diff --git a/Anti-Cheat_Driver/utils.cpp b/Anti-Cheat_Driver/utils.cpp index 051f087..c6bb9cb 100644 --- a/Anti-Cheat_Driver/utils.cpp +++ b/Anti-Cheat_Driver/utils.cpp @@ -1,4 +1,5 @@ #include "utils.h" +#include "kernel_function.h" namespace utils { @@ -64,10 +65,42 @@ namespace utils } + auto get_beep_trampoline_ptr() -> uintptr_t + { + uintptr_t* trampoline_ptr = NULL; + auto beep = kernel_function::GetKernelModule("beep.sys"); + auto nt_header = reinterpret_cast(beep + reinterpret_cast(beep)->e_lfanew); + auto file_header = &nt_header->FileHeader; + auto section_header = IMAGE_FIRST_SECTION(nt_header); + for (size_t i = 0; i < file_header->NumberOfSections; i++) + { + if (!strcmp((char*)section_header[i].Name, ".text")) + { + trampoline_ptr = (uintptr_t*)((beep + section_header[i].VirtualAddress) + section_header[i].Misc.VirtualSize); + } + } + if (trampoline_ptr) + { + unsigned int count = NULL; + unsigned int index = NULL; + while (trampoline_ptr[index] != NULL) + { + if (trampoline_ptr[index] == NULL) + count++; + if (count > 0x08) + break; + + index++; + } + return (uintptr_t)&trampoline_ptr[index]; + } + + return NULL; + } } \ No newline at end of file diff --git a/Anti-Cheat_Driver/utils.h b/Anti-Cheat_Driver/utils.h index 4c68c48..c21682d 100644 --- a/Anti-Cheat_Driver/utils.h +++ b/Anti-Cheat_Driver/utils.h @@ -9,6 +9,6 @@ namespace utils auto kernel_get_expotr_func(wchar_t* func_name) -> uintptr_t; - + auto get_beep_trampoline_ptr()->uintptr_t; } \ No newline at end of file