diff --git a/Anti-Cheat_Driver/create_thread_callback.cpp b/Anti-Cheat_Driver/create_thread_callback.cpp index 1a513fa..f03ac48 100644 --- a/Anti-Cheat_Driver/create_thread_callback.cpp +++ b/Anti-Cheat_Driver/create_thread_callback.cpp @@ -1,13 +1,10 @@ #include "create_thread_callback.h" #include "protect_filter.h" - - - namespace thread_notify_routine { //保护的进程ID - auto protect_id = ULongToHandle(8976); + //auto protect_id = ULongToHandle(8976); void thread_notify_routine(HANDLE ProcessId, HANDLE ThreadId, BOOLEAN Create) @@ -19,9 +16,6 @@ namespace thread_notify_routine if (!NT_SUCCESS(status)) goto end; - - - /*PEPROCESS protect_process{ 0 }; status = PsLookupProcessByProcessId(protect_id, &protect_process); if (!NT_SUCCESS(status)) @@ -48,8 +42,9 @@ namespace thread_notify_routine DbgPrintEx(77, 0, "[!] 被创建线程ID: %d\n", ThreadId); } + - end: + end: ObDereferenceObject(process); } } diff --git a/Anti-Cheat_Driver/kernel_api.cpp b/Anti-Cheat_Driver/kernel_api.cpp index 63aeb75..1547aea 100644 --- a/Anti-Cheat_Driver/kernel_api.cpp +++ b/Anti-Cheat_Driver/kernel_api.cpp @@ -27,4 +27,7 @@ namespace kernel_api return reinterpret_cast (imported.ps_getprocessimage_filname)(Process); } + + + } diff --git a/Anti-Cheat_Driver/load_Image_callback.cpp b/Anti-Cheat_Driver/load_Image_callback.cpp index 2dec44c..3a9f244 100644 --- a/Anti-Cheat_Driver/load_Image_callback.cpp +++ b/Anti-Cheat_Driver/load_Image_callback.cpp @@ -22,13 +22,7 @@ namespace load_image_notify_routine } - - } - - - - } diff --git a/Anti-Cheat_Driver/ob_reg_callback.cpp b/Anti-Cheat_Driver/ob_reg_callback.cpp index d759973..a1a49ce 100644 --- a/Anti-Cheat_Driver/ob_reg_callback.cpp +++ b/Anti-Cheat_Driver/ob_reg_callback.cpp @@ -67,7 +67,6 @@ auto ob_call_back::register_ob_reg_callback() -> NTSTATUS status = ObRegisterCallbacks(&obReg, ®_ob_callback_handle); return status; - } auto ob_call_back::uninstall_ob_callback() -> BOOLEAN