init

Anti-Cheat_Driver.sln

@@ -5,6 +5,10 @@ VisualStudioVersion = 16.0.37206.5
 MinimumVisualStudioVersion = 10.0.40219.1
 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Anti-Cheat_Driver", "Anti-Cheat_Driver\Anti-Cheat_Driver.vcxproj", "{E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}"
 EndProject
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Anit-Cheat_EXE", "Anit-Cheat_EXE\Anit-Cheat_EXE.vcxproj", "{17DDE567-4EAA-4E85-B533-02C4E6451072}"
+EndProject
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Anit-Cheat_DLL", "Anit-Cheat_DLL\Anit-Cheat_DLL.vcxproj", "{5CABFAE0-D81B-47A9-A7BA-BC7510BE19DF}"
+EndProject
 Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug|ARM = Debug|ARM
@@ -41,6 +45,30 @@ Global
 		{E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Release|x86.ActiveCfg = Release|Win32
 		{E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Release|x86.Build.0 = Release|Win32
 		{E15AAB35-A0F2-4401-A41C-4AB5B200C6AD}.Release|x86.Deploy.0 = Release|Win32
+		{17DDE567-4EAA-4E85-B533-02C4E6451072}.Debug|ARM.ActiveCfg = Debug|Win32
+		{17DDE567-4EAA-4E85-B533-02C4E6451072}.Debug|ARM64.ActiveCfg = Debug|Win32
+		{17DDE567-4EAA-4E85-B533-02C4E6451072}.Debug|x64.ActiveCfg = Debug|x64
+		{17DDE567-4EAA-4E85-B533-02C4E6451072}.Debug|x64.Build.0 = Debug|x64
+		{17DDE567-4EAA-4E85-B533-02C4E6451072}.Debug|x86.ActiveCfg = Debug|Win32
+		{17DDE567-4EAA-4E85-B533-02C4E6451072}.Debug|x86.Build.0 = Debug|Win32
+		{17DDE567-4EAA-4E85-B533-02C4E6451072}.Release|ARM.ActiveCfg = Release|Win32
+		{17DDE567-4EAA-4E85-B533-02C4E6451072}.Release|ARM64.ActiveCfg = Release|Win32
+		{17DDE567-4EAA-4E85-B533-02C4E6451072}.Release|x64.ActiveCfg = Release|x64
+		{17DDE567-4EAA-4E85-B533-02C4E6451072}.Release|x64.Build.0 = Release|x64
+		{17DDE567-4EAA-4E85-B533-02C4E6451072}.Release|x86.ActiveCfg = Release|Win32
+		{17DDE567-4EAA-4E85-B533-02C4E6451072}.Release|x86.Build.0 = Release|Win32
+		{5CABFAE0-D81B-47A9-A7BA-BC7510BE19DF}.Debug|ARM.ActiveCfg = Debug|Win32
+		{5CABFAE0-D81B-47A9-A7BA-BC7510BE19DF}.Debug|ARM64.ActiveCfg = Debug|Win32
+		{5CABFAE0-D81B-47A9-A7BA-BC7510BE19DF}.Debug|x64.ActiveCfg = Debug|x64
+		{5CABFAE0-D81B-47A9-A7BA-BC7510BE19DF}.Debug|x64.Build.0 = Debug|x64
+		{5CABFAE0-D81B-47A9-A7BA-BC7510BE19DF}.Debug|x86.ActiveCfg = Debug|Win32
+		{5CABFAE0-D81B-47A9-A7BA-BC7510BE19DF}.Debug|x86.Build.0 = Debug|Win32
+		{5CABFAE0-D81B-47A9-A7BA-BC7510BE19DF}.Release|ARM.ActiveCfg = Release|Win32
+		{5CABFAE0-D81B-47A9-A7BA-BC7510BE19DF}.Release|ARM64.ActiveCfg = Release|Win32
+		{5CABFAE0-D81B-47A9-A7BA-BC7510BE19DF}.Release|x64.ActiveCfg = Release|x64
+		{5CABFAE0-D81B-47A9-A7BA-BC7510BE19DF}.Release|x64.Build.0 = Release|x64
+		{5CABFAE0-D81B-47A9-A7BA-BC7510BE19DF}.Release|x86.ActiveCfg = Release|Win32
+		{5CABFAE0-D81B-47A9-A7BA-BC7510BE19DF}.Release|x86.Build.0 = Release|Win32
 	EndGlobalSection
 	GlobalSection(SolutionProperties) = preSolution
 		HideSolutionNode = FALSE

Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj

@@ -42,6 +42,7 @@
     <Configuration>Debug</Configuration>
     <Platform Condition="'$(Platform)' == ''">Win32</Platform>
     <RootNamespace>Anti_Cheat_Driver</RootNamespace>
+    <WindowsTargetPlatformVersion>$(LatestTargetPlatformVersion)</WindowsTargetPlatformVersion>
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
@@ -71,7 +72,7 @@
     <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
     <ConfigurationType>Driver</ConfigurationType>
     <DriverType>WDM</DriverType>
-    <Driver_SpectreMitigation>Spectre</Driver_SpectreMitigation>
+    <Driver_SpectreMitigation>false</Driver_SpectreMitigation>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'" Label="Configuration">
     <TargetVersion>Windows10</TargetVersion>
@@ -114,12 +115,18 @@
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
     <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
+    <TargetName>$(TargetName.Replace(' ',''))</TargetName>
+    <OutDir>$(SolutionDir)Bin\$(Platform)\</OutDir>
+    <IntDir>$(Platform)\</IntDir>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
     <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
     <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
+    <TargetName>Anti_Cheat_Driver</TargetName>
+    <OutDir>$(SolutionDir)Bin\$(Platform)\</OutDir>
+    <IntDir>$(Platform)\</IntDir>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'">
     <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>

Anti-Cheat_Driver/comm_dispatch.cpp

@@ -1,11 +1,15 @@
 #include "comm_dispatch.h"
 #include "protect_filter.h"
 #include "anit_screen_grap.h"
+#include "create_thread_callback.h"
+#include "mouse_keybord_hook.h"
+
 namespace comm_dispatch
 {
 	auto dispatch(CMD_COMM* data) -> NTSTATUS
 	{
 		auto status = STATUS_UNSUCCESSFUL;
+
 		switch (data->CommID)
 		{
 		case CMD::DRIVER_COMM_TEST:
@@ -19,6 +23,12 @@ namespace comm_dispatch
 			status = protect_filter::add_protect_list((ULONG)process_data->Pid, NULL, FALSE);
 			break;
 		}
+		case CMD::DRIVER_CANCEL_PROTECT_PROCESS:
+		{
+			auto process_data = (IOCTL_PROCESS*)data->Buf;
+			status = protect_filter::remove_protect_list((ULONG)process_data->Pid, NULL);
+			break;
+		}
 		case CMD::ADD_WHITE_PROCESS:
 		{
 			auto process_data = (IOCTL_PROCESS*)data->Buf;
@@ -34,6 +44,42 @@ namespace comm_dispatch
 
 			break;
 		}
+		case CMD::USER_EVENT_HANDLE:
+		{
+			auto user_handle = (HANDLE*)data->Buf;
+
+			status = ObReferenceObjectByHandle(
+				*user_handle,
+				EVENT_MODIFY_STATE,
+				*ExEventObjectType,
+				UserMode,
+				(PVOID*)&thread_notify_routine::g_UserEvent,
+				NULL);
+
+
+			DbgPrintEx(77, 0, "ObReferenceObjectByHandle[status]:%x\n", status);
+			DbgPrintEx(77, 0, "g_UserEvent:%p\n", thread_notify_routine::g_UserEvent);
+
+
+			break;
+		}
+		case CMD::PROTECT_THREAD_CONTRL:
+		{
+			auto process_data = (IOCTL_PROCESS*)data->Buf;
+			thread_notify_routine::g_thread_protect = process_data->is_no_create_remote_thread;
+			status = STATUS_SUCCESS;
+			break;
+		}
+		case CMD::INSTALL_MOUSE_KEYBOARD:
+		{
+			status = mouse_keybord_hook::install_mouse_keybord_hook();
+			break;
+		}
+		case CMD::UNLOAD_MOUSE_KEYBOARD:
+		{
+			status = mouse_keybord_hook::remove_mouse_keybord_hook();
+			break;
+		}
 		default:
 			break;
 		}

Anti-Cheat_Driver/comm_dispatch.h

@@ -11,6 +11,7 @@ struct CMD_COMM
 struct IOCTL_PROCESS
 {
 	DWORD64 Pid;
+	BOOL is_no_create_remote_thread;
 };
 
 struct IOCTL_WINDOW
@@ -23,8 +24,13 @@ enum CMD
 	MSG_BASE = 0x10000,
 	DRIVER_COMM_TEST,
 	DRIVER_PROTECT_PROCESS,
+	DRIVER_CANCEL_PROTECT_PROCESS,
 	ADD_WHITE_PROCESS,
 	WINDOW_ANIT_SCREEN,
+	USER_EVENT_HANDLE,
+	PROTECT_THREAD_CONTRL,
+	INSTALL_MOUSE_KEYBOARD,
+	UNLOAD_MOUSE_KEYBOARD,
 };
 
 namespace comm_dispatch

Anti-Cheat_Driver/create_thread_callback.cpp

@@ -15,9 +15,10 @@ EXTERN_C NTKERNELAPI NTSTATUS ZwOpenThread(
 	_In_ PCLIENT_ID ClientId
 	);
 
-
 namespace thread_notify_routine
 {
+	PKEVENT g_UserEvent = NULL;      // 用户态传入的事件对象
+	BOOL g_thread_protect;
 
 	// 打开线程句柄并终止
 	NTSTATUS TerminateThreadByHandle(
@@ -69,7 +70,6 @@ namespace thread_notify_routine
 	{
 		if (Create)
 		{
-
 			PEPROCESS process{ 0 };
 			auto status = PsLookupProcessByProcessId(ProcessId, &process);
 			if (!NT_SUCCESS(status))
@@ -80,7 +80,7 @@ namespace thread_notify_routine
 			if (!NT_SUCCESS(status))
 				goto end;*/
 
-			if(!protect_filter::is_protect_pid(0, process))
+			if (!protect_filter::is_protect_pid(HandleToLong(ProcessId)))
 				goto end;
 
 			/*if (protect_process != process)
@@ -94,17 +94,19 @@ namespace thread_notify_routine
 			{
 				//DbgBreakPoint();
 
-				DbgPrintEx(77, 0, "[!] 恶意远程线程检测！\n");
+				//DbgPrintEx(77, 0, "[!] 恶意远程线程检测！\n");
+				//
+				//DbgPrintEx(77, 0, "[!] 目标进程ID: %d\n", ProcessId);
+				//
+				//DbgPrintEx(77, 0, "[!] 创建者进程ID: %d\n", cutor_process_id);
+				//
+				//DbgPrintEx(77, 0, "[!] 被创建线程ID: %d\n", ThreadId);
 
-				DbgPrintEx(77, 0, "[!] 目标进程ID: %d\n", ProcessId);
+				if (g_thread_protect)
-
+				{
-				DbgPrintEx(77, 0, "[!] 创建者进程ID: %d\n", cutor_process_id);
+					TerminateThreadByHandle(ProcessId, ThreadId);
-
+				}
-				DbgPrintEx(77, 0, "[!] 被创建线程ID: %d\n", ThreadId);
+				//KeSetEvent(g_UserEvent, IO_NO_INCREMENT, FALSE);
-
-
-				TerminateThreadByHandle(ProcessId, ThreadId);
-	
 			}
 		end:	
 			ObDereferenceObject(process);

Anti-Cheat_Driver/create_thread_callback.h

@@ -3,9 +3,13 @@
 
 namespace thread_notify_routine
 {
+	extern BOOL g_thread_protect;
+
+	extern PKEVENT g_UserEvent;
 
 	auto create_thread_routine()->NTSTATUS;
 
 	auto unload_thread_routine()->NTSTATUS;
 
+
 }

Anti-Cheat_Driver/driver_main.cpp

@@ -20,8 +20,6 @@ EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING)
 			process_notify_callback::remov_process_notify();
 			thread_notify_routine::unload_thread_routine();
 
-			mouse_keybord_hook::remove_mouse_keybord_hook();
-
 			//load_image_notify_routine::remove_image_load_notify_routine();
 		};
 	}
@@ -30,15 +28,16 @@ EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING)
 	kernel_api::kernel_api_init();
 	kernel_comm_create::Init();
 
-	protect_filter::add_protect_list(3632, 0, FALSE);
+	//把保护的进程插入到链表中
+	//protect_filter::add_protect_list(12204, 0, FALSE);
 
-
+	//mouse_keybord_hook::install_mouse_keybord_hook();
-	mouse_keybord_hook::install_mouse_keybord_hook();
+	DbgPrintEx(77, 0, "[+]ob_reg_callback status:%x\n", ob_call_back::register_ob_reg_callback());
-	//DbgPrintEx(77, 0, "[+]ob_reg_callback status:%x\n", ob_call_back::register_ob_reg_callback());
 	DbgPrintEx(77, 0, "[+]process_notify_callback status:%x\n", process_notify_callback::install_process_notify());
 	DbgPrintEx(77, 0, "[+]create_thread_routine status:%x\n", thread_notify_routine::create_thread_routine());
 
-	//load_image_notify_routine::create_image_load_notify_routine();
 
+	//我过滤了那个任务管理器 所以看不了结束进程效果 直接看能不能读搜索就行了 没有图标吧
+	//也搜索不了 我这个就是内存加载 也不会蓝屏啊
 	return STATUS_SUCCESS;
 }

Anti-Cheat_Driver/kernel_api.cpp

@@ -25,6 +25,9 @@ namespace kernel_api
 
 		RtlInitUnicodeString(&unFuncName, L"ZwOpenThread");
 		imported.nt_open_thread = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
+
+		RtlInitUnicodeString(&unFuncName, L"ObOpenObjectByName");
+		imported.ob_open_object_by_name = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
 	}
 
 	NTSTATUS ntquerysysteminformation(ULONG SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength)
@@ -60,5 +63,10 @@ namespace kernel_api
 		return reinterpret_cast<NTSTATUS(*)(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, PCLIENT_ID)>(imported.nt_open_thread)
 			(ThreadHandle, DesiredAccess, ObjectAttributes, ClientId);
 	}
+	NTSTATUS obopenobjectbyname(POBJECT_ATTRIBUTES ObjectAttributes, POBJECT_TYPE ObjectType, KPROCESSOR_MODE AccessMode, PACCESS_STATE AccessState, ACCESS_MASK DesiredAccess, PVOID ParseContext, PHANDLE Handle)
+	{
+		return reinterpret_cast<NTSTATUS(*)(POBJECT_ATTRIBUTES, POBJECT_TYPE, KPROCESSOR_MODE, PACCESS_STATE, ACCESS_MASK, PVOID, PHANDLE)>
+			(imported.ob_open_object_by_name)(ObjectAttributes, ObjectType, AccessMode, AccessState, DesiredAccess, ParseContext, Handle);
+	}
 }
 	

Anti-Cheat_Driver/kernel_api.h

@@ -20,6 +20,7 @@ struct imported_
 	ULONG64 ps_getprocess_id;
 	ULONG64 se_locateprocess_imagename;
 	ULONG64 nt_open_thread;
+	ULONG64 ob_open_object_by_name;
 };
 
 namespace kernel_api
@@ -42,4 +43,14 @@ namespace kernel_api
 	PVOID rtlfindexportedroutinebyname(PVOID ImageBase, PCCH RoutineName);
 
 	NTSTATUS ntopenthread(PHANDLE ThreadHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId);
+
+	NTSTATUS obopenobjectbyname(
+		POBJECT_ATTRIBUTES ObjectAttributes,
+		POBJECT_TYPE ObjectType,
+		KPROCESSOR_MODE AccessMode,
+		PACCESS_STATE AccessState,
+		ACCESS_MASK DesiredAccess,
+		PVOID ParseContext,
+		PHANDLE Handle
+	);
 }

Anti-Cheat_Driver/mouse_key_win10.cpp

@@ -9,7 +9,7 @@ namespace mouse_key_win10
 	__int64 __fastcall hkNtUserSendInput(unsigned int a1, volatile void* a2, int a3, int a4)
 	{
 		auto pid = PsGetCurrentProcessId();
-		if (protect_filter::is_white_pid(HandleToLong(pid), NULL))
+		if (protect_filter::is_white_pid(HandleToLong(pid)))
 			return origon_NtUserSendInput_win10(a1, a2, a3, a4);
 			
 

Anti-Cheat_Driver/mouse_key_win7.cpp

@@ -8,7 +8,7 @@ namespace mouse_key_win7
 	{
 		auto pid = PsGetCurrentProcessId();
 
-		if(protect_filter::is_white_pid(HandleToLong(pid), NULL))
+		if(protect_filter::is_white_pid(HandleToLong(pid)))
 			return origon_NtUserSendInput_win7(a1, a2, a3);
 		
 		return NULL;

Anti-Cheat_Driver/mouse_keybord_hook.cpp

@@ -52,14 +52,22 @@ namespace mouse_keybord_hook
 
 	auto install_mouse_keybord_hook() -> BOOL
 	{
-		auto _eprocess_process = kernel_function::FindProcess("winlogon.exe");
+		//auto _eprocess_process = kernel_function::FindProcess("winlogon.exe");
-		if (!_eprocess_process)
+		//if (!_eprocess_process)
-			return FALSE;
+		//	return FALSE;
-
+		//
-		auto apc_state = kernel_function::ke_stack_attch_process(_eprocess_process);
+		//auto apc_state = kernel_function::ke_stack_attch_process(_eprocess_process);
-
-		_ntSendInput = get_sendinput_hook_addr();
 
+		if (!_ntSendInput)
+		{
+			_ntSendInput = get_sendinput_hook_addr();
+		}
+		else
+		{
+			if (_ntSendInput[0] == 0xff || _ntSendInput[1] == 0x25)
+				return TRUE;
+		}
+		
 		auto os = utils::GetVersion();
 		if (os.dwBuildNumber == 7600 || os.dwBuildNumber == 7601)
 		{
@@ -70,8 +78,8 @@ namespace mouse_keybord_hook
 			inline_hooks_manager::fn_get_instance()->inline_install_hook(_ntSendInput, mouse_key_win10::hkNtUserSendInput, (void**)&origon_NtUserSendInput_win10);
 		}
 
-		kernel_function::ke_unstack_detach_process(apc_state);
+		//kernel_function::ke_unstack_detach_process(apc_state);
-		ObDereferenceObject(_eprocess_process);
+		//ObDereferenceObject(_eprocess_process);
 		return 0;
 	}
 
@@ -83,11 +91,11 @@ namespace mouse_keybord_hook
 
 		auto apc_state = kernel_function::ke_stack_attch_process(_eprocess_process);
 
-		inline_hooks_manager::fn_get_instance()->inline_remov_hook((void**)_ntSendInput);
+		auto status = inline_hooks_manager::fn_get_instance()->inline_remov_hook((void**)_ntSendInput);
 
 		kernel_function::ke_unstack_detach_process(apc_state);
 		ObDereferenceObject(_eprocess_process);
-		return 0;
+		return status;
 	}
 
 }

Anti-Cheat_Driver/ob_reg_callback.cpp

@@ -37,7 +37,7 @@ auto ob_call_back::register_ob_reg_callback() -> NTSTATUS
 			if(is_allow_process(image_file_name))
 				goto end;
 				
-			if (protect_filter::is_protect_pid(HandleToLong(dwPid), nullptr))
+			if (protect_filter::is_protect_pid(HandleToLong(dwPid)))
 			{
 				pOperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess = 0;
 				pOperationInformation->Parameters->DuplicateHandleInformation.OriginalDesiredAccess = 0;

Anti-Cheat_Driver/process_notify_callback.cpp

@@ -15,15 +15,17 @@ namespace process_notify_callback
 		{
 
 			//进程退出时进行 对插链的清理操作
-			if (protect_filter::is_protect_pid(HandleToLong(ProcessId), nullptr))
+			if (protect_filter::is_protect_pid(HandleToLong(ProcessId))) {
-				protect_filter::remove_protect_list(g_protect_list, HandleToLong(ProcessId), nullptr);
 
-			if (protect_filter::is_white_pid(HandleToLong(ProcessId), nullptr))
+				//DbgPrintEx(77, 0, "%p\n", ProcessId);
-			{
+
+				protect_filter::remove_protect_list(HandleToLong(ProcessId), nullptr);
 
-				DbgBreakPoint();
-				protect_filter::remove_protect_list(g_white_list, HandleToLong(ProcessId), nullptr);
 			}
+				
+
+			if (protect_filter::is_white_pid(HandleToLong(ProcessId)))
+				protect_filter::remove_white_list( HandleToLong(ProcessId), nullptr);
 		}
 
 		/*DbgPrintEx(77, 0, "ParentId:%d | ProcessId:%d | Create:%d\n",

Anti-Cheat_Driver/protect_filter.cpp

@@ -1,7 +1,7 @@
 #include "protect_filter.h"
 
-LIST_ENTRY g_protect_list;
+LIST_ENTRY g_protect_list = { 0 };
-LIST_ENTRY g_white_list;
+LIST_ENTRY g_white_list = { 0 };
 
 namespace protect_filter
 {
@@ -13,6 +13,12 @@ namespace protect_filter
 
 	auto add_protect_list(ULONG Pid, HWND hwnd, BOOL is_white)->BOOL
 	{
+		PEPROCESS process{ 0 };
+		if (!NT_SUCCESS(PsLookupProcessByProcessId(UlongToHandle(Pid), &process)))
+			return FALSE;
+
+		ObDereferenceObject(process);
+
 		auto PFilter = reinterpret_cast<PFILTER>(ExAllocatePoolWithTag(PagedPool, sizeof(FILTER), 'wag'));
 		if (!PFilter)
 			return FALSE;
@@ -21,12 +27,7 @@ namespace protect_filter
 
 		if (Pid)
 		{
-			PEPROCESS eprocess{ 0 };
-			if (!NT_SUCCESS(PsLookupProcessByProcessId(ULongToHandle(Pid), &eprocess)))
-				return FALSE;
-
 			PFilter->Pid = Pid;
-			PFilter->Eprocess = eprocess;
 		}
 		if (hwnd)
 		{
@@ -40,7 +41,7 @@ namespace protect_filter
 		return TRUE;
 	}
 
-	auto is_protect_pid(ULONG Pid, PEPROCESS Eprocess)->BOOL
+	auto is_protect_pid(ULONG Pid)->BOOL
 	{
 		if (IsListEmpty(&g_protect_list))
 			return NULL;
@@ -51,22 +52,20 @@ namespace protect_filter
 			auto list_data = reinterpret_cast<PFILTER>(CONTAINING_RECORD(list_head, FILTER, List));
 			list_head = list_head->Flink;
 
-			if (Pid)
+			if (MmIsAddressValid(list_data))
 			{
-				if (list_data->Pid == Pid)
+				if (Pid)
-					return TRUE;
+				{
-			}
+					if (list_data->Pid == Pid)
-			if (Eprocess)
+						return TRUE;
-			{
+				}
-				if (list_data->Eprocess == Eprocess)
-					return TRUE;
 			}
 		}
 
 		return FALSE;
 	}
 
-	auto is_white_pid(ULONG Pid, PEPROCESS Eprocess)->BOOL
+	auto is_white_pid(ULONG Pid)->BOOL
 	{
 		if (IsListEmpty(&g_white_list))
 			return NULL;
@@ -82,35 +81,35 @@ namespace protect_filter
 				if (list_data->Pid == Pid)
 					return TRUE;
 			}
-			if (Eprocess)
-			{
-				if (list_data->Eprocess == Eprocess)
-					return TRUE;
-			}
-
 		}
 
 		return FALSE;
 	}
 
-	auto remove_protect_list(LIST_ENTRY list_entry, ULONG Pid, HWND hwnd)->BOOL
+	auto remove_protect_list(ULONG Pid, HWND hwnd)->BOOL
 	{
 		UNREFERENCED_PARAMETER(hwnd);
-
 		BOOL is_remove_list = FALSE;
 
-		if (IsListEmpty(&list_entry))
+		//auto List_Entry = list_entry;
+
+		if (IsListEmpty(&g_protect_list))
 			return FALSE;
 
-		auto list_head = list_entry.Flink;
+		auto list_head = g_protect_list.Flink;
-		while (list_head != &list_entry)
+		while (list_head != &g_protect_list)
 		{
 			auto list_data = reinterpret_cast<PFILTER>(CONTAINING_RECORD(list_head, FILTER, List));
+
 			list_head = list_head->Flink;
 
 
+			//DbgPrintEx(77, 0, "[+]list_head:%p | list_entry:%p\n", list_head, list_head);
+
 			if (list_data->Pid == Pid)
 			{
+
+				//DbgPrintEx(77, 0, "[+]%d\n", list_data->Pid);
 				RemoveEntryList(list_head->Blink);
 				is_remove_list = TRUE;
 			}
@@ -124,4 +123,42 @@ namespace protect_filter
 		return FALSE;
 		
 	}
+
+	auto remove_white_list(ULONG Pid, HWND hwnd)->BOOL
+	{
+		UNREFERENCED_PARAMETER(hwnd);
+		BOOL is_remove_list = FALSE;
+
+		//auto List_Entry = list_entry;
+
+		if (IsListEmpty(&g_white_list))
+			return FALSE;
+
+		auto list_head = g_white_list.Flink;
+		while (list_head != &g_white_list)
+		{
+			auto list_data = reinterpret_cast<PFILTER>(CONTAINING_RECORD(list_head, FILTER, List));
+
+			list_head = list_head->Flink;
+
+
+			//DbgPrintEx(77, 0, "[+]list_head:%p | list_entry:%p\n", list_head, list_head);
+
+			if (list_data->Pid == Pid)
+			{
+
+				//DbgPrintEx(77, 0, "[+]%d\n", list_data->Pid);
+				RemoveEntryList(list_head->Blink);
+				is_remove_list = TRUE;
+			}
+
+			if (is_remove_list)
+			{
+				ExFreePoolWithTag(list_data, 'wag');
+				return TRUE;
+			}
+		}
+		return FALSE;
+
+	}
 }

Anti-Cheat_Driver/protect_filter.h

@@ -4,7 +4,7 @@
 typedef struct _FILTER
 {
 	LIST_ENTRY List;
-	PEPROCESS Eprocess;
+	//PEPROCESS Eprocess;
 	ULONG Pid;
 	HWND hWnd;
 }FILTER,*PFILTER;
@@ -18,9 +18,11 @@ namespace protect_filter
 
 	auto add_protect_list(ULONG Pid, HWND hwnd, BOOL is_white)->BOOL;
 
-	auto is_protect_pid(ULONG Pid, PEPROCESS Eprocess) -> BOOL;
+	auto is_protect_pid(ULONG Pid) -> BOOL;
 
-	auto is_white_pid(ULONG Pid, PEPROCESS Eprocess)->BOOL;
+	auto is_white_pid(ULONG Pid)->BOOL;
 
-	auto remove_protect_list(LIST_ENTRY list_entry, ULONG Pid, HWND hwnd)->BOOL;
+	auto remove_protect_list(ULONG Pid, HWND hwnd)->BOOL;
+
+	auto remove_white_list(ULONG Pid, HWND hwnd)->BOOL;
 }