maowengrui/anit-cheat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat get zwopenprocess

Browse Source
This commit is contained in:
maowenrui
2026-06-30 16:58:18 +08:00
parent eb8978731f
commit cbbb11430a
2 changed files with 11 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Anti-Cheat_Driver/kernel_api.cpp
+8
View File
@@ -22,6 +22,9 @@ namespace kernel_api
RtlInitUnicodeString(&unFuncName, L"RtlFindExportedRoutineByName"); RtlInitUnicodeString(&unFuncName, L"RtlFindExportedRoutineByName");
imported.rtl_findexported_routinebyname = (ULONG64)MmGetSystemRoutineAddress(&unFuncName); imported.rtl_findexported_routinebyname = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
RtlInitUnicodeString(&unFuncName, L"ZwOpenThread");
imported.nt_open_thread = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
} }
NTSTATUS ntquerysysteminformation(ULONG SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength) NTSTATUS ntquerysysteminformation(ULONG SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength)
@@ -52,5 +55,10 @@ namespace kernel_api
return reinterpret_cast<PVOID(*)(PVOID, PCCH)>(imported.rtl_findexported_routinebyname) return reinterpret_cast<PVOID(*)(PVOID, PCCH)>(imported.rtl_findexported_routinebyname)
(ImageBase, RoutineName); (ImageBase, RoutineName);
} }
NTSTATUS ntopenthread(PHANDLE ThreadHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId)
{
return reinterpret_cast<NTSTATUS(*)(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, PCLIENT_ID)>(imported.nt_open_thread)
(ThreadHandle, DesiredAccess, ObjectAttributes, ClientId);
}
} }
Anti-Cheat_Driver/kernel_api.h
+3
View File
@@ -19,6 +19,7 @@ struct imported_
ULONG64 ps_getprocess_section_baseaddress; ULONG64 ps_getprocess_section_baseaddress;
ULONG64 ps_getprocess_id; ULONG64 ps_getprocess_id;
ULONG64 se_locateprocess_imagename; ULONG64 se_locateprocess_imagename;
ULONG64 nt_open_thread;
}; };
namespace kernel_api namespace kernel_api
@@ -39,4 +40,6 @@ namespace kernel_api
NTSTATUS selocate_process_imagename(PEPROCESS Process, PUNICODE_STRING* pImageFileName); NTSTATUS selocate_process_imagename(PEPROCESS Process, PUNICODE_STRING* pImageFileName);
PVOID rtlfindexportedroutinebyname(PVOID ImageBase, PCCH RoutineName); PVOID rtlfindexportedroutinebyname(PVOID ImageBase, PCCH RoutineName);
NTSTATUS ntopenthread(PHANDLE ThreadHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId);
} }