fix unload thread

Anti-Cheat_Driver/create_thread_callback.cpp

@@ -3,15 +3,11 @@
 #include "kernel_function.h"
 #include "utils.h"
 
-#pragma warning(disable : 4309)
-#pragma warning(disable : 4838)
-
+#pragma warning(disable : 4309 4838)
 namespace thread_notify_routine
 {
 	//保护的进程ID
 	//auto protect_id = ULongToHandle(8976);
-
-
 	void thread_notify_routine(HANDLE ProcessId, HANDLE ThreadId, BOOLEAN Create)
 	{
 		if (Create)
@@ -46,17 +42,16 @@ namespace thread_notify_routine
 
 				DbgPrintEx(77, 0, "[!] 被创建线程ID: %d\n", ThreadId);
 			}
-
-			
-
 		end:	
 			ObDereferenceObject(process);
 		}
 	}
 
+	uintptr_t trampoline_ptr = NULL;
+
 	auto create_thread_routine() -> NTSTATUS
 	{
-		auto trampoline_ptr = utils::get_beep_trampoline_ptr();
+		trampoline_ptr = utils::get_beep_trampoline_ptr();
 		if (trampoline_ptr)
 		{
 			char jmprax[] = { 0x48, 0xB8, 0xA0, 0x9A, 0xD5, 0x3E, 0xFE, 0x7F, 0x00, 0x00, 0xFF, 0xE0 };
@@ -74,10 +69,15 @@ namespace thread_notify_routine
 
 	auto unload_thread_routine() -> NTSTATUS
 	{
-		//auto trampoline_ptr = utils::get_beep_trampoline_ptr();
-		return PsRemoveCreateThreadNotifyRoutine(thread_notify_routine);
+		auto status = PsRemoveCreateThreadNotifyRoutine((PCREATE_PROCESS_NOTIFY_ROUTINE)trampoline_ptr);
+		if (!NT_SUCCESS(status))
+			return status;
+
+		char nullcode[12]{ 0 };
+		status = kernel_function::MmMDLPagesCopy((PVOID)trampoline_ptr, &nullcode, sizeof(nullcode), 0x0000002, KernelMode);
+		if (!NT_SUCCESS(status))
+			return status;
+
+		return STATUS_SUCCESS;
 	}
-
-
-	
 }