From cbbb11430adeb8c03d62ec0ed2dd76574f11e423 Mon Sep 17 00:00:00 2001
From: maowenrui <3505719167@qq.com>
Date: Tue, 30 Jun 2026 16:58:18 +0800
Subject: [PATCH] feat get zwopenprocess

---
 Anti-Cheat_Driver/kernel_api.cpp | 8 ++++++++
 Anti-Cheat_Driver/kernel_api.h   | 3 +++
 2 files changed, 11 insertions(+)

diff --git a/Anti-Cheat_Driver/kernel_api.cpp b/Anti-Cheat_Driver/kernel_api.cpp
index bbbf435..8501830 100644
--- a/Anti-Cheat_Driver/kernel_api.cpp
+++ b/Anti-Cheat_Driver/kernel_api.cpp
@@ -22,6 +22,9 @@ namespace kernel_api
 
 		RtlInitUnicodeString(&unFuncName, L"RtlFindExportedRoutineByName");
 		imported.rtl_findexported_routinebyname = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
+
+		RtlInitUnicodeString(&unFuncName, L"ZwOpenThread");
+		imported.nt_open_thread = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
 	}
 
 	NTSTATUS ntquerysysteminformation(ULONG SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength)
@@ -52,5 +55,10 @@ namespace kernel_api
 		return reinterpret_cast<PVOID(*)(PVOID, PCCH)>(imported.rtl_findexported_routinebyname)
 			(ImageBase, RoutineName);
 	}
+	NTSTATUS ntopenthread(PHANDLE ThreadHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId)
+	{
+		return reinterpret_cast<NTSTATUS(*)(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, PCLIENT_ID)>(imported.nt_open_thread)
+			(ThreadHandle, DesiredAccess, ObjectAttributes, ClientId);
+	}
 }
 	
\ No newline at end of file
diff --git a/Anti-Cheat_Driver/kernel_api.h b/Anti-Cheat_Driver/kernel_api.h
index d96312d..e342a80 100644
--- a/Anti-Cheat_Driver/kernel_api.h
+++ b/Anti-Cheat_Driver/kernel_api.h
@@ -19,6 +19,7 @@ struct imported_
 	ULONG64 ps_getprocess_section_baseaddress;
 	ULONG64 ps_getprocess_id;
 	ULONG64 se_locateprocess_imagename;
+	ULONG64 nt_open_thread;
 };
 
 namespace kernel_api
@@ -39,4 +40,6 @@ namespace kernel_api
 	NTSTATUS selocate_process_imagename(PEPROCESS Process, PUNICODE_STRING* pImageFileName);
 
 	PVOID rtlfindexportedroutinebyname(PVOID ImageBase, PCCH RoutineName);
+
+	NTSTATUS ntopenthread(PHANDLE ThreadHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId);
 }
\ No newline at end of file