This commit is contained in:
2026-06-11 15:29:16 +08:00
parent 1c8e593127
commit eb87fee622
2 changed files with 19 additions and 18 deletions
@@ -71,6 +71,7 @@
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset> <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
<ConfigurationType>Driver</ConfigurationType> <ConfigurationType>Driver</ConfigurationType>
<DriverType>WDM</DriverType> <DriverType>WDM</DriverType>
<Driver_SpectreMitigation>Spectre</Driver_SpectreMitigation>
</PropertyGroup> </PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'" Label="Configuration"> <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'" Label="Configuration">
<TargetVersion>Windows10</TargetVersion> <TargetVersion>Windows10</TargetVersion>
@@ -136,6 +137,9 @@
<Link> <Link>
<AdditionalOptions>/INTEGRITYCHECK %(AdditionalOptions)</AdditionalOptions> <AdditionalOptions>/INTEGRITYCHECK %(AdditionalOptions)</AdditionalOptions>
</Link> </Link>
<ClCompile>
<BufferSecurityCheck>false</BufferSecurityCheck>
</ClCompile>
</ItemDefinitionGroup> </ItemDefinitionGroup>
<ItemGroup> <ItemGroup>
<FilesToPackage Include="$(TargetPath)" /> <FilesToPackage Include="$(TargetPath)" />
+11 -14
View File
@@ -4,32 +4,29 @@
#include "load_Image_callback.h" #include "load_Image_callback.h"
#include "protect_filter.h" #include "protect_filter.h"
#include "process_func.h" #include "process_func.h"
#include "kernel_function.h"
EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING) EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING)
{ {
if (drv_obj)
{
drv_obj->DriverUnload = [](PDRIVER_OBJECT) drv_obj->DriverUnload = [](PDRIVER_OBJECT)
{ {
ob_call_back::uninstall_ob_callback(); ob_call_back::uninstall_ob_callback();
thread_notify_routine::unload_thread_routine(); thread_notify_routine::unload_thread_routine();
load_image_notify_routine::remove_image_load_notify_routine(); //load_image_notify_routine::remove_image_load_notify_routine();
//process_function::eprocess_protect_process_off(4732);
}; };
}
kernel_api::kernel_api_init(); kernel_api::kernel_api_init();
protect_filter::Init(); protect_filter::Init();
//protect_filter::add_list(6644, 0); protect_filter::add_list(10492, 0);
DbgPrintEx(77, 0, "[+]ob_reg_callback status:%x\n", ob_call_back::register_ob_reg_callback());
DbgPrintEx(77, 0, "[+]create_thread_routine status:%x\n", thread_notify_routine::create_thread_routine());
//NtQueryVirtualMemory
//process_function::eprocess_protect_process_on(4732); //load_image_notify_routine::create_image_load_notify_routine();
ob_call_back::register_ob_reg_callback();
thread_notify_routine::create_thread_routine();
load_image_notify_routine::create_image_load_notify_routine();
return STATUS_SUCCESS; return STATUS_SUCCESS;
} }