From a514b171485d5f9b6a947a6e245707ec33dbe0d6 Mon Sep 17 00:00:00 2001 From: maowenrui <3505719167@qq.com> Date: Wed, 3 Jun 2026 10:28:55 +0800 Subject: [PATCH] fix is_allow_process function win10 if fail --- Anti-Cheat_Driver/ob_reg_callback.cpp | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/Anti-Cheat_Driver/ob_reg_callback.cpp b/Anti-Cheat_Driver/ob_reg_callback.cpp index 9aaa047..def399f 100644 --- a/Anti-Cheat_Driver/ob_reg_callback.cpp +++ b/Anti-Cheat_Driver/ob_reg_callback.cpp @@ -1,4 +1,5 @@ #include "ob_reg_callback.h" +#include "protect_filter.h" void* reg_ob_callback_handle; @@ -8,7 +9,8 @@ auto is_allow_process(PUNICODE_STRING image_file_name) -> BOOL if (!image_file_name->Buffer) return FALSE; - if (wcsstr(image_file_name->Buffer, L"\\System32\\taskmgr.exe")) + if (wcsstr(image_file_name->Buffer, L"\\System32\\taskmgr.exe") || + wcsstr(image_file_name->Buffer, L"\\System32\\Taskmgr.exe")) return TRUE; return FALSE; @@ -32,7 +34,7 @@ auto ob_call_back::register_ob_reg_callback() -> NTSTATUS if(is_allow_process(image_file_name)) goto end; - if (dwPid == ULongToHandle(1836)) + if (protect_filter::is_protect_pid(HandleToLong(dwPid))) { pOperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess = 0; pOperationInformation->Parameters->DuplicateHandleInformation.OriginalDesiredAccess = 0;