init

2026-07-28 15:11:47 +08:00
parent 9b00c5f6eb
commit e91e372b19
80 changed files with 246075 additions and 0 deletions
@@ -0,0 +1,76 @@
+#include "driver_func.h"
+
+
+typedef ULONG(WINAPI* NtConvertBetweenAuxiliaryCounterAndPerformanceCounterProc)(char a1, PVOID a2, PVOID a3, PVOID a4);
+NtConvertBetweenAuxiliaryCounterAndPerformanceCounterProc gNtConvertBetweenAuxiliary = NULL;
+
+HANDLE null_device_handle;
+
+OSVERSIONINFOW os{ 0 };
+
+namespace driver_func
+{
+	auto GetVersion() -> OSVERSIONINFOW
+	{
+		OSVERSIONINFOW os{ 0 };
+		typedef NTSTATUS(WINAPI* PFNRtlGetVersion)(PRTL_OSVERSIONINFOW);
+		static PFNRtlGetVersion RtlGetVersion = nullptr;
+		if (RtlGetVersion == nullptr)
+		{
+			HMODULE hNtdll = GetModuleHandleW(L"ntdll.dll");
+			if (hNtdll != NULL)
+			{
+				RtlGetVersion = (PFNRtlGetVersion)GetProcAddress(hNtdll, "RtlGetVersion");
+			}
+		}
+
+		RtlGetVersion(&os);
+		return os;
+	}
+
+	auto init() -> BOOL
+	{
+		os = GetVersion();
+		if (os.dwBuildNumber == 7600 || os.dwBuildNumber == 7601)
+		{
+			null_device_handle = CreateFileA("\\\\.\\Nul", GENERIC_READ | GENERIC_WRITE, 0, 0, OPEN_EXISTING, FILE_ATTRIBUTE_SYSTEM, 0);
+			if (null_device_handle != NULL && null_device_handle != INVALID_HANDLE_VALUE)
+				return TRUE;
+		}
+		else if (os.dwBuildNumber >= 14393)
+		{
+			HMODULE ntdll = GetModuleHandleA("ntdll.dll");
+			if (ntdll)
+			{
+				if (gNtConvertBetweenAuxiliary == nullptr)
+				{
+					gNtConvertBetweenAuxiliary = (NtConvertBetweenAuxiliaryCounterAndPerformanceCounterProc)
+						GetProcAddress(ntdll, "NtConvertBetweenAuxiliaryCounterAndPerformanceCounter");
+
+					return gNtConvertBetweenAuxiliary ? TRUE : FALSE;
+				}
+			}
+		}
+
+		return FALSE;
+	}
+
+	auto driver_comm_func(LPVOID Buf, DWORD bufSize)->BOOL
+	{
+		if (os.dwBuildNumber == 7600 || os.dwBuildNumber == 7601)
+		{
+			DWORD retlen = 0;
+			return DeviceIoControl(null_device_handle, 0x12345678, Buf, bufSize, Buf, bufSize, &retlen, NULL);
+		}
+		else if (os.dwBuildNumber >= 14393)
+		{
+			ULONG64 xxx = 0;
+			auto data = (ULONG64)Buf;
+			gNtConvertBetweenAuxiliary(1, &data, (PVOID)&xxx, NULL);
+			return TRUE;
+		}
+
+		return FALSE;
+	}
+
+}