feat get_beep_trampoline_ptr

Anti-Cheat_Driver/utils.cpp

@@ -1,4 +1,5 @@
 #include "utils.h"
+#include "kernel_function.h"
 
 namespace utils
 {
@@ -64,10 +65,42 @@ namespace utils
 	}
 
 
+	auto get_beep_trampoline_ptr() -> uintptr_t
+	{
+		uintptr_t* trampoline_ptr = NULL;
 
+		auto beep = kernel_function::GetKernelModule("beep.sys");
+		auto nt_header = reinterpret_cast<PIMAGE_NT_HEADERS>(beep + reinterpret_cast<PIMAGE_DOS_HEADER>(beep)->e_lfanew);
+		auto file_header = &nt_header->FileHeader;
 
+		auto section_header = IMAGE_FIRST_SECTION(nt_header);
+		for (size_t i = 0; i < file_header->NumberOfSections; i++)
+		{
+			if (!strcmp((char*)section_header[i].Name, ".text"))
+			{
+				trampoline_ptr = (uintptr_t*)((beep + section_header[i].VirtualAddress) + section_header[i].Misc.VirtualSize);
+			}
+		}
 
+		if (trampoline_ptr)
+		{
+			unsigned int count = NULL;
+			unsigned int index = NULL;
+			while (trampoline_ptr[index] != NULL)
+			{
+				if (trampoline_ptr[index] == NULL)
+					count++;
 
+				if (count > 0x08)
+					break;
+
+				index++;
+			}
+			return (uintptr_t)&trampoline_ptr[index];
+		}
+
+		return NULL;
+	}
 
 
 }

Anti-Cheat_Driver/utils.h

@@ -9,6 +9,6 @@ namespace utils
 
 	auto kernel_get_expotr_func(wchar_t* func_name) -> uintptr_t;
 
-
+	auto get_beep_trampoline_ptr()->uintptr_t;
 
 }