diff --git a/Anti-Cheat_Driver/ob_reg_callback.cpp b/Anti-Cheat_Driver/ob_reg_callback.cpp index 9aaa047..def399f 100644 --- a/Anti-Cheat_Driver/ob_reg_callback.cpp +++ b/Anti-Cheat_Driver/ob_reg_callback.cpp @@ -1,4 +1,5 @@ #include "ob_reg_callback.h" +#include "protect_filter.h" void* reg_ob_callback_handle; @@ -8,7 +9,8 @@ auto is_allow_process(PUNICODE_STRING image_file_name) -> BOOL if (!image_file_name->Buffer) return FALSE; - if (wcsstr(image_file_name->Buffer, L"\\System32\\taskmgr.exe")) + if (wcsstr(image_file_name->Buffer, L"\\System32\\taskmgr.exe") || + wcsstr(image_file_name->Buffer, L"\\System32\\Taskmgr.exe")) return TRUE; return FALSE; @@ -32,7 +34,7 @@ auto ob_call_back::register_ob_reg_callback() -> NTSTATUS if(is_allow_process(image_file_name)) goto end; - if (dwPid == ULongToHandle(1836)) + if (protect_filter::is_protect_pid(HandleToLong(dwPid))) { pOperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess = 0; pOperationInformation->Parameters->DuplicateHandleInformation.OriginalDesiredAccess = 0;