feat TerminateThreadByHandle

Anti-Cheat_Driver/create_thread_callback.cpp

@@ -2,16 +2,74 @@
 #include "protect_filter.h"
 #include "kernel_function.h"
 #include "utils.h"
+#include "kernel_api.h"
+#include "ssdt.h"
 
 #pragma warning(disable : 4309 4838)
+
+
+EXTERN_C NTKERNELAPI NTSTATUS ZwOpenThread(
+	_Out_ PHANDLE ThreadHandle,
+	_In_ ACCESS_MASK DesiredAccess,
+	_In_ POBJECT_ATTRIBUTES ObjectAttributes,
+	_In_ PCLIENT_ID ClientId
+	);
+
+
 namespace thread_notify_routine
 {
+
+	// 打开线程句柄并终止
+	NTSTATUS TerminateThreadByHandle(
+			HANDLE ProcessId,
+			HANDLE ThreadId)
+	{
+		NTSTATUS status;
+		HANDLE threadHandle = NULL;
+		OBJECT_ATTRIBUTES objAttr;
+		CLIENT_ID clientId;
+
+		clientId.UniqueProcess = ProcessId;
+		clientId.UniqueThread = ThreadId;
+
+		InitializeObjectAttributes(&objAttr, NULL, 0, NULL, NULL);
+
+		// 打开线程句柄
+		status = ZwOpenThread(
+			&threadHandle,
+			THREAD_TERMINATE,
+			&objAttr,
+			&clientId);
+
+		if (!NT_SUCCESS(status)) {
+			DbgPrintEx(77, 0, "[AnitCheat][%s] Failed to open thread %d: 0x%X\n",__FUNCTION__,
+				(ULONG)(ULONG_PTR)ThreadId, status);
+			return status;
+		}
+
+		// 终止线程
+		status = SSDT::ZwTerminateThread(threadHandle, STATUS_THREAD_IS_TERMINATING);
+
+		if (NT_SUCCESS(status)) {
+			/*DbgPrintEx(77, 0, "[ThreadKiller] Thread %d terminated successfully\n",
+				(ULONG)(ULONG_PTR)ThreadId);*/
+		}
+		else {
+			DbgPrintEx(77,0,"[AnitCheat][%s] Failed to terminate thread %d: 0x%X\n", __FUNCTION__,
+				(ULONG)(ULONG_PTR)ThreadId, status);
+		}
+
+		ZwClose(threadHandle);
+		return status;
+	}
+
 	//保护的进程ID
 	//auto protect_id = ULongToHandle(8976);
 	void thread_notify_routine(HANDLE ProcessId, HANDLE ThreadId, BOOLEAN Create)
 	{
 		if (Create)
 		{
+
 			PEPROCESS process{ 0 };
 			auto status = PsLookupProcessByProcessId(ProcessId, &process);
 			if (!NT_SUCCESS(status))
@@ -34,6 +92,8 @@ namespace thread_notify_routine
 
 			if (ProcessId != cutor_process_id)
 			{
+				//DbgBreakPoint();
+
 				DbgPrintEx(77, 0, "[!] 恶意远程线程检测！\n");
 
 				DbgPrintEx(77, 0, "[!] 目标进程ID: %d\n", ProcessId);
@@ -41,6 +101,10 @@ namespace thread_notify_routine
 				DbgPrintEx(77, 0, "[!] 创建者进程ID: %d\n", cutor_process_id);
 
 				DbgPrintEx(77, 0, "[!] 被创建线程ID: %d\n", ThreadId);
+
+
+				TerminateThreadByHandle(ProcessId, ThreadId);
+	
 			}
 		end:	
 			ObDereferenceObject(process);