load_notify_routine();
}; };
} }
@@ -30,15 +28,16 @@ EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING)
kernel_api::kernel_api_init(); kernel_api::kernel_api_init();
kernel_comm_create::Init(); kernel_comm_create::Init();
protect_filter::add_protect_list(3632, 0, FALSE); //把保护的进程插入到链表中
//protect_filter::add_protect_list(12204, 0, FALSE);
//mouse_keybord_hook::install_mouse_keybord_hook();
mouse_keybord_hook::install_mouse_keybord_hook(); DbgPrintEx(77, 0, "[+]ob_reg_callback status:%x\n", ob_call_back::register_ob_reg_callback());
//DbgPrintEx(77, 0, "[+]ob_reg_callback status:%x\n", ob_call_back::register_ob_reg_callback());
DbgPrintEx(77, 0, "[+]process_notify_callback status:%x\n", process_notify_callback::install_process_notify()); DbgPrintEx(77, 0, "[+]process_notify_callback status:%x\n", process_notify_callback::install_process_notify());
DbgPrintEx(77, 0, "[+]create_thread_routine status:%x\n", thread_notify_routine::create_thread_routine()); DbgPrintEx(77, 0, "[+]create_thread_routine status:%x\n", thread_notify_routine::create_thread_routine());
//load_image_notify_routine::create_image_load_notify_routine();
//我过滤了那个任务管理器 所以看不了结束进程效果 直接看能不能读搜索就行了 没有图标吧
//也搜索不了 我这个就是内存加载 也不会蓝屏啊
return STATUS_SUCCESS; return STATUS_SUCCESS;
} }
Anti-Cheat_Driver/kernel_api.cpp
+8
View File
@@ -25,6 +25,9 @@ namespace kernel_api
RtlInitUnicodeString(&unFuncName, L"ZwOpenThread"); RtlInitUnicodeString(&unFuncName, L"ZwOpenThread");
imported.nt_open_thread = (ULONG64)MmGetSystemRoutineAddress(&unFuncName); imported.nt_open_thread = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
RtlInitUnicodeString(&unFuncName, L"ObOpenObjectByName");
imported.ob_open_object_by_name = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
} }
NTSTATUS ntquerysysteminformation(ULONG SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength) NTSTATUS ntquerysysteminformation(ULONG SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength)
@@ -60,5 +63,10 @@ namespace kernel_api
return reinterpret_cast<NTSTATUS(*)(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, PCLIENT_ID)>(imported.nt_open_thread) return reinterpret_cast<NTSTATUS(*)(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, PCLIENT_ID)>(imported.nt_open_thread)
(ThreadHandle, DesiredAccess, ObjectAttributes, ClientId); (ThreadHandle, DesiredAccess, ObjectAttributes, ClientId);
} }
NTSTATUS obopenobjectbyname(POBJECT_ATTRIBUTES ObjectAttributes, POBJECT_TYPE ObjectType, KPROCESSOR_MODE AccessMode, PACCESS_STATE AccessState, ACCESS_MASK DesiredAccess, PVOID ParseContext, PHANDLE Handle)
{
return reinterpret_cast<NTSTATUS(*)(POBJECT_ATTRIBUTES, POBJECT_TYPE, KPROCESSOR_MODE, PACCESS_STATE, ACCESS_MASK, PVOID, PHANDLE)>
(imported.ob_open_object_by_name)(ObjectAttributes, ObjectType, AccessMode, AccessState, DesiredAccess, ParseContext, Handle);
}
} }
Anti-Cheat_Driver/kernel_api.h
+11
View File
@@ -20,6 +20,7 @@ struct imported_
ULONG64 ps_getprocess_id; ULONG64 ps_getprocess_id;
ULONG64 se_locateprocess_imagename; ULONG64 se_locateprocess_imagename;
ULONG64 nt_open_thread; ULONG64 nt_open_thread;
ULONG64 ob_open_object_by_name;
}; };
namespace kernel_api namespace kernel_api
@@ -42,4 +43,14 @@ namespace kernel_api
PVOID rtlfindexportedroutinebyname(PVOID ImageBase, PCCH RoutineName); PVOID rtlfindexportedroutinebyname(PVOID ImageBase, PCCH RoutineName);
NTSTATUS ntopenthread(PHANDLE ThreadHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId); NTSTATUS ntopenthread(PHANDLE ThreadHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId);
NTSTATUS obopenobjectbyname(
POBJECT_ATTRIBUTES ObjectAttributes,
POBJECT_TYPE ObjectType,
KPROCESSOR_MODE AccessMode,
PACCESS_STATE AccessState,
ACCESS_MASK DesiredAccess,
PVOID ParseContext,
PHANDLE Handle
);
} }
Anti-Cheat_Driver/mouse_key_win10.cpp
+1 -1
View File
@@ -9,7 +9,7 @@ namespace mouse_key_win10
__int64 __fastcall hkNtUserSendInput(unsigned int a1, volatile void* a2, int a3, int a4) __int64 __fastcall hkNtUserSendInput(unsigned int a1, volatile void* a2, int a3, int a4)
{ {
auto pid = PsGetCurrentProcessId(); auto pid = PsGetCurrentProcessId();
if (protect_filter::is_white_pid(HandleToLong(pid), NULL)) if (protect_filter::is_white_pid(HandleToLong(pid)))
return origon_NtUserSendInput_win10(a1, a2, a3, a4); return origon_NtUserSendInput_win10(a1, a2, a3, a4);
Anti-Cheat_Driver/mouse_key_win7.cpp
+1 -1
View File
@@ -8,7 +8,7 @@ namespace mouse_key_win7
{ {
auto pid = PsGetCurrentProcessId(); auto pid = PsGetCurrentProcessId();
if(protect_filter::is_white_pid(HandleToLong(pid), NULL)) if(protect_filter::is_white_pid(HandleToLong(pid)))
return origon_NtUserSendInput_win7(a1, a2, a3); return origon_NtUserSendInput_win7(a1, a2, a3);
return NULL; return NULL;
Anti-Cheat_Driver/mouse_keybord_hook.cpp
+18 -10
View File
@@ -52,13 +52,21 @@ namespace mouse_keybord_hook
auto install_mouse_keybord_hook() -> BOOL auto install_mouse_keybord_hook() -> BOOL
{ {
auto _eprocess_process = kernel_function::FindProcess("winlogon.exe"); //auto _eprocess_process = kernel_function::FindProcess("winlogon.exe");
if (!_eprocess_process) //if (!_eprocess_process)
return FALSE; // return FALSE;
//
//auto apc_state = kernel_function::ke_stack_attch_process(_eprocess_process);
auto apc_state = kernel_function::ke_stack_attch_process(_eprocess_process); if (!_ntSendInput)
{
_ntSendInput = get_sendinput_hook_addr(); _ntSendInput = get_sendinput_hook_addr();
}
else
{
if (_ntSendInput[0] == 0xff || _ntSendInput[1] == 0x25)
return TRUE;
}
auto os = utils::GetVersion(); auto os = utils::GetVersion();
if (os.dwBuildNumber == 7600 || os.dwBuildNumber == 7601) if (os.dwBuildNumber == 7600 || os.dwBuildNumber == 7601)
@@ -70,8 +78,8 @@ namespace mouse_keybord_hook
inline_hooks_manager::fn_get_instance()->inline_install_hook(_ntSendInput, mouse_key_win10::hkNtUserSendInput, (void**)&origon_NtUserSendInput_win10); inline_hooks_manager::fn_get_instance()->inline_install_hook(_ntSendInput, mouse_key_win10::hkNtUserSendInput, (void**)&origon_NtUserSendInput_win10);
} }
kernel_function::ke_unstack_detach_process(apc_state); //kernel_function::ke_unstack_detach_process(apc_state);
ObDereferenceObject(_eprocess_process); //ObDereferenceObject(_eprocess_process);
return 0; return 0;
} }
@@ -83,11 +91,11 @@ namespace mouse_keybord_hook
auto apc_state = kernel_function::ke_stack_attch_process(_eprocess_process); auto apc_state = kernel_function::ke_stack_attch_process(_eprocess_process);
inline_hooks_manager::fn_get_instance()->inline_remov_hook((void**)_ntSendInput); auto status = inline_hooks_manager::fn_get_instance()->inline_remov_hook((void**)_ntSendInput);
kernel_function::ke_unstack_detach_process(apc_state); kernel_function::ke_unstack_detach_process(apc_state);
ObDereferenceObject(_eprocess_process); ObDereferenceObject(_eprocess_process);
return 0; return status;
} }
} }
Anti-Cheat_Driver/ob_reg_callback.cpp
+1 -1
View File
@@ -37,7 +37,7 @@ auto ob_call_back::register_ob_reg_callback() -> NTSTATUS
if(is_allow_process(image_file_name)) if(is_allow_process(image_file_name))
goto end; goto end;
if (protect_filter::is_protect_pid(HandleToLong(dwPid), nullptr)) if (protect_filter::is_protect_pid(HandleToLong(dwPid)))
{ {
pOperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess = 0; pOperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess = 0;
pOperationInformation->Parameters->DuplicateHandleInformation.OriginalDesiredAccess = 0; pOperationInformation->Parameters->DuplicateHandleInformation.OriginalDesiredAccess = 0;
Anti-Cheat_Driver/process_notify_callback.cpp
+8 -6
View File
@@ -15,15 +15,17 @@ namespace process_notify_callback
{ {
//进程退出时进行 对插链的清理操作 //进程退出时进行 对插链的清理操作
if (protect_filter::is_protect_pid(HandleToLong(ProcessId), nullptr)) if (protect_filter::is_protect_pid(HandleToLong(ProcessId))) {
protect_filter::remove_protect_list(g_protect_list, HandleToLong(ProcessId), nullptr);
if (protect_filter::is_white_pid(HandleToLong(ProcessId), nullptr)) //DbgPrintEx(77, 0, "%p\n", ProcessId);
{
protect_filter::remove_protect_list(HandleToLong(ProcessId), nullptr);
DbgBreakPoint();
protect_filter::remove_protect_list(g_white_list, HandleToLong(ProcessId), nullptr);
} }
if (protect_filter::is_white_pid(HandleToLong(ProcessId)))
protect_filter::remove_white_list( HandleToLong(ProcessId), nullptr);
} }
/*DbgPrintEx(77, 0, "ParentId:%d | ProcessId:%d | Create:%d\n", /*DbgPrintEx(77, 0, "ParentId:%d | ProcessId:%d | Create:%d\n",
Anti-Cheat_Driver/protect_filter.cpp
+65 -28
View File
@@ -1,7 +1,7 @@
#include "protect_filter.h" #include "protect_filter.h"
LIST_ENTRY g_protect_list; LIST_ENTRY g_protect_list = { 0 };
LIST_ENTRY g_white_list; LIST_ENTRY g_white_list = { 0 };
namespace protect_filter namespace protect_filter
{ {
@@ -13,6 +13,12 @@ namespace protect_filter
auto add_protect_list(ULONG Pid, HWND hwnd, BOOL is_white)->BOOL auto add_protect_list(ULONG Pid, HWND hwnd, BOOL is_white)->BOOL
{ {
PEPROCESS process{ 0 };
if (!NT_SUCCESS(PsLookupProcessByProcessId(UlongToHandle(Pid), &process)))
return FALSE;
ObDereferenceObject(process);
auto PFilter = reinterpret_cast<PFILTER>(ExAllocatePoolWithTag(PagedPool, sizeof(FILTER), 'wag')); auto PFilter = reinterpret_cast<PFILTER>(ExAllocatePoolWithTag(PagedPool, sizeof(FILTER), 'wag'));
if (!PFilter) if (!PFilter)
return FALSE; return FALSE;
@@ -21,12 +27,7 @@ namespace protect_filter
if (Pid) if (Pid)
{ {
PEPROCESS eprocess{ 0 };
if (!NT_SUCCESS(PsLookupProcessByProcessId(ULongToHandle(Pid), &eprocess)))
return FALSE;
PFilter->Pid = Pid; PFilter->Pid = Pid;
PFilter->Eprocess = eprocess;
} }
if (hwnd) if (hwnd)
{ {
@@ -40,7 +41,7 @@ namespace protect_filter
return TRUE; return TRUE;
} }
auto is_protect_pid(ULONG Pid, PEPROCESS Eprocess)->BOOL auto is_protect_pid(ULONG Pid)->BOOL
{ {
if (IsListEmpty(&g_protect_list)) if (IsListEmpty(&g_protect_list))
return NULL; return NULL;
@@ -51,22 +52,20 @@ namespace protect_filter
auto list_data = reinterpret_cast<PFILTER>(CONTAINING_RECORD(list_head, FILTER, List)); auto list_data = reinterpret_cast<PFILTER>(CONTAINING_RECORD(list_head, FILTER, List));
list_head = list_head->Flink; list_head = list_head->Flink;
if (Pid) if (MmIsAddressValid(list_data))
{ {
if (list_data->Pid == Pid) if (Pid)
return TRUE; {
} if (list_data->Pid == Pid)
if (Eprocess) return TRUE;
{ }
if (list_data->Eprocess == Eprocess)
return TRUE;
} }
} }
return FALSE; return FALSE;
} }
auto is_white_pid(ULONG Pid, PEPROCESS Eprocess)->BOOL auto is_white_pid(ULONG Pid)->BOOL
{ {
if (IsListEmpty(&g_white_list)) if (IsListEmpty(&g_white_list))
return NULL; return NULL;
@@ -82,35 +81,73 @@ namespace protect_filter
if (list_data->Pid == Pid) if (list_data->Pid == Pid)
return TRUE; return TRUE;
} }
if (Eprocess)
{
if (list_data->Eprocess == Eprocess)
return TRUE;
}
} }
return FALSE; return FALSE;
} }
auto remove_protect_list(LIST_ENTRY list_entry, ULONG Pid, HWND hwnd)->BOOL auto remove_protect_list(ULONG Pid, HWND hwnd)->BOOL
{ {
UNREFERENCED_PARAMETER(hwnd); UNREFERENCED_PARAMETER(hwnd);
BOOL is_remove_list = FALSE; BOOL is_remove_list = FALSE;
if (IsListEmpty(&list_entry)) //auto List_Entry = list_entry;
if (IsListEmpty(&g_protect_list))
return FALSE; return FALSE;
auto list_head = list_entry.Flink; auto list_head = g_protect_list.Flink;
while (list_head != &list_entry) while (list_head != &g_protect_list)
{ {
auto list_data = reinterpret_cast<PFILTER>(CONTAINING_RECORD(list_head, FILTER, List)); auto list_data = reinterpret_cast<PFILTER>(CONTAINING_RECORD(list_head, FILTER, List));
list_head = list_head->Flink; list_head = list_head->Flink;
//DbgPrintEx(77, 0, "[+]list_head:%p | list_entry:%p\n", list_head, list_head);
if (list_data->Pid == Pid) if (list_data->Pid == Pid)
{ {
//DbgPrintEx(77, 0, "[+]%d\n", list_data->Pid);
RemoveEntryList(list_head->Blink);
is_remove_list = TRUE;
}
if (is_remove_list)
{
ExFreePoolWithTag(list_data, 'wag');
return TRUE;
}
}
return FALSE;
}
auto remove_white_list(ULONG Pid, HWND hwnd)->BOOL
{
UNREFERENCED_PARAMETER(hwnd);
BOOL is_remove_list = FALSE;
//auto List_Entry = list_entry;
if (IsListEmpty(&g_white_list))
return FALSE;
auto list_head = g_white_list.Flink;
while (list_head != &g_white_list)
{
auto list_data = reinterpret_cast<PFILTER>(CONTAINING_RECORD(list_head, FILTER, List));
list_head = list_head->Flink;
//DbgPrintEx(77, 0, "[+]list_head:%p | list_entry:%p\n", list_head, list_head);
if (list_data->Pid == Pid)
{
//DbgPrintEx(77, 0, "[+]%d\n", list_data->Pid);
RemoveEntryList(list_head->Blink); RemoveEntryList(list_head->Blink);
is_remove_list = TRUE; is_remove_list = TRUE;
} }
Anti-Cheat_Driver/protect_filter.h
+6 -4
View File
@@ -4,7 +4,7 @@
typedef struct _FILTER typedef struct _FILTER
{ {
LIST_ENTRY List; LIST_ENTRY List;
PEPROCESS Eprocess; //PEPROCESS Eprocess;
ULONG Pid; ULONG Pid;
HWND hWnd; HWND hWnd;
}FILTER,*PFILTER; }FILTER,*PFILTER;
@@ -18,9 +18,11 @@ namespace protect_filter
auto add_protect_list(ULONG Pid, HWND hwnd, BOOL is_white)->BOOL; auto add_protect_list(ULONG Pid, HWND hwnd, BOOL is_white)->BOOL;
auto is_protect_pid(ULONG Pid, PEPROCESS Eprocess) -> BOOL; auto is_protect_pid(ULONG Pid) -> BOOL;
auto is_white_pid(ULONG Pid, PEPROCESS Eprocess)->BOOL; auto is_white_pid(ULONG Pid)->BOOL;
auto remove_protect_list(LIST_ENTRY list_entry, ULONG Pid, HWND hwnd)->BOOL; auto remove_protect_list(ULONG Pid, HWND hwnd)->BOOL;
auto remove_white_list(ULONG Pid, HWND hwnd)->BOOL;
} }