diff --git a/Anti-Cheat_Driver/load_Image_callback.cpp b/Anti-Cheat_Driver/load_Image_callback.cpp index 3a9f244..a247bf8 100644 --- a/Anti-Cheat_Driver/load_Image_callback.cpp +++ b/Anti-Cheat_Driver/load_Image_callback.cpp @@ -2,6 +2,10 @@ namespace load_image_notify_routine { + + typedef NTSTATUS(__fastcall* fnMmUnloadSystemImage)(PVOID ImageBase); + fnMmUnloadSystemImage _MmUnloadSystemImage = (fnMmUnloadSystemImage)0xfffff800042748a0; + VOID load_image_notify_routine( PUNICODE_STRING FullImageName, HANDLE ProcessId, @@ -16,10 +20,13 @@ namespace load_image_notify_routine if (wcsstr(FullImageName->Buffer, L"MyDriver1")) { - DbgPrintEx(77, 0, "[+] %ws | pid:%d\n", FullImageName->Buffer, ProcessId); + //DbgBreakPoint(); - ZwUnmapViewOfSection(PsGetCurrentProcess(), ImageInfo->ImageBase); + //DbgPrintEx(77, 0, "[+] %ws | pid:%d\n", FullImageName->Buffer, ProcessId); + //auto status = _MmUnloadSystemImage(ImageInfo->ImageBase); + + //DbgPrintEx(77, 0, "%x\n", status); } }