maowengrui/anit-cheat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix unload thread

Browse Source
This commit is contained in:
maowenrui
2026-06-23 13:18:29 +08:00
parent 0df0e40cf2
commit 9c8c165efa
1 changed files with 14 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Anti-Cheat_Driver/create_thread_callback.cpp
+14 -14
View File
@@ -3,15 +3,11 @@
#include "kernel_function.h" #include "kernel_function.h"
#include "utils.h" #include "utils.h"
#pragma warning(disable : 4309) #pragma warning(disable : 4309 4838)
#pragma warning(disable : 4838)
namespace thread_notify_routine namespace thread_notify_routine
{ {
//保护的进程ID //保护的进程ID
//auto protect_id = ULongToHandle(8976); //auto protect_id = ULongToHandle(8976);
void thread_notify_routine(HANDLE ProcessId, HANDLE ThreadId, BOOLEAN Create) void thread_notify_routine(HANDLE ProcessId, HANDLE ThreadId, BOOLEAN Create)
{ {
if (Create) if (Create)
@@ -46,17 +42,16 @@ namespace thread_notify_routine
DbgPrintEx(77, 0, "[!] 被创建线程ID: %d\n", ThreadId); DbgPrintEx(77, 0, "[!] 被创建线程ID: %d\n", ThreadId);
} }
end: end:
ObDereferenceObject(process); ObDereferenceObject(process);
} }
} }
uintptr_t trampoline_ptr = NULL;
auto create_thread_routine() -> NTSTATUS auto create_thread_routine() -> NTSTATUS
{ {
auto trampoline_ptr = utils::get_beep_trampoline_ptr(); trampoline_ptr = utils::get_beep_trampoline_ptr();
if (trampoline_ptr) if (trampoline_ptr)
{ {
char jmprax[] = { 0x48, 0xB8, 0xA0, 0x9A, 0xD5, 0x3E, 0xFE, 0x7F, 0x00, 0x00, 0xFF, 0xE0 }; char jmprax[] = { 0x48, 0xB8, 0xA0, 0x9A, 0xD5, 0x3E, 0xFE, 0x7F, 0x00, 0x00, 0xFF, 0xE0 };
@@ -74,10 +69,15 @@ namespace thread_notify_routine
auto unload_thread_routine() -> NTSTATUS auto unload_thread_routine() -> NTSTATUS
{ {
//auto trampoline_ptr = utils::get_beep_trampoline_ptr(); auto status = PsRemoveCreateThreadNotifyRoutine((PCREATE_PROCESS_NOTIFY_ROUTINE)trampoline_ptr);
return PsRemoveCreateThreadNotifyRoutine(thread_notify_routine); if (!NT_SUCCESS(status))
return status;
char nullcode[12]{ 0 };
status = kernel_function::MmMDLPagesCopy((PVOID)trampoline_ptr, &nullcode, sizeof(nullcode), 0x0000002, KernelMode);
if (!NT_SUCCESS(status))
return status;
return STATUS_SUCCESS;
} }
} }