style

Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj

@@ -146,6 +146,10 @@
   </ItemGroup>
   <ItemGroup>
     <ClCompile Include="anit_screen_grap.cpp" />
+    <ClCompile Include="comm.cpp" />
+    <ClCompile Include="comm_dispatch.cpp" />
+    <ClCompile Include="comm_win10.cpp" />
+    <ClCompile Include="comm_win7.cpp" />
     <ClCompile Include="create_thread_callback.cpp" />
     <ClCompile Include="driver_main.cpp" />
     <ClCompile Include="io_ctl.cpp" />
@@ -160,6 +164,10 @@
   <ItemGroup>
     <ClInclude Include="anit_screen_grap.h" />
     <ClInclude Include="Base.h" />
+    <ClInclude Include="comm.h" />
+    <ClInclude Include="comm_dispatch.h" />
+    <ClInclude Include="comm_win10.h" />
+    <ClInclude Include="comm_win7.h" />
     <ClInclude Include="create_thread_callback.h" />
     <ClInclude Include="io_ctl.h" />
     <ClInclude Include="kernel_api.h" />

Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj.filters

@@ -38,6 +38,9 @@
     <Filter Include="process_function">
       <UniqueIdentifier>{e30d7c3e-b37a-4d86-9561-383f1b377fba}</UniqueIdentifier>
     </Filter>
+    <Filter Include="comm">
+      <UniqueIdentifier>{39d8ef92-d541-4aee-9850-0a3d878333dc}</UniqueIdentifier>
+    </Filter>
   </ItemGroup>
   <ItemGroup>
     <ClCompile Include="driver_main.cpp">
@@ -73,6 +76,18 @@
     <ClCompile Include="process_func.cpp">
       <Filter>process_function</Filter>
     </ClCompile>
+    <ClCompile Include="comm_win7.cpp">
+      <Filter>comm</Filter>
+    </ClCompile>
+    <ClCompile Include="comm_win10.cpp">
+      <Filter>comm</Filter>
+    </ClCompile>
+    <ClCompile Include="comm_dispatch.cpp">
+      <Filter>comm</Filter>
+    </ClCompile>
+    <ClCompile Include="comm.cpp">
+      <Filter>comm</Filter>
+    </ClCompile>
   </ItemGroup>
   <ItemGroup>
     <ClInclude Include="Base.h">
@@ -108,5 +123,17 @@
     <ClInclude Include="process_func.h">
       <Filter>process_function</Filter>
     </ClInclude>
+    <ClInclude Include="comm_win7.h">
+      <Filter>comm</Filter>
+    </ClInclude>
+    <ClInclude Include="comm_win10.h">
+      <Filter>comm</Filter>
+    </ClInclude>
+    <ClInclude Include="comm_dispatch.h">
+      <Filter>comm</Filter>
+    </ClInclude>
+    <ClInclude Include="comm.h">
+      <Filter>comm</Filter>
+    </ClInclude>
   </ItemGroup>
 </Project>

Anti-Cheat_Driver/comm.cpp

@@ -0,0 +1,45 @@
+#include "comm.h"
+#include "utils.h"
+#include "comm_win10.h"
+#include "comm_win7.h"
+
+namespace kernel_comm_create
+{
+	auto Init() -> BOOL
+	{
+		auto version = utils::GetVersion();
+		if (version.dwBuildNumber == 7600 || version.dwBuildNumber == 7601)
+		{
+			//win7
+			if (comm_win7::comm_init())
+			{
+				return comm_win7::comm_install_hook();
+			}
+		}
+		else
+		{
+			//win10
+			if (comm_win10::comm_init())
+			{
+				return comm_win10::comm_install_hook();
+			}
+		}
+
+		return FALSE;
+	}
+
+	auto remove() -> BOOL
+	{
+		auto version = utils::GetVersion();
+		if (version.dwBuildNumber == 7600 || version.dwBuildNumber == 7601)
+		{
+			//win7
+			return comm_win7::comm_remov_hook();
+		}
+		else
+		{
+			return comm_win10::comm_remov_hook();
+		}
+	}
+
+}

Anti-Cheat_Driver/comm.h

@@ -0,0 +1,10 @@
+#pragma once
+#include "Base.h"
+
+namespace kernel_comm_create
+{
+	auto Init()->BOOL;
+
+	auto remove()->BOOL;
+
+}

Anti-Cheat_Driver/comm_dispatch.cpp

@@ -0,0 +1,29 @@
+#include "comm_dispatch.h"
+#include "protect_filter.h"
+
+namespace comm_dispatch
+{
+	auto dispatch(CMD_COMM* data) -> NTSTATUS
+	{
+		auto status = STATUS_UNSUCCESSFUL;
+		switch (data->CommID)
+		{
+		case CMD::DRIVER_COMM_TEST:
+		{
+			status = STATUS_SUCCESS;
+			break;
+		}
+		case CMD::DRIVER_PROTECT_PROCESS:
+		{
+			status = protect_filter::add_list((ULONG)data->Pid, NULL);
+			break;
+		}
+		default:
+			break;
+		}
+
+		*(NTSTATUS*)data->status = status;
+		return status;
+	}
+}
+

Anti-Cheat_Driver/comm_dispatch.h

@@ -0,0 +1,21 @@
+#pragma once
+#include "Base.h"
+
+struct CMD_COMM
+{
+	DWORD64 CommID;
+	DWORD64 Pid;
+	DWORD64 status;
+};
+
+enum CMD
+{
+	MSG_BASE = 0x10000,
+	DRIVER_COMM_TEST,
+	DRIVER_PROTECT_PROCESS
+};
+
+namespace comm_dispatch
+{
+	auto dispatch(CMD_COMM* data)->NTSTATUS;
+}

Anti-Cheat_Driver/comm_win10.cpp

@@ -0,0 +1,75 @@
+#include "comm_win10.h"
+#include "comm_dispatch.h"
+#include "utils.h"
+#include "kernel_function.h"
+#pragma warning(disable : 4309)
+#pragma warning(disable : 4838)
+
+typedef NTSTATUS(__fastcall* fnHalpTimerConvertAuxiliaryCounterToPerformanceCounter)(PVOID, PVOID, PVOID);
+fnHalpTimerConvertAuxiliaryCounterToPerformanceCounter _HalpTimerConvertAuxiliaryCounterToPerformanceCounter = 0;
+
+uintptr_t beep_trampoline_ptr;
+uintptr_t func_call_address;
+
+namespace comm_win10
+{
+	auto comm_callback(PVOID a1, PVOID a2, PVOID a3) -> NTSTATUS
+	{
+		comm_dispatch::dispatch((CMD_COMM*)a1);
+		return _HalpTimerConvertAuxiliaryCounterToPerformanceCounter(a1, a2, a3);
+	}
+
+	auto comm_init() -> BOOL
+	{
+		beep_trampoline_ptr = utils::get_beep_trampoline_ptr();
+		return !beep_trampoline_ptr ? FALSE : TRUE;
+	}
+
+	auto comm_install_hook() -> BOOL
+	{
+		auto ntoskrnl = kernel_function::GetKernelModule("ntoskrnl.exe");
+		if (!ntoskrnl)
+			return FALSE;
+
+		// mov rax,comm_callback
+		// jmp rax
+		char jmprax[] = { 0x48, 0xB8, 0x13, 0x09, 0xFC, 0xD6, 0xFC, 0x7F, 0x00, 0x00, 0xFF, 0xE0 };
+		*(uintptr_t*)&jmprax[2] = (uintptr_t)comm_callback;
+		
+		auto status = kernel_function::MmMDLPagesCopy((PVOID)beep_trampoline_ptr, &jmprax, sizeof(jmprax), 0x0000002, KernelMode);
+		if (!NT_SUCCESS(status))
+			return FALSE;
+
+		auto code_addr = utils::FindSectionsCode(ntoskrnl, "\x48\x8B\x05\x00\x00\x00\x00\x00\x00\x48\x8B\x05\x00\x00\x00\x00\xE8\x00\x00\x00\x00\x8B\xC8",
+			"xxx??????xxx????x????xx", "PAGE");
+
+		func_call_address = (*(long*)(code_addr + 3)) + (code_addr + 7);
+		_HalpTimerConvertAuxiliaryCounterToPerformanceCounter =
+			*(fnHalpTimerConvertAuxiliaryCounterToPerformanceCounter*)(func_call_address);
+
+		*(uintptr_t*)func_call_address = beep_trampoline_ptr;
+
+		return TRUE;
+	}
+	auto comm_remov_hook() -> BOOL
+	{
+		if (!func_call_address)
+			return FALSE;
+
+		*(uintptr_t*)func_call_address = 
+			(uintptr_t)_HalpTimerConvertAuxiliaryCounterToPerformanceCounter;
+
+		if (!beep_trampoline_ptr)
+			return FALSE;
+
+
+		char nullcode[12]{ 0 };
+		auto status = kernel_function::MmMDLPagesCopy((PVOID)beep_trampoline_ptr, &nullcode, sizeof(nullcode), 0x0000002, KernelMode);
+		if (!NT_SUCCESS(status))
+			return FALSE;
+
+		return TRUE;
+	}
+}
+
+

Anti-Cheat_Driver/comm_win10.h

@@ -0,0 +1,9 @@
+#pragma once
+#include "Base.h"
+
+namespace comm_win10
+{
+	auto comm_init()->BOOL;
+	auto comm_install_hook()->BOOL;
+	auto comm_remov_hook()->BOOL;
+}

Anti-Cheat_Driver/comm_win7.cpp

@@ -0,0 +1,81 @@
+#include "comm_win7.h"
+#include "comm_dispatch.h"
+#include "utils.h"
+#include "kernel_function.h"
+
+#pragma warning(disable : 4309)
+#pragma warning(disable : 4838)
+
+PFILE_OBJECT file_obj{ 0 };
+PDEVICE_OBJECT device_obj{ 0 };
+
+LPVOID orign_maj_function = nullptr;
+
+namespace comm_win7
+{
+	auto comm_init() -> BOOL
+	{
+		UNICODE_STRING unName{ 0 };
+		RtlInitUnicodeString(&unName, L"\\Device\\Null");	
+		auto status = IoGetDeviceObjectPointer(&unName, FILE_ALL_ACCESS, &file_obj, &device_obj);
+		if (!NT_SUCCESS(status))
+			return FALSE;
+
+		ObDereferenceObject(file_obj);
+		return TRUE;
+	}
+
+	auto dispatch_device_io(PDEVICE_OBJECT drvice_object, PIRP irp)->NTSTATUS
+	{
+		UNREFERENCED_PARAMETER(drvice_object);
+		
+		auto comm_buf_data =  reinterpret_cast<CMD_COMM*>(irp->AssociatedIrp.SystemBuffer);
+
+		auto status = comm_dispatch::dispatch(comm_buf_data);
+
+		irp->IoStatus.Information = sizeof(CMD_COMM);
+		irp->IoStatus.Status = status;
+		IoCompleteRequest(irp, IO_NO_INCREMENT);
+		return status;
+	};
+
+	auto comm_install_hook() -> BOOL
+	{
+		auto drv_obj = device_obj->DriverObject;
+		if (!drv_obj)
+			return FALSE;
+
+		orign_maj_function = drv_obj->MajorFunction[IRP_MJ_DEVICE_CONTROL];
+
+		auto beep_trampoline = utils::get_beep_trampoline_ptr();
+		if (!beep_trampoline)
+			return FALSE;
+
+		//mov rax,dispatch_device_io
+        //jmp rax
+		char jmprax[] = { 0x48, 0xB8, 0xA0, 0x9A, 0xD5, 0x3E, 0xFE, 0x7F, 0x00, 0x00, 0xFF, 0xE0 };
+
+		*(uintptr_t*)&jmprax[2] = (uintptr_t)dispatch_device_io;
+		kernel_function::MmMDLPagesCopy((PVOID)beep_trampoline, &jmprax, sizeof(jmprax), 0x0000002, KernelMode);
+
+		drv_obj->MajorFunction[IRP_MJ_DEVICE_CONTROL] = (PDRIVER_DISPATCH)beep_trampoline/*Ö±½Ó¾ÍÊÇÄãµÄº¯Êý*/;
+		
+		return TRUE;
+	}
+
+	auto comm_remov_hook() -> BOOL
+	{
+		auto drv_obj = device_obj->DriverObject;
+		if (!drv_obj)
+			return FALSE;
+
+		if (drv_obj->MajorFunction[IRP_MJ_DEVICE_CONTROL])
+		{
+			drv_obj->MajorFunction[IRP_MJ_DEVICE_CONTROL] = 
+				(PDRIVER_DISPATCH)orign_maj_function;
+		}
+
+		return TRUE;
+	}
+
+}

Anti-Cheat_Driver/comm_win7.h

@@ -0,0 +1,12 @@
+#pragma once
+#include "Base.h"
+
+namespace comm_win7
+{
+	auto comm_init()->BOOL;
+
+	auto comm_install_hook()->BOOL;
+
+	auto comm_remov_hook()->BOOL;
+
+}

Anti-Cheat_Driver/create_thread_callback.cpp

@@ -1,6 +1,7 @@
 #include "create_thread_callback.h"
 #include "protect_filter.h"
 #include "kernel_function.h"
+#include "utils.h"
 
 #pragma warning(disable : 4309)
 #pragma warning(disable : 4838)
@@ -53,28 +54,9 @@ namespace thread_notify_routine
 		}
 	}
 
-	auto get_beep_trampoline_ptr() -> uintptr_t
-	{
-		uintptr_t trampoline_ptr = NULL;
-
-		auto beep = kernel_function::GetKernelModule("beep.sys");
-		auto nt_header = reinterpret_cast<PIMAGE_NT_HEADERS>(beep + reinterpret_cast<PIMAGE_DOS_HEADER>(beep)->e_lfanew);
-		auto file_header = &nt_header->FileHeader;
-
-		auto section_header = IMAGE_FIRST_SECTION(nt_header);
-		for (size_t i = 0; i < file_header->NumberOfSections; i++)
-		{
-			if (!strcmp((char*)section_header[i].Name, ".text"))
-			{
-				trampoline_ptr = ((beep + section_header[i].VirtualAddress) + section_header[i].Misc.VirtualSize);
-			}
-		}
-		return trampoline_ptr;
-	}
-
 	auto create_thread_routine() -> NTSTATUS
 	{
-		auto trampoline_ptr = get_beep_trampoline_ptr();
+		auto trampoline_ptr = utils::get_beep_trampoline_ptr();
 		if (trampoline_ptr)
 		{
 			char jmprax[] = { 0x48, 0xB8, 0xA0, 0x9A, 0xD5, 0x3E, 0xFE, 0x7F, 0x00, 0x00, 0xFF, 0xE0 };
@@ -92,8 +74,8 @@ namespace thread_notify_routine
 
 	auto unload_thread_routine() -> NTSTATUS
 	{
-		auto trampoline_ptr = get_beep_trampoline_ptr();
-		return PsRemoveCreateThreadNotifyRoutine((PCREATE_PROCESS_NOTIFY_ROUTINE)trampoline_ptr);
+		//auto trampoline_ptr = utils::get_beep_trampoline_ptr();
+		return PsRemoveCreateThreadNotifyRoutine(thread_notify_routine);
 	}
 
 

Anti-Cheat_Driver/driver_main.cpp

@@ -1,32 +1,27 @@
 #include "ob_reg_callback.h"
-#include "anit_screen_grap.h"
 #include "create_thread_callback.h"
-#include "load_Image_callback.h"
 #include "protect_filter.h"
-#include "process_func.h"
-#include "kernel_function.h"
+#include "comm.h"
+
+
 EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING)
 {
 	if (drv_obj)
 	{
 		drv_obj->DriverUnload = [](PDRIVER_OBJECT)
 		{
+			kernel_comm_create::remove();
 			ob_call_back::uninstall_ob_callback();
-			thread_notify_routine::unload_thread_routine();
-			//load_image_notify_routine::remove_image_load_notify_routine();
+			//DbgPrintEx(77,0,"%x\n", thread_notify_routine::unload_thread_routine());
 		};
 	}
 
-
 	kernel_api::kernel_api_init();
 	protect_filter::Init();
+	kernel_comm_create::Init();
 
-	protect_filter::add_list(10492, 0);
 	DbgPrintEx(77, 0, "[+]ob_reg_callback status:%x\n", ob_call_back::register_ob_reg_callback());
-	DbgPrintEx(77, 0, "[+]create_thread_routine status:%x\n", thread_notify_routine::create_thread_routine());
-	
-	//NtQueryVirtualMemory
-	//load_image_notify_routine::create_image_load_notify_routine();
+	//DbgPrintEx(77, 0, "[+]create_thread_routine status:%x\n", thread_notify_routine::create_thread_routine());
 
 	return STATUS_SUCCESS;
 }

Anti-Cheat_Driver/io_ctl.cpp

@@ -39,6 +39,9 @@ auto io_ctl::init_device_and_symbolic(PDRIVER_OBJECT drv_obj) -> NTSTATUS
 		break;
 	}
 
+
+	
+
 	drv_obj->MajorFunction[IRP_MJ_CLOSE] = dispatch_create_close;
 	drv_obj->MajorFunction[IRP_MJ_CREATE] = dispatch_create_close;
 	drv_obj->MajorFunction[IRP_MJ_DEVICE_CONTROL] = dispatch_device_io;

Anti-Cheat_Driver/protect_filter.cpp

@@ -48,7 +48,6 @@ namespace protect_filter
 			auto list_data = reinterpret_cast<PFILTER>(CONTAINING_RECORD(list_head, FILTER, List));
 			list_head = list_head->Flink;
 
-
 			if (Pid)
 			{
 				if (list_data->Pid == Pid)
@@ -59,9 +58,6 @@ namespace protect_filter
 				if (list_data->Eprocess == Eprocess)
 					return TRUE;
 			}
-		
-
-			//DbgPrintEx(77, 0, "[+] pid:%d | eproecss:%p\n", list_data->Pid, list_data->Eprocess);
 		}
 
 		return NULL;
@@ -73,7 +69,6 @@ namespace protect_filter
 
 		BOOL is_remove_list = FALSE;
 
-	
 		if (IsListEmpty(&g_protect_list))
 			return NULL;
 
@@ -96,12 +91,6 @@ namespace protect_filter
 			}
 		}
 		
-
 		return TRUE;
 	}
-
-
-
-
-
 }

Anti-Cheat_Driver/utils.cpp

@@ -1,4 +1,5 @@
 #include "utils.h"
+#include "kernel_function.h"
 
 namespace utils
 {
@@ -64,10 +65,42 @@ namespace utils
 	}
 
 
+	auto get_beep_trampoline_ptr() -> uintptr_t
+	{
+		uintptr_t* trampoline_ptr = NULL;
 
+		auto beep = kernel_function::GetKernelModule("beep.sys");
+		auto nt_header = reinterpret_cast<PIMAGE_NT_HEADERS>(beep + reinterpret_cast<PIMAGE_DOS_HEADER>(beep)->e_lfanew);
+		auto file_header = &nt_header->FileHeader;
 
+		auto section_header = IMAGE_FIRST_SECTION(nt_header);
+		for (size_t i = 0; i < file_header->NumberOfSections; i++)
+		{
+			if (!strcmp((char*)section_header[i].Name, ".text"))
+			{
+				trampoline_ptr = (uintptr_t*)((beep + section_header[i].VirtualAddress) + section_header[i].Misc.VirtualSize);
+			}
+		}
 
+		if (trampoline_ptr)
+		{
+			unsigned int count = NULL;
+			unsigned int index = NULL;
+			while (trampoline_ptr[index] != NULL)
+			{
+				if (trampoline_ptr[index] == NULL)
+					count++;
 
+				if (count > 0x08)
+					break;
+
+				index++;
+			}
+			return (uintptr_t)&trampoline_ptr[index];
+		}
+
+		return NULL;
+	}
 
 
 }

Anti-Cheat_Driver/utils.h

@@ -9,6 +9,6 @@ namespace utils
 
 	auto kernel_get_expotr_func(wchar_t* func_name) -> uintptr_t;
 
-
+	auto get_beep_trampoline_ptr()->uintptr_t;
 
 }