style

Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj

@@ -146,28 +146,55 @@
   </ItemGroup>
   <ItemGroup>
     <ClCompile Include="anit_screen_grap.cpp" />
+    <ClCompile Include="comm.cpp" />
+    <ClCompile Include="comm_dispatch.cpp" />
+    <ClCompile Include="comm_win10.cpp" />
+    <ClCompile Include="comm_win7.cpp" />
     <ClCompile Include="create_thread_callback.cpp" />
     <ClCompile Include="driver_main.cpp" />
+    <ClCompile Include="hde\hde64.cpp" />
+    <ClCompile Include="inline_hooks.cpp" />
     <ClCompile Include="io_ctl.cpp" />
     <ClCompile Include="kernel_api.cpp" />
     <ClCompile Include="kernel_function.cpp" />
     <ClCompile Include="load_Image_callback.cpp" />
+    <ClCompile Include="mouse_keybord_hook.cpp" />
+    <ClCompile Include="mouse_key_win10.cpp" />
+    <ClCompile Include="mouse_key_win7.cpp" />
     <ClCompile Include="ob_reg_callback.cpp" />
     <ClCompile Include="process_func.cpp" />
+    <ClCompile Include="process_notify_callback.cpp" />
     <ClCompile Include="protect_filter.cpp" />
+    <ClCompile Include="shadow_ssdt.cpp" />
+    <ClCompile Include="ssdt.cpp" />
     <ClCompile Include="utils.cpp" />
   </ItemGroup>
   <ItemGroup>
     <ClInclude Include="anit_screen_grap.h" />
     <ClInclude Include="Base.h" />
+    <ClInclude Include="comm.h" />
+    <ClInclude Include="comm_dispatch.h" />
+    <ClInclude Include="comm_win10.h" />
+    <ClInclude Include="comm_win7.h" />
     <ClInclude Include="create_thread_callback.h" />
+    <ClInclude Include="hde\hde64.h" />
+    <ClInclude Include="hde\headers.hpp" />
+    <ClInclude Include="hde\pstdint.h" />
+    <ClInclude Include="hde\table64.h" />
+    <ClInclude Include="inline_hooks.h" />
     <ClInclude Include="io_ctl.h" />
     <ClInclude Include="kernel_api.h" />
     <ClInclude Include="kernel_function.h" />
     <ClInclude Include="load_Image_callback.h" />
+    <ClInclude Include="mouse_keybord_hook.h" />
+    <ClInclude Include="mouse_key_win10.h" />
+    <ClInclude Include="mouse_key_win7.h" />
     <ClInclude Include="ob_reg_callback.h" />
     <ClInclude Include="process_func.h" />
+    <ClInclude Include="process_notify_callback.h" />
     <ClInclude Include="protect_filter.h" />
+    <ClInclude Include="shadow_ssdt.h" />
+    <ClInclude Include="ssdt.h" />
     <ClInclude Include="utils.h" />
   </ItemGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />

Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj.filters

@@ -19,9 +19,6 @@
     <Filter Include="kernel_extern_api">
       <UniqueIdentifier>{b3f98251-c1bf-4bd0-a5bd-d5425c272a5e}</UniqueIdentifier>
     </Filter>
-    <Filter Include="Iocontrol">
-      <UniqueIdentifier>{1373c16e-e769-4553-b7b9-0f87b2f6ab0e}</UniqueIdentifier>
-    </Filter>
     <Filter Include="Resource Files">
       <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
       <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
@@ -38,6 +35,30 @@
     <Filter Include="process_function">
       <UniqueIdentifier>{e30d7c3e-b37a-4d86-9561-383f1b377fba}</UniqueIdentifier>
     </Filter>
+    <Filter Include="comm">
+      <UniqueIdentifier>{39d8ef92-d541-4aee-9850-0a3d878333dc}</UniqueIdentifier>
+    </Filter>
+    <Filter Include="comm\Iocontrol">
+      <UniqueIdentifier>{1373c16e-e769-4553-b7b9-0f87b2f6ab0e}</UniqueIdentifier>
+    </Filter>
+    <Filter Include="utils\hde">
+      <UniqueIdentifier>{eb37b22e-76b8-4afe-9adb-bc5b6842ee98}</UniqueIdentifier>
+    </Filter>
+    <Filter Include="Hooks">
+      <UniqueIdentifier>{ea698d6c-d13f-4cc1-9129-3f8e935ee10d}</UniqueIdentifier>
+    </Filter>
+    <Filter Include="Hooks\InlineHook">
+      <UniqueIdentifier>{c6d3ba67-35ff-487d-b42b-beaf95752ea6}</UniqueIdentifier>
+    </Filter>
+    <Filter Include="mouse_keyboard">
+      <UniqueIdentifier>{d29bdd3e-0035-4cad-a658-7b272bd7d199}</UniqueIdentifier>
+    </Filter>
+    <Filter Include="kernel_extern_api\SSDT">
+      <UniqueIdentifier>{14cf9a07-d604-4163-8bfc-ded4b6e62df5}</UniqueIdentifier>
+    </Filter>
+    <Filter Include="kernel_extern_api\ShadowSSDT">
+      <UniqueIdentifier>{4f8c4f4e-0ff6-4cfa-804b-27bd50fca679}</UniqueIdentifier>
+    </Filter>
   </ItemGroup>
   <ItemGroup>
     <ClCompile Include="driver_main.cpp">
@@ -50,7 +71,7 @@
       <Filter>kernel_extern_api</Filter>
     </ClCompile>
     <ClCompile Include="io_ctl.cpp">
-      <Filter>Iocontrol</Filter>
+      <Filter>comm\Iocontrol</Filter>
     </ClCompile>
     <ClCompile Include="utils.cpp">
       <Filter>utils</Filter>
@@ -73,6 +94,42 @@
     <ClCompile Include="process_func.cpp">
       <Filter>process_function</Filter>
     </ClCompile>
+    <ClCompile Include="comm_win7.cpp">
+      <Filter>comm</Filter>
+    </ClCompile>
+    <ClCompile Include="comm_win10.cpp">
+      <Filter>comm</Filter>
+    </ClCompile>
+    <ClCompile Include="comm_dispatch.cpp">
+      <Filter>comm</Filter>
+    </ClCompile>
+    <ClCompile Include="comm.cpp">
+      <Filter>comm</Filter>
+    </ClCompile>
+    <ClCompile Include="process_notify_callback.cpp">
+      <Filter>kernel_callback</Filter>
+    </ClCompile>
+    <ClCompile Include="hde\hde64.cpp">
+      <Filter>utils\hde</Filter>
+    </ClCompile>
+    <ClCompile Include="inline_hooks.cpp">
+      <Filter>Hooks\InlineHook</Filter>
+    </ClCompile>
+    <ClCompile Include="mouse_keybord_hook.cpp">
+      <Filter>mouse_keyboard</Filter>
+    </ClCompile>
+    <ClCompile Include="shadow_ssdt.cpp">
+      <Filter>kernel_extern_api\ShadowSSDT</Filter>
+    </ClCompile>
+    <ClCompile Include="mouse_key_win10.cpp">
+      <Filter>mouse_keyboard</Filter>
+    </ClCompile>
+    <ClCompile Include="mouse_key_win7.cpp">
+      <Filter>mouse_keyboard</Filter>
+    </ClCompile>
+    <ClCompile Include="ssdt.cpp">
+      <Filter>kernel_extern_api\SSDT</Filter>
+    </ClCompile>
   </ItemGroup>
   <ItemGroup>
     <ClInclude Include="Base.h">
@@ -85,7 +142,7 @@
       <Filter>kernel_extern_api</Filter>
     </ClInclude>
     <ClInclude Include="io_ctl.h">
-      <Filter>Iocontrol</Filter>
+      <Filter>comm\Iocontrol</Filter>
     </ClInclude>
     <ClInclude Include="utils.h">
       <Filter>utils</Filter>
@@ -108,5 +165,50 @@
     <ClInclude Include="process_func.h">
       <Filter>process_function</Filter>
     </ClInclude>
+    <ClInclude Include="comm_win7.h">
+      <Filter>comm</Filter>
+    </ClInclude>
+    <ClInclude Include="comm_win10.h">
+      <Filter>comm</Filter>
+    </ClInclude>
+    <ClInclude Include="comm_dispatch.h">
+      <Filter>comm</Filter>
+    </ClInclude>
+    <ClInclude Include="comm.h">
+      <Filter>comm</Filter>
+    </ClInclude>
+    <ClInclude Include="process_notify_callback.h">
+      <Filter>kernel_callback</Filter>
+    </ClInclude>
+    <ClInclude Include="hde\hde64.h">
+      <Filter>utils\hde</Filter>
+    </ClInclude>
+    <ClInclude Include="hde\headers.hpp">
+      <Filter>utils\hde</Filter>
+    </ClInclude>
+    <ClInclude Include="hde\pstdint.h">
+      <Filter>utils\hde</Filter>
+    </ClInclude>
+    <ClInclude Include="hde\table64.h">
+      <Filter>utils\hde</Filter>
+    </ClInclude>
+    <ClInclude Include="inline_hooks.h">
+      <Filter>Hooks\InlineHook</Filter>
+    </ClInclude>
+    <ClInclude Include="mouse_keybord_hook.h">
+      <Filter>mouse_keyboard</Filter>
+    </ClInclude>
+    <ClInclude Include="shadow_ssdt.h">
+      <Filter>kernel_extern_api\ShadowSSDT</Filter>
+    </ClInclude>
+    <ClInclude Include="mouse_key_win10.h">
+      <Filter>mouse_keyboard</Filter>
+    </ClInclude>
+    <ClInclude Include="mouse_key_win7.h">
+      <Filter>mouse_keyboard</Filter>
+    </ClInclude>
+    <ClInclude Include="ssdt.h">
+      <Filter>kernel_extern_api\SSDT</Filter>
+    </ClInclude>
   </ItemGroup>
 </Project>

Anti-Cheat_Driver/anit_screen_grap.cpp

@@ -7,16 +7,6 @@ namespace anit_screen_grap
 {
 	auto GreProtectSpriteContent(HWND hWnd, UINT Flags) -> BOOL
 	{
-		UNREFERENCED_PARAMETER(hWnd);
-		UNREFERENCED_PARAMETER(Flags);
-		auto eprocess = kernel_function::FindProcess("IHuan.exe");
-
-		ObDereferenceObject(eprocess);
-
-		KAPC_STATE apc{ 0 };
-
-		KeStackAttachProcess(eprocess, &apc);
-
 		typedef BOOL(__fastcall* fn_GreProtectSpriteContent)(LPVOID, HWND, INT, UINT);
 		static fn_GreProtectSpriteContent _GreProtectSpriteContent = nullptr;
 		if (!_GreProtectSpriteContent) {
@@ -41,7 +31,6 @@ namespace anit_screen_grap
 
 		auto suc = _GreProtectSpriteContent(NULL, hWnd, TRUE, Flags);
 
-		KeUnstackDetachProcess(&apc);
 		return suc;
 	}
 

Anti-Cheat_Driver/comm.cpp

@@ -0,0 +1,45 @@
+#include "comm.h"
+#include "utils.h"
+#include "comm_win10.h"
+#include "comm_win7.h"
+
+namespace kernel_comm_create
+{
+	auto Init() -> BOOL
+	{
+		auto version = utils::GetVersion();
+		if (version.dwBuildNumber == 7600 || version.dwBuildNumber == 7601)
+		{
+			//win7
+			if (comm_win7::comm_init())
+			{
+				return comm_win7::comm_install_hook();
+			}
+		}
+		else
+		{
+			//win10
+			if (comm_win10::comm_init())
+			{
+				return comm_win10::comm_install_hook();
+			}
+		}
+
+		return FALSE;
+	}
+
+	auto remove() -> BOOL
+	{
+		auto version = utils::GetVersion();
+		if (version.dwBuildNumber == 7600 || version.dwBuildNumber == 7601)
+		{
+			//win7
+			return comm_win7::comm_remov_hook();
+		}
+		else
+		{
+			return comm_win10::comm_remov_hook();
+		}
+	}
+
+}

Anti-Cheat_Driver/comm.h

@@ -0,0 +1,10 @@
+#pragma once
+#include "Base.h"
+
+namespace kernel_comm_create
+{
+	auto Init()->BOOL;
+
+	auto remove()->BOOL;
+
+}

Anti-Cheat_Driver/comm_dispatch.cpp

@@ -0,0 +1,45 @@
+#include "comm_dispatch.h"
+#include "protect_filter.h"
+#include "anit_screen_grap.h"
+namespace comm_dispatch
+{
+	auto dispatch(CMD_COMM* data) -> NTSTATUS
+	{
+		auto status = STATUS_UNSUCCESSFUL;
+		switch (data->CommID)
+		{
+		case CMD::DRIVER_COMM_TEST:
+		{
+			status = STATUS_SUCCESS;
+			break;
+		}
+		case CMD::DRIVER_PROTECT_PROCESS:
+		{
+			auto process_data = (IOCTL_PROCESS*)data->Buf;
+			status = protect_filter::add_protect_list((ULONG)process_data->Pid, NULL, FALSE);
+			break;
+		}
+		case CMD::ADD_WHITE_PROCESS:
+		{
+			auto process_data = (IOCTL_PROCESS*)data->Buf;
+			status = protect_filter::add_protect_list((ULONG)process_data->Pid, NULL, TRUE);
+			break;
+		}
+		case CMD::WINDOW_ANIT_SCREEN:
+		{
+			auto window_data = (IOCTL_WINDOW*)data->Buf;
+
+			status = anit_screen_grap::GreProtectSpriteContent(
+				(HWND)window_data->HWND, (UINT)window_data->Flags);
+
+			break;
+		}
+		default:
+			break;
+		}
+
+		*(NTSTATUS*)data->status = status;
+		return status;
+	}
+}
+

Anti-Cheat_Driver/comm_dispatch.h

@@ -0,0 +1,33 @@
+#pragma once
+#include "Base.h"
+
+struct CMD_COMM
+{
+	DWORD64 CommID;
+	DWORD64 Buf;
+	DWORD64 status;
+};
+
+struct IOCTL_PROCESS
+{
+	DWORD64 Pid;
+};
+
+struct IOCTL_WINDOW
+{
+	DWORD64 HWND;
+	DWORD64 Flags;
+};
+enum CMD
+{
+	MSG_BASE = 0x10000,
+	DRIVER_COMM_TEST,
+	DRIVER_PROTECT_PROCESS,
+	ADD_WHITE_PROCESS,
+	WINDOW_ANIT_SCREEN,
+};
+
+namespace comm_dispatch
+{
+	auto dispatch(CMD_COMM* data)->NTSTATUS;
+}

Anti-Cheat_Driver/comm_win10.cpp

@@ -0,0 +1,74 @@
+#include "comm_win10.h"
+#include "comm_dispatch.h"
+#include "utils.h"
+#include "kernel_function.h"
+#pragma warning(disable : 4309 4838)
+
+typedef NTSTATUS(__fastcall* fnHalpTimerConvertAuxiliaryCounterToPerformanceCounter)(PVOID, PVOID, PVOID);
+fnHalpTimerConvertAuxiliaryCounterToPerformanceCounter _HalpTimerConvertAuxiliaryCounterToPerformanceCounter = 0;
+
+uintptr_t beep_trampoline_ptr;
+uintptr_t func_call_address;
+
+namespace comm_win10
+{
+	auto comm_callback(PVOID a1, PVOID a2, PVOID a3) -> NTSTATUS
+	{
+		comm_dispatch::dispatch((CMD_COMM*)a1);
+		return _HalpTimerConvertAuxiliaryCounterToPerformanceCounter(a1, a2, a3);
+	}
+
+	auto comm_init() -> BOOL
+	{
+		beep_trampoline_ptr = utils::get_beep_trampoline_ptr();
+		return !beep_trampoline_ptr ? FALSE : TRUE;
+	}
+
+	auto comm_install_hook() -> BOOL
+	{
+		auto ntoskrnl = kernel_function::GetKernelModule("ntoskrnl.exe");
+		if (!ntoskrnl)
+			return FALSE;
+
+		// mov rax,comm_callback
+		// jmp rax
+
+		char jmprax[] = { 0x48, 0xB8, 0x13, 0x09, 0xFC, 0xD6, 0xFC, 0x7F, 0x00, 0x00, 0xFF, 0xE0 };
+		*(uintptr_t*)&jmprax[2] = (uintptr_t)comm_callback;
+		
+		auto status = kernel_function::MmMDLPagesCopy((PVOID)beep_trampoline_ptr, &jmprax, sizeof(jmprax), 0x0000002, KernelMode);
+		if (!NT_SUCCESS(status))
+			return FALSE;
+
+		auto code_addr = utils::FindSectionsCode(ntoskrnl, "\x48\x8B\x05\x00\x00\x00\x00\x00\x00\x48\x8B\x05\x00\x00\x00\x00\xE8\x00\x00\x00\x00\x8B\xC8",
+			"xxx??????xxx????x????xx", "PAGE");
+
+		func_call_address = (*(long*)(code_addr + 3)) + (code_addr + 7);
+		_HalpTimerConvertAuxiliaryCounterToPerformanceCounter =
+			*(fnHalpTimerConvertAuxiliaryCounterToPerformanceCounter*)(func_call_address);
+
+		*(uintptr_t*)func_call_address = beep_trampoline_ptr;
+
+		return TRUE;
+	}
+	auto comm_remov_hook() -> BOOL
+	{
+		if (!func_call_address)
+			return FALSE;
+
+		*(uintptr_t*)func_call_address = 
+			(uintptr_t)_HalpTimerConvertAuxiliaryCounterToPerformanceCounter;
+
+		if (!beep_trampoline_ptr)
+			return FALSE;
+
+		char nullcode[12]{ 0 };
+		auto status = kernel_function::MmMDLPagesCopy((PVOID)beep_trampoline_ptr, &nullcode, sizeof(nullcode), 0x0000002, KernelMode);
+		if (!NT_SUCCESS(status))
+			return FALSE;
+
+		return TRUE;
+	}
+}
+
+

Anti-Cheat_Driver/comm_win10.h

@@ -0,0 +1,9 @@
+#pragma once
+#include "Base.h"
+
+namespace comm_win10
+{
+	auto comm_init()->BOOL;
+	auto comm_install_hook()->BOOL;
+	auto comm_remov_hook()->BOOL;
+}

Anti-Cheat_Driver/comm_win7.cpp

@@ -0,0 +1,91 @@
+#include "comm_win7.h"
+#include "comm_dispatch.h"
+#include "utils.h"
+#include "kernel_function.h"
+
+#pragma warning(disable : 4309 4838)
+
+PFILE_OBJECT file_obj{ 0 };
+PDEVICE_OBJECT device_obj{ 0 };
+
+LPVOID orign_maj_function = nullptr;
+
+namespace comm_win7
+{
+	auto comm_init() -> BOOL
+	{
+		UNICODE_STRING unName{ 0 };
+		RtlInitUnicodeString(&unName, L"\\Device\\Null");	
+		auto status = IoGetDeviceObjectPointer(&unName, FILE_ALL_ACCESS, &file_obj, &device_obj);
+		if (!NT_SUCCESS(status))
+			return FALSE;
+
+		ObDereferenceObject(file_obj);
+		return TRUE;
+	}
+
+	auto dispatch_device_io(PDEVICE_OBJECT drvice_object, PIRP irp)->NTSTATUS
+	{
+		UNREFERENCED_PARAMETER(drvice_object);
+		
+		auto comm_buf_data =  reinterpret_cast<CMD_COMM*>(irp->AssociatedIrp.SystemBuffer);
+
+		auto status = comm_dispatch::dispatch(comm_buf_data);
+
+		irp->IoStatus.Information = sizeof(CMD_COMM);
+		irp->IoStatus.Status = status;
+		IoCompleteRequest(irp, IO_NO_INCREMENT);
+		return status;
+	};
+
+	uintptr_t beep_trampoline = NULL;
+
+	auto comm_install_hook() -> BOOL
+	{
+		auto drv_obj = device_obj->DriverObject;
+		if (!drv_obj)
+			return FALSE;
+
+		orign_maj_function = drv_obj->MajorFunction[IRP_MJ_DEVICE_CONTROL];
+
+		beep_trampoline = utils::get_beep_trampoline_ptr();
+		if (!beep_trampoline)
+			return FALSE;
+
+		//mov rax,dispatch_device_io
+        //jmp rax
+		char jmprax[] = { 0x48, 0xB8, 0xA0, 0x9A, 0xD5, 0x3E, 0xFE, 0x7F, 0x00, 0x00, 0xFF, 0xE0 };
+
+		*(uintptr_t*)&jmprax[2] = (uintptr_t)dispatch_device_io;
+		kernel_function::MmMDLPagesCopy((PVOID)beep_trampoline, &jmprax, sizeof(jmprax), 0x0000002, KernelMode);
+
+		drv_obj->MajorFunction[IRP_MJ_DEVICE_CONTROL] = (PDRIVER_DISPATCH)beep_trampoline/*Ö±½Ó¾ÍÊÇÄãµÄº¯Êý*/;
+		
+		return TRUE;
+	}
+
+	auto comm_remov_hook() -> BOOL
+	{
+		auto drv_obj = device_obj->DriverObject;
+		if (!drv_obj)
+			return FALSE;
+
+		if (drv_obj->MajorFunction[IRP_MJ_DEVICE_CONTROL])
+		{
+			drv_obj->MajorFunction[IRP_MJ_DEVICE_CONTROL] = 
+				(PDRIVER_DISPATCH)orign_maj_function;
+
+			if (!beep_trampoline)
+				return FALSE;
+
+			char nullcode[12]{ 0 };
+			auto status = kernel_function::MmMDLPagesCopy((PVOID)beep_trampoline, &nullcode, sizeof(nullcode), 0x0000002, KernelMode);
+			if (!NT_SUCCESS(status))
+				return FALSE;
+
+		}
+
+		return TRUE;
+	}
+
+}

Anti-Cheat_Driver/comm_win7.h

@@ -0,0 +1,12 @@
+#pragma once
+#include "Base.h"
+
+namespace comm_win7
+{
+	auto comm_init()->BOOL;
+
+	auto comm_install_hook()->BOOL;
+
+	auto comm_remov_hook()->BOOL;
+
+}

Anti-Cheat_Driver/create_thread_callback.cpp

@@ -1,20 +1,75 @@
 #include "create_thread_callback.h"
 #include "protect_filter.h"
 #include "kernel_function.h"
+#include "utils.h"
+#include "kernel_api.h"
+#include "ssdt.h"
+
+#pragma warning(disable : 4309 4838)
+
+
+EXTERN_C NTKERNELAPI NTSTATUS ZwOpenThread(
+	_Out_ PHANDLE ThreadHandle,
+	_In_ ACCESS_MASK DesiredAccess,
+	_In_ POBJECT_ATTRIBUTES ObjectAttributes,
+	_In_ PCLIENT_ID ClientId
+	);
 
-#pragma warning(disable : 4309)
-#pragma warning(disable : 4838)
 
 namespace thread_notify_routine
 {
+
+	// 打开线程句柄并终止
+	NTSTATUS TerminateThreadByHandle(
+			HANDLE ProcessId,
+			HANDLE ThreadId)
+	{
+		NTSTATUS status;
+		HANDLE threadHandle = NULL;
+		OBJECT_ATTRIBUTES objAttr;
+		CLIENT_ID clientId;
+
+		clientId.UniqueProcess = ProcessId;
+		clientId.UniqueThread = ThreadId;
+
+		InitializeObjectAttributes(&objAttr, NULL, 0, NULL, NULL);
+
+		// 打开线程句柄
+		status = ZwOpenThread(
+			&threadHandle,
+			THREAD_TERMINATE,
+			&objAttr,
+			&clientId);
+
+		if (!NT_SUCCESS(status)) {
+			DbgPrintEx(77, 0, "[AnitCheat][%s] Failed to open thread %d: 0x%X\n",__FUNCTION__,
+				(ULONG)(ULONG_PTR)ThreadId, status);
+			return status;
+		}
+
+		// 终止线程
+		status = SSDT::ZwTerminateThread(threadHandle, STATUS_THREAD_IS_TERMINATING);
+
+		if (NT_SUCCESS(status)) {
+			/*DbgPrintEx(77, 0, "[ThreadKiller] Thread %d terminated successfully\n",
+				(ULONG)(ULONG_PTR)ThreadId);*/
+		}
+		else {
+			DbgPrintEx(77,0,"[AnitCheat][%s] Failed to terminate thread %d: 0x%X\n", __FUNCTION__,
+				(ULONG)(ULONG_PTR)ThreadId, status);
+		}
+
+		ZwClose(threadHandle);
+		return status;
+	}
+
 	//保护的进程ID
 	//auto protect_id = ULongToHandle(8976);
-
-
 	void thread_notify_routine(HANDLE ProcessId, HANDLE ThreadId, BOOLEAN Create)
 	{
 		if (Create)
 		{
+
 			PEPROCESS process{ 0 };
 			auto status = PsLookupProcessByProcessId(ProcessId, &process);
 			if (!NT_SUCCESS(status))
@@ -37,6 +92,8 @@ namespace thread_notify_routine
 
 			if (ProcessId != cutor_process_id)
 			{
+				//DbgBreakPoint();
+
 				DbgPrintEx(77, 0, "[!] 恶意远程线程检测！\n");
 
 				DbgPrintEx(77, 0, "[!] 目标进程ID: %d\n", ProcessId);
@@ -44,37 +101,21 @@ namespace thread_notify_routine
 				DbgPrintEx(77, 0, "[!] 创建者进程ID: %d\n", cutor_process_id);
 
 				DbgPrintEx(77, 0, "[!] 被创建线程ID: %d\n", ThreadId);
+
+
+				TerminateThreadByHandle(ProcessId, ThreadId);
+	
 			}
-
-			
-
 		end:	
 			ObDereferenceObject(process);
 		}
 	}
 
-	auto get_beep_trampoline_ptr() -> uintptr_t
+	uintptr_t trampoline_ptr = NULL;
-	{
-		uintptr_t trampoline_ptr = NULL;
-
-		auto beep = kernel_function::GetKernelModule("beep.sys");
-		auto nt_header = reinterpret_cast<PIMAGE_NT_HEADERS>(beep + reinterpret_cast<PIMAGE_DOS_HEADER>(beep)->e_lfanew);
-		auto file_header = &nt_header->FileHeader;
-
-		auto section_header = IMAGE_FIRST_SECTION(nt_header);
-		for (size_t i = 0; i < file_header->NumberOfSections; i++)
-		{
-			if (!strcmp((char*)section_header[i].Name, ".text"))
-			{
-				trampoline_ptr = ((beep + section_header[i].VirtualAddress) + section_header[i].Misc.VirtualSize);
-			}
-		}
-		return trampoline_ptr;
-	}
 
 	auto create_thread_routine() -> NTSTATUS
 	{
-		auto trampoline_ptr = get_beep_trampoline_ptr();
+		trampoline_ptr = utils::get_beep_trampoline_ptr();
 		if (trampoline_ptr)
 		{
 			char jmprax[] = { 0x48, 0xB8, 0xA0, 0x9A, 0xD5, 0x3E, 0xFE, 0x7F, 0x00, 0x00, 0xFF, 0xE0 };
@@ -92,10 +133,15 @@ namespace thread_notify_routine
 
 	auto unload_thread_routine() -> NTSTATUS
 	{
-		auto trampoline_ptr = get_beep_trampoline_ptr();
+		auto status = PsRemoveCreateThreadNotifyRoutine((PCREATE_PROCESS_NOTIFY_ROUTINE)trampoline_ptr);
-		return PsRemoveCreateThreadNotifyRoutine((PCREATE_PROCESS_NOTIFY_ROUTINE)trampoline_ptr);
+		if (!NT_SUCCESS(status))
+			return status;
+
+		char nullcode[12]{ 0 };
+		status = kernel_function::MmMDLPagesCopy((PVOID)trampoline_ptr, &nullcode, sizeof(nullcode), 0x0000002, KernelMode);
+		if (!NT_SUCCESS(status))
+			return status;
+
+		return STATUS_SUCCESS;
 	}
-
-
-	
 }

Anti-Cheat_Driver/driver_main.cpp

@@ -1,31 +1,43 @@
 #include "ob_reg_callback.h"
-#include "anit_screen_grap.h"
 #include "create_thread_callback.h"
+#include "process_notify_callback.h"
 #include "load_Image_callback.h"
 #include "protect_filter.h"
-#include "process_func.h"
+#include "comm.h"
-#include "kernel_function.h"
+#include "inline_hooks.h"
+#include "mouse_keybord_hook.h"
+#include "ssdt.h"
+
+
 EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING)
 {
 	if (drv_obj)
 	{
 		drv_obj->DriverUnload = [](PDRIVER_OBJECT)
 		{
-			ob_call_back::uninstall_ob_callback();
+			kernel_comm_create::remove();
+			//ob_call_back::uninstall_ob_callback();
+			process_notify_callback::remov_process_notify();
 			thread_notify_routine::unload_thread_routine();
+
+			mouse_keybord_hook::remove_mouse_keybord_hook();
+
 			//load_image_notify_routine::remove_image_load_notify_routine();
 		};
 	}
 
-
-	kernel_api::kernel_api_init();
 	protect_filter::Init();
+	kernel_api::kernel_api_init();
+	kernel_comm_create::Init();
 
-	protect_filter::add_list(10492, 0);
+	protect_filter::add_protect_list(3632, 0, FALSE);
-	DbgPrintEx(77, 0, "[+]ob_reg_callback status:%x\n", ob_call_back::register_ob_reg_callback());
+
+
+	mouse_keybord_hook::install_mouse_keybord_hook();
+	//DbgPrintEx(77, 0, "[+]ob_reg_callback status:%x\n", ob_call_back::register_ob_reg_callback());
+	DbgPrintEx(77, 0, "[+]process_notify_callback status:%x\n", process_notify_callback::install_process_notify());
 	DbgPrintEx(77, 0, "[+]create_thread_routine status:%x\n", thread_notify_routine::create_thread_routine());
 
-	//NtQueryVirtualMemory
 	//load_image_notify_routine::create_image_load_notify_routine();
 
 	return STATUS_SUCCESS;

Anti-Cheat_Driver/hde/hde64.cpp

@@ -0,0 +1,350 @@
+/*
+ * Hacker Disassembler Engine 64 C
+ * Copyright (c) 2008-2009, Vyacheslav Patkov.
+ * All rights reserved.
+ *
+ */
+
+#include "headers.hpp"
+
+#if defined(_M_X64) || defined(__x86_64__)
+#pragma warning(push, 0)
+#pragma warning(disable: 4701 4706 26451)
+
+#include "hde64.h"
+#include "table64.h"
+
+unsigned int hde64_disasm(const void* code, hde64s* hs)
+{
+	uint8_t x, c, * p = (uint8_t*)code, cflags, opcode, pref = 0;
+	uint8_t* ht = hde64_table, m_mod, m_reg, m_rm, disp_size = 0;
+	uint8_t op64 = 0;
+
+	// Avoid using memset to reduce the footprint.
+	memset(hs, 0, sizeof(hde64s));
+
+	for (x = 16; x; x--)
+		switch (c = *p++) {
+		case 0xf3:
+			hs->p_rep = c;
+			pref |= PRE_F3;
+			break;
+		case 0xf2:
+			hs->p_rep = c;
+			pref |= PRE_F2;
+			break;
+		case 0xf0:
+			hs->p_lock = c;
+			pref |= PRE_LOCK;
+			break;
+		case 0x26: case 0x2e: case 0x36:
+		case 0x3e: case 0x64: case 0x65:
+			hs->p_seg = c;
+			pref |= PRE_SEG;
+			break;
+		case 0x66:
+			hs->p_66 = c;
+			pref |= PRE_66;
+			break;
+		case 0x67:
+			hs->p_67 = c;
+			pref |= PRE_67;
+			break;
+		default:
+			goto pref_done;
+		}
+pref_done:
+
+	hs->flags = (uint32_t)pref << 23;
+
+	if (!pref)
+		pref |= PRE_NONE;
+
+	if ((c & 0xf0) == 0x40) {
+		hs->flags |= F_PREFIX_REX;
+		if ((hs->rex_w = (c & 0xf) >> 3) && (*p & 0xf8) == 0xb8)
+			op64++;
+		hs->rex_r = (c & 7) >> 2;
+		hs->rex_x = (c & 3) >> 1;
+		hs->rex_b = c & 1;
+		if (((c = *p++) & 0xf0) == 0x40) {
+			opcode = c;
+			goto error_opcode;
+		}
+	}
+
+	if ((hs->opcode = c) == 0x0f) {
+		hs->opcode2 = c = *p++;
+		ht += DELTA_OPCODES;
+	}
+	else if (c >= 0xa0 && c <= 0xa3) {
+		op64++;
+		if (pref & PRE_67)
+			pref |= PRE_66;
+		else
+			pref &= ~PRE_66;
+	}
+
+	opcode = c;
+	cflags = ht[ht[opcode / 4] + (opcode % 4)];
+
+	if (cflags == C_ERROR) {
+	error_opcode:
+		hs->flags |= F_ERROR | F_ERROR_OPCODE;
+		cflags = 0;
+		if ((opcode & -3) == 0x24)
+			cflags++;
+	}
+
+	x = 0;
+	if (cflags & C_GROUP) {
+		uint16_t t;
+		t = *(uint16_t*)(ht + (cflags & 0x7f));
+		cflags = (uint8_t)t;
+		x = (uint8_t)(t >> 8);
+	}
+
+	if (hs->opcode2) {
+		ht = hde64_table + DELTA_PREFIXES;
+		if (ht[ht[opcode / 4] + (opcode % 4)] & pref)
+			hs->flags |= F_ERROR | F_ERROR_OPCODE;
+	}
+
+	if (cflags & C_MODRM) {
+		hs->flags |= F_MODRM;
+		hs->modrm = c = *p++;
+		hs->modrm_mod = m_mod = c >> 6;
+		hs->modrm_rm = m_rm = c & 7;
+		hs->modrm_reg = m_reg = (c & 0x3f) >> 3;
+
+		if (x && ((x << m_reg) & 0x80))
+			hs->flags |= F_ERROR | F_ERROR_OPCODE;
+
+		if (!hs->opcode2 && opcode >= 0xd9 && opcode <= 0xdf) {
+			uint8_t t = opcode - 0xd9;
+			if (m_mod == 3) {
+				ht = hde64_table + DELTA_FPU_MODRM + t * 8;
+				t = ht[m_reg] << m_rm;
+			}
+			else {
+				ht = hde64_table + DELTA_FPU_REG;
+				t = ht[t] << m_reg;
+			}
+			if (t & 0x80)
+				hs->flags |= F_ERROR | F_ERROR_OPCODE;
+		}
+
+		if (pref & PRE_LOCK) {
+			if (m_mod == 3) {
+				hs->flags |= F_ERROR | F_ERROR_LOCK;
+			}
+			else {
+				uint8_t* table_end, op = opcode;
+				if (hs->opcode2) {
+					ht = hde64_table + DELTA_OP2_LOCK_OK;
+					table_end = ht + DELTA_OP_ONLY_MEM - DELTA_OP2_LOCK_OK;
+				}
+				else {
+					ht = hde64_table + DELTA_OP_LOCK_OK;
+					table_end = ht + DELTA_OP2_LOCK_OK - DELTA_OP_LOCK_OK;
+					op &= -2;
+				}
+				for (; ht != table_end; ht++)
+					if (*ht++ == op) {
+						if (!((*ht << m_reg) & 0x80))
+							goto no_lock_error;
+						else
+							break;
+					}
+				hs->flags |= F_ERROR | F_ERROR_LOCK;
+			no_lock_error:
+				;
+			}
+		}
+
+		if (hs->opcode2) {
+			switch (opcode) {
+			case 0x20: case 0x22:
+				m_mod = 3;
+				if (m_reg > 4 || m_reg == 1)
+					goto error_operand;
+				else
+					goto no_error_operand;
+			case 0x21: case 0x23:
+				m_mod = 3;
+				if (m_reg == 4 || m_reg == 5)
+					goto error_operand;
+				else
+					goto no_error_operand;
+			}
+		}
+		else {
+			switch (opcode) {
+			case 0x8c:
+				if (m_reg > 5)
+					goto error_operand;
+				else
+					goto no_error_operand;
+			case 0x8e:
+				if (m_reg == 1 || m_reg > 5)
+					goto error_operand;
+				else
+					goto no_error_operand;
+			}
+		}
+
+		if (m_mod == 3) {
+			uint8_t* table_end;
+			if (hs->opcode2) {
+				ht = hde64_table + DELTA_OP2_ONLY_MEM;
+				table_end = ht + sizeof(hde64_table) - DELTA_OP2_ONLY_MEM;
+			}
+			else {
+				ht = hde64_table + DELTA_OP_ONLY_MEM;
+				table_end = ht + DELTA_OP2_ONLY_MEM - DELTA_OP_ONLY_MEM;
+			}
+			for (; ht != table_end; ht += 2)
+				if (*ht++ == opcode) {
+					if (*ht++ & pref && !((*ht << m_reg) & 0x80))
+						goto error_operand;
+					else
+						break;
+				}
+			goto no_error_operand;
+		}
+		else if (hs->opcode2) {
+			switch (opcode) {
+			case 0x50: case 0xd7: case 0xf7:
+				if (pref & (PRE_NONE | PRE_66))
+					goto error_operand;
+				break;
+			case 0xd6:
+				if (pref & (PRE_F2 | PRE_F3))
+					goto error_operand;
+				break;
+			case 0xc5:
+				goto error_operand;
+			}
+			goto no_error_operand;
+		}
+		else
+			goto no_error_operand;
+
+	error_operand:
+		hs->flags |= F_ERROR | F_ERROR_OPERAND;
+	no_error_operand:
+
+		c = *p++;
+		if (m_reg <= 1) {
+			if (opcode == 0xf6)
+				cflags |= C_IMM8;
+			else if (opcode == 0xf7)
+				cflags |= C_IMM_P66;
+		}
+
+		switch (m_mod) {
+		case 0:
+			if (pref & PRE_67) {
+				if (m_rm == 6)
+					disp_size = 2;
+			}
+			else
+				if (m_rm == 5)
+					disp_size = 4;
+			break;
+		case 1:
+			disp_size = 1;
+			break;
+		case 2:
+			disp_size = 2;
+			if (!(pref & PRE_67))
+				disp_size <<= 1;
+		}
+
+		if (m_mod != 3 && m_rm == 4) {
+			hs->flags |= F_SIB;
+			p++;
+			hs->sib = c;
+			hs->sib_scale = c >> 6;
+			hs->sib_index = (c & 0x3f) >> 3;
+			if ((hs->sib_base = c & 7) == 5 && !(m_mod & 1))
+				disp_size = 4;
+		}
+
+		p--;
+		switch (disp_size) {
+		case 1:
+			hs->flags |= F_DISP8;
+			hs->disp.disp8 = *p;
+			break;
+		case 2:
+			hs->flags |= F_DISP16;
+			hs->disp.disp16 = *(uint16_t*)p;
+			break;
+		case 4:
+			hs->flags |= F_DISP32;
+			hs->disp.disp32 = *(uint32_t*)p;
+		}
+		p += disp_size;
+	}
+	else if (pref & PRE_LOCK)
+		hs->flags |= F_ERROR | F_ERROR_LOCK;
+
+	if (cflags & C_IMM_P66) {
+		if (cflags & C_REL32) {
+			if (pref & PRE_66) {
+				hs->flags |= F_IMM16 | F_RELATIVE;
+				hs->imm.imm16 = *(uint16_t*)p;
+				p += 2;
+				goto disasm_done;
+			}
+			goto rel32_ok;
+		}
+		if (op64) {
+			hs->flags |= F_IMM64;
+			hs->imm.imm64 = *(uint64_t*)p;
+			p += 8;
+		}
+		else if (!(pref & PRE_66)) {
+			hs->flags |= F_IMM32;
+			hs->imm.imm32 = *(uint32_t*)p;
+			p += 4;
+		}
+		else
+			goto imm16_ok;
+	}
+
+	if (cflags & C_IMM16) {
+	imm16_ok:
+		hs->flags |= F_IMM16;
+		hs->imm.imm16 = *(uint16_t*)p;
+		p += 2;
+	}
+	if (cflags & C_IMM8) {
+		hs->flags |= F_IMM8;
+		hs->imm.imm8 = *p++;
+	}
+
+	if (cflags & C_REL32) {
+	rel32_ok:
+		hs->flags |= F_IMM32 | F_RELATIVE;
+		hs->imm.imm32 = *(uint32_t*)p;
+		p += 4;
+	}
+	else if (cflags & C_REL8) {
+		hs->flags |= F_IMM8 | F_RELATIVE;
+		hs->imm.imm8 = *p++;
+	}
+
+disasm_done:
+
+	if ((hs->len = (uint8_t)(p - (uint8_t*)code)) > 15) {
+		hs->flags |= F_ERROR | F_ERROR_LENGTH;
+		hs->len = 15;
+	}
+
+	return (unsigned int)hs->len;
+}
+
+#pragma warning(pop)
+#endif // defined(_M_X64) || defined(__x86_64__)

Anti-Cheat_Driver/hde/hde64.h

@@ -0,0 +1,112 @@
+/*
+ * Hacker Disassembler Engine 64
+ * Copyright (c) 2008-2009, Vyacheslav Patkov.
+ * All rights reserved.
+ *
+ * hde64.h: C/C++ header file
+ *
+ */
+
+#ifndef _HDE64_H_
+#define _HDE64_H_
+
+/* stdint.h - C99 standard header
+ * http://en.wikipedia.org/wiki/stdint.h
+ *
+ * if your compiler doesn't contain "stdint.h" header (for
+ * example, Microsoft Visual C++), you can download file:
+ *   http://www.azillionmonkeys.com/qed/pstdint.h
+ * and change next line to:
+ *   #include "pstdint.h"
+ */
+#include "pstdint.h"
+
+#define F_MODRM         0x00000001
+#define F_SIB           0x00000002
+#define F_IMM8          0x00000004
+#define F_IMM16         0x00000008
+#define F_IMM32         0x00000010
+#define F_IMM64         0x00000020
+#define F_DISP8         0x00000040
+#define F_DISP16        0x00000080
+#define F_DISP32        0x00000100
+#define F_RELATIVE      0x00000200
+#define F_ERROR         0x00001000
+#define F_ERROR_OPCODE  0x00002000
+#define F_ERROR_LENGTH  0x00004000
+#define F_ERROR_LOCK    0x00008000
+#define F_ERROR_OPERAND 0x00010000
+#define F_PREFIX_REPNZ  0x01000000
+#define F_PREFIX_REPX   0x02000000
+#define F_PREFIX_REP    0x03000000
+#define F_PREFIX_66     0x04000000
+#define F_PREFIX_67     0x08000000
+#define F_PREFIX_LOCK   0x10000000
+#define F_PREFIX_SEG    0x20000000
+#define F_PREFIX_REX    0x40000000
+#define F_PREFIX_ANY    0x7f000000
+
+#define PREFIX_SEGMENT_CS   0x2e
+#define PREFIX_SEGMENT_SS   0x36
+#define PREFIX_SEGMENT_DS   0x3e
+#define PREFIX_SEGMENT_ES   0x26
+#define PREFIX_SEGMENT_FS   0x64
+#define PREFIX_SEGMENT_GS   0x65
+#define PREFIX_LOCK         0xf0
+#define PREFIX_REPNZ        0xf2
+#define PREFIX_REPX         0xf3
+#define PREFIX_OPERAND_SIZE 0x66
+#define PREFIX_ADDRESS_SIZE 0x67
+
+#pragma pack(push,1)
+
+typedef struct {
+    uint8_t len;
+    uint8_t p_rep;
+    uint8_t p_lock;
+    uint8_t p_seg;
+    uint8_t p_66;
+    uint8_t p_67;
+    uint8_t rex;
+    uint8_t rex_w;
+    uint8_t rex_r;
+    uint8_t rex_x;
+    uint8_t rex_b;
+    uint8_t opcode;
+    uint8_t opcode2;
+    uint8_t modrm;
+    uint8_t modrm_mod;
+    uint8_t modrm_reg;
+    uint8_t modrm_rm;
+    uint8_t sib;
+    uint8_t sib_scale;
+    uint8_t sib_index;
+    uint8_t sib_base;
+    union {
+        uint8_t imm8;
+        uint16_t imm16;
+        uint32_t imm32;
+        uint64_t imm64;
+    } imm;
+    union {
+        uint8_t disp8;
+        uint16_t disp16;
+        uint32_t disp32;
+    } disp;
+    uint32_t flags;
+} hde64s;
+
+#pragma pack(pop)
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* __cdecl */
+unsigned int hde64_disasm(const void *code, hde64s *hs);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _HDE64_H_ */

Anti-Cheat_Driver/hde/headers.hpp

@@ -0,0 +1,11 @@
+#pragma once
+
+#include <ntifs.h>
+#include <ntdef.h>
+#include <ntddk.h>
+#include <wdm.h>
+#include <ntstatus.h>
+#include <ntimage.h>
+#include <ntstrsafe.h>
+#include <intrin.h>
+#include <intsafe.h>

Anti-Cheat_Driver/hde/pstdint.h

@@ -0,0 +1,37 @@
+/*
+ *  MinHook - The Minimalistic API Hooking Library for x64/x86
+ *  Copyright (C) 2009-2017 Tsuda Kageyu. All rights reserved.
+ *
+ *  Redistribution and use in source and binary forms, with or without
+ *  modification, are permitted provided that the following conditions
+ *  are met:
+ *
+ *  1. Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ *  2. Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ *  THIS SOFTWARE IS PROVIDED BY THE AUTHOR "AS IS" AND ANY EXPRESS OR
+ *  IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ *  OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ *  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ *  INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ *  NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ *  DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ *  THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ *  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ *  THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+// Integer types for HDE.
+typedef INT8   int8_t;
+typedef INT16  int16_t;
+typedef INT32  int32_t;
+typedef INT64  int64_t;
+typedef UINT8  uint8_t;
+typedef UINT16 uint16_t;
+typedef UINT32 uint32_t;
+typedef UINT64 uint64_t;

Anti-Cheat_Driver/hde/table64.h

@@ -0,0 +1,74 @@
+/*
+ * Hacker Disassembler Engine 64 C
+ * Copyright (c) 2008-2009, Vyacheslav Patkov.
+ * All rights reserved.
+ *
+ */
+
+#define C_NONE    0x00
+#define C_MODRM   0x01
+#define C_IMM8    0x02
+#define C_IMM16   0x04
+#define C_IMM_P66 0x10
+#define C_REL8    0x20
+#define C_REL32   0x40
+#define C_GROUP   0x80
+#define C_ERROR   0xff
+
+#define PRE_ANY  0x00
+#define PRE_NONE 0x01
+#define PRE_F2   0x02
+#define PRE_F3   0x04
+#define PRE_66   0x08
+#define PRE_67   0x10
+#define PRE_LOCK 0x20
+#define PRE_SEG  0x40
+#define PRE_ALL  0xff
+
+#define DELTA_OPCODES      0x4a
+#define DELTA_FPU_REG      0xfd
+#define DELTA_FPU_MODRM    0x104
+#define DELTA_PREFIXES     0x13c
+#define DELTA_OP_LOCK_OK   0x1ae
+#define DELTA_OP2_LOCK_OK  0x1c6
+#define DELTA_OP_ONLY_MEM  0x1d8
+#define DELTA_OP2_ONLY_MEM 0x1e7
+
+unsigned char hde64_table[] = {
+  0xa5,0xaa,0xa5,0xb8,0xa5,0xaa,0xa5,0xaa,0xa5,0xb8,0xa5,0xb8,0xa5,0xb8,0xa5,
+  0xb8,0xc0,0xc0,0xc0,0xc0,0xc0,0xc0,0xc0,0xc0,0xac,0xc0,0xcc,0xc0,0xa1,0xa1,
+  0xa1,0xa1,0xb1,0xa5,0xa5,0xa6,0xc0,0xc0,0xd7,0xda,0xe0,0xc0,0xe4,0xc0,0xea,
+  0xea,0xe0,0xe0,0x98,0xc8,0xee,0xf1,0xa5,0xd3,0xa5,0xa5,0xa1,0xea,0x9e,0xc0,
+  0xc0,0xc2,0xc0,0xe6,0x03,0x7f,0x11,0x7f,0x01,0x7f,0x01,0x3f,0x01,0x01,0xab,
+  0x8b,0x90,0x64,0x5b,0x5b,0x5b,0x5b,0x5b,0x92,0x5b,0x5b,0x76,0x90,0x92,0x92,
+  0x5b,0x5b,0x5b,0x5b,0x5b,0x5b,0x5b,0x5b,0x5b,0x5b,0x5b,0x5b,0x6a,0x73,0x90,
+  0x5b,0x52,0x52,0x52,0x52,0x5b,0x5b,0x5b,0x5b,0x77,0x7c,0x77,0x85,0x5b,0x5b,
+  0x70,0x5b,0x7a,0xaf,0x76,0x76,0x5b,0x5b,0x5b,0x5b,0x5b,0x5b,0x5b,0x5b,0x5b,
+  0x5b,0x5b,0x86,0x01,0x03,0x01,0x04,0x03,0xd5,0x03,0xd5,0x03,0xcc,0x01,0xbc,
+  0x03,0xf0,0x03,0x03,0x04,0x00,0x50,0x50,0x50,0x50,0xff,0x20,0x20,0x20,0x20,
+  0x01,0x01,0x01,0x01,0xc4,0x02,0x10,0xff,0xff,0xff,0x01,0x00,0x03,0x11,0xff,
+  0x03,0xc4,0xc6,0xc8,0x02,0x10,0x00,0xff,0xcc,0x01,0x01,0x01,0x00,0x00,0x00,
+  0x00,0x01,0x01,0x03,0x01,0xff,0xff,0xc0,0xc2,0x10,0x11,0x02,0x03,0x01,0x01,
+  0x01,0xff,0xff,0xff,0x00,0x00,0x00,0xff,0x00,0x00,0xff,0xff,0xff,0xff,0x10,
+  0x10,0x10,0x10,0x02,0x10,0x00,0x00,0xc6,0xc8,0x02,0x02,0x02,0x02,0x06,0x00,
+  0x04,0x00,0x02,0xff,0x00,0xc0,0xc2,0x01,0x01,0x03,0x03,0x03,0xca,0x40,0x00,
+  0x0a,0x00,0x04,0x00,0x00,0x00,0x00,0x7f,0x00,0x33,0x01,0x00,0x00,0x00,0x00,
+  0x00,0x00,0xff,0xbf,0xff,0xff,0x00,0x00,0x00,0x00,0x07,0x00,0x00,0xff,0x00,
+  0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xff,0xff,
+  0x00,0x00,0x00,0xbf,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x7f,0x00,0x00,
+  0xff,0x40,0x40,0x40,0x40,0x41,0x49,0x40,0x40,0x40,0x40,0x4c,0x42,0x40,0x40,
+  0x40,0x40,0x40,0x40,0x40,0x40,0x4f,0x44,0x53,0x40,0x40,0x40,0x44,0x57,0x43,
+  0x5c,0x40,0x60,0x40,0x40,0x40,0x40,0x40,0x40,0x40,0x40,0x40,0x40,0x40,0x40,
+  0x40,0x40,0x64,0x66,0x6e,0x6b,0x40,0x40,0x6a,0x46,0x40,0x40,0x44,0x46,0x40,
+  0x40,0x5b,0x44,0x40,0x40,0x00,0x00,0x00,0x00,0x06,0x06,0x06,0x06,0x01,0x06,
+  0x06,0x02,0x06,0x06,0x00,0x06,0x00,0x0a,0x0a,0x00,0x00,0x00,0x02,0x07,0x07,
+  0x06,0x02,0x0d,0x06,0x06,0x06,0x0e,0x05,0x05,0x02,0x02,0x00,0x00,0x04,0x04,
+  0x04,0x04,0x05,0x06,0x06,0x06,0x00,0x00,0x00,0x0e,0x00,0x00,0x08,0x00,0x10,
+  0x00,0x18,0x00,0x20,0x00,0x28,0x00,0x30,0x00,0x80,0x01,0x82,0x01,0x86,0x00,
+  0xf6,0xcf,0xfe,0x3f,0xab,0x00,0xb0,0x00,0xb1,0x00,0xb3,0x00,0xba,0xf8,0xbb,
+  0x00,0xc0,0x00,0xc1,0x00,0xc7,0xbf,0x62,0xff,0x00,0x8d,0xff,0x00,0xc4,0xff,
+  0x00,0xc5,0xff,0x00,0xff,0xff,0xeb,0x01,0xff,0x0e,0x12,0x08,0x00,0x13,0x09,
+  0x00,0x16,0x08,0x00,0x17,0x09,0x00,0x2b,0x09,0x00,0xae,0xff,0x07,0xb2,0xff,
+  0x00,0xb4,0xff,0x00,0xb5,0xff,0x00,0xc3,0x01,0x00,0xc7,0xff,0xbf,0xe7,0x08,
+  0x00,0xf0,0x02,0x00
+};

Anti-Cheat_Driver/inline_hooks.cpp

@@ -0,0 +1,110 @@
+#include "inline_hooks.h"
+#include "kernel_function.h"
+#include "hde/hde64.h"
+
+#pragma warning(disable : 4309 4838)
+
+inline_hooks_manager* inline_hooks_manager::instance;
+
+inline_hooks_manager* inline_hooks_manager::fn_get_instance()
+{
+	if (instance == nullptr)
+	{
+		instance = (inline_hooks_manager*)ExAllocatePoolWithTag(NonPagedPool, sizeof(inline_hooks_manager), 'hook');
+
+		instance->m_cur_hook_count = 0;
+		instance->m_trampo_line = (unsigned char*)ExAllocatePoolWithTag(NonPagedPool, PAGE_SIZE, 'line');
+		RtlSecureZeroMemory(instance->m_Info, sizeof(HOOK_INFO) * HOOK_MAX_COUNT);
+		RtlSecureZeroMemory(instance->m_trampo_line, PAGE_SIZE);
+	}
+
+	return instance;
+}
+
+auto inline_hooks_manager::inline_install_hook(void* target_func, void* my_function, void** origon_func) -> BOOL
+{
+	if (m_cur_hook_count > HOOK_MAX_COUNT)
+		return FALSE;
+
+	auto ori_func_addr = reinterpret_cast<unsigned char*>(target_func);
+
+	hde64s hde{ 0 };
+	uint64_t break_byte_count = NULL;
+	while (break_byte_count < 14)
+	{
+		hde64_disasm(ori_func_addr + break_byte_count, &hde);
+		break_byte_count += hde.len;
+	}
+
+	//保存原来的hook信息方便进行恢复
+	m_Info[m_cur_hook_count].origon_func = target_func;
+	memcpy(m_Info[m_cur_hook_count].destroy_code, target_func, 14);
+	m_cur_hook_count++;
+
+	//开始hook
+	//2D963190000 - FF25 00000000 A09AA40CFC7F0000 - jmp USER32.GetWindow
+	char jmpcode[14] = { 0xFF,0x25,0,0,0,0,0xA0,0x9A,0xA4,0x0C,0xFC,0x7F,0x00,0x00 };
+	*(uint64_t*)&jmpcode[6] = (uint64_t)my_function;
+
+	//蹦床构建
+	*origon_func = bulid_trampo_line(ori_func_addr, break_byte_count);
+
+	auto status = kernel_function::MmMDLPagesCopy(ori_func_addr, &jmpcode, sizeof(jmpcode), 0x0000002, KernelMode);
+	if (!NT_SUCCESS(status))
+		return FALSE;
+
+	return TRUE;
+}
+ 
+auto inline_hooks_manager::inline_remov_hook(void** origon_func) -> BOOL
+{
+	for (size_t i = 0; i < HOOK_MAX_COUNT; i++)
+	{
+		if (m_cur_hook_count <= i)
+			break;
+
+		if (m_Info[i].origon_func)
+		{
+			if (m_Info[i].origon_func == origon_func)
+			{
+				kernel_function::MmMDLPagesCopy(m_Info[i].origon_func,
+					&m_Info[i].destroy_code, 14, 0x0000002, KernelMode);
+			}
+
+			if (origon_func == nullptr) {
+				kernel_function::MmMDLPagesCopy(m_Info[i].origon_func,
+					&m_Info[i].destroy_code, 14, 0x0000002, KernelMode);
+			}
+		}
+	}
+	return TRUE;
+}
+
+auto inline_hooks_manager::bulid_trampo_line(void* target_func, UINT64 break_byte_count) -> void*
+{
+	//push 低32位
+	//mov[rsp+4],高32位
+	//ret
+
+	/*138DADF0000 - 68 A09AA40C - push 0CA49AA0
+	138DADF0005 - C7 44 24 04 FC7F0000 - mov[rsp + 04], 00007FFC
+	138DADF000D - C3 - ret*/
+
+	char push_mov_ret[] =
+	{   0x68, 0xA0, 0x9A, 0xA4, 0x0C,
+	    0xC7, 0x44, 0x24, 0x04, 0xFC, 0x7F, 0x00, 0x00,
+	    0xC3
+	};
+
+	*(uint32_t*)&push_mov_ret[1] = (((uint64_t)target_func + break_byte_count) & 0xffffffff);
+	*(uint32_t*)&push_mov_ret[9] = ((((uint64_t)target_func + break_byte_count) >> 32) & 0xffffffff);
+
+	memcpy(instance->m_trampo_line, target_func, break_byte_count);
+	memcpy(instance->m_trampo_line + break_byte_count, &push_mov_ret, sizeof(push_mov_ret));
+
+	auto ret = reinterpret_cast<void*>(instance->m_trampo_line);
+
+	instance->m_trampo_line += break_byte_count + sizeof(push_mov_ret);
+
+	return ret;
+}

Anti-Cheat_Driver/inline_hooks.h

@@ -0,0 +1,36 @@
+#pragma once
+#include "Base.h"
+
+#define HOOK_MAX_COUNT 0x100
+
+typedef struct _HOOK_INFO
+{
+	void* origon_func;
+
+	unsigned char* destroy_code[14];
+
+	unsigned char* m_trampo_line;
+
+}HOOK_INFO, * PHOOK_INFO;
+
+
+class inline_hooks_manager
+{
+public:
+	static inline_hooks_manager* fn_get_instance();
+
+	auto inline_install_hook(void* target_func,void* my_function, void** origon_func) -> BOOL;
+
+	auto inline_remov_hook(void** origon_func)->BOOL;
+
+	auto inline_remov_all_hook()->BOOL;
+
+	auto bulid_trampo_line(void* target_func, UINT64 break_byte_count) -> void*;
+
+private:
+	static inline_hooks_manager* instance;
+	unsigned char* m_trampo_line;
+
+	UINT64 m_cur_hook_count;
+	_HOOK_INFO m_Info[HOOK_MAX_COUNT];
+};

Anti-Cheat_Driver/io_ctl.cpp

@@ -39,6 +39,9 @@ auto io_ctl::init_device_and_symbolic(PDRIVER_OBJECT drv_obj) -> NTSTATUS
 		break;
 	}
 
+
+	
+
 	drv_obj->MajorFunction[IRP_MJ_CLOSE] = dispatch_create_close;
 	drv_obj->MajorFunction[IRP_MJ_CREATE] = dispatch_create_close;
 	drv_obj->MajorFunction[IRP_MJ_DEVICE_CONTROL] = dispatch_device_io;

Anti-Cheat_Driver/kernel_api.cpp

@@ -1,9 +1,9 @@
 #include "kernel_api.h"
+struct imported_ imported { 0 };
+
 
 namespace kernel_api
 {
-	struct imported_ imported { 0 };
-
 	auto kernel_api_init() -> void
 	{
 		UNICODE_STRING unFuncName{ 0 };
@@ -19,6 +19,12 @@ namespace kernel_api
 
 		RtlInitUnicodeString(&unFuncName, L"SeLocateProcessImageName");
 		imported.se_locateprocess_imagename = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
+
+		RtlInitUnicodeString(&unFuncName, L"RtlFindExportedRoutineByName");
+		imported.rtl_findexported_routinebyname = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
+
+		RtlInitUnicodeString(&unFuncName, L"ZwOpenThread");
+		imported.nt_open_thread = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
 	}
 
 	NTSTATUS ntquerysysteminformation(ULONG SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength)
@@ -43,4 +49,16 @@ namespace kernel_api
 		return reinterpret_cast<NTSTATUS(*)(PEPROCESS, PUNICODE_STRING*)>
 			(imported.se_locateprocess_imagename)(Process, pImageFileName);
 	}
+
+	PVOID rtlfindexportedroutinebyname(PVOID ImageBase, PCCH RoutineName)
+	{
+		return reinterpret_cast<PVOID(*)(PVOID, PCCH)>(imported.rtl_findexported_routinebyname)
+			(ImageBase, RoutineName);
+	}
+	NTSTATUS ntopenthread(PHANDLE ThreadHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId)
+	{
+		return reinterpret_cast<NTSTATUS(*)(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, PCLIENT_ID)>(imported.nt_open_thread)
+			(ThreadHandle, DesiredAccess, ObjectAttributes, ClientId);
+	}
 }
+	

Anti-Cheat_Driver/kernel_api.h

@@ -19,11 +19,12 @@ struct imported_
 	ULONG64 ps_getprocess_section_baseaddress;
 	ULONG64 ps_getprocess_id;
 	ULONG64 se_locateprocess_imagename;
+	ULONG64 nt_open_thread;
 };
 
 namespace kernel_api
 {
-	extern struct imported_ imported;
+	//extern struct imported_ imported;
 
 	auto kernel_api_init() -> void;
 
@@ -38,4 +39,7 @@ namespace kernel_api
 
 	NTSTATUS selocate_process_imagename(PEPROCESS Process, PUNICODE_STRING* pImageFileName);
 
+	PVOID rtlfindexportedroutinebyname(PVOID ImageBase, PCCH RoutineName);
+
+	NTSTATUS ntopenthread(PHANDLE ThreadHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId);
 }

Anti-Cheat_Driver/kernel_function.cpp

@@ -5,10 +5,9 @@
 #pragma warning(disable : 4838)
 namespace kernel_function
 {
-	PEPROCESS process{ 0 };
-
 	auto FindProcess(const CHAR* ProcessName) -> PEPROCESS
 	{
+		PEPROCESS process{ 0 };
 		for (ULONG i = 4; i < 0x401000; i += 4)
 		{
 			auto status = PsLookupProcessByProcessId(ULongToHandle(i), &process);
@@ -68,6 +67,65 @@ namespace kernel_function
 		return base;
 	}
 
+	auto GetProcessModule(HANDLE Pid, UNICODE_STRING ModuleName, PVOID Buffer) -> NTSTATUS
+	{
+		NTSTATUS status = STATUS_SUCCESS;
+		PEPROCESS process = NULL;
+		UNICODE_STRING UniCodeName{ 0 };
+		uintptr_t ModuleBase = 0;
+
+		status = PsLookupProcessByProcessId(Pid, &process);
+		if (!NT_SUCCESS(status))
+		{
+			DbgPrintEx(77, 0, "[drv_memory] PsLookupProcessByProcessId failed with status %x\n", status);
+			return status;
+		}
+		BOOLEAN Is64 = (utils::PsGetProcessWow64Process(process) != NULL) ? TRUE : FALSE;
+
+		KAPC_STATE ApcState;
+		KeStackAttachProcess(process, &ApcState);
+		if (Is64)
+		{
+			PPEB32 Peb32 = (PPEB32)utils::PsGetProcessWow64Process(process);
+			PLIST_ENTRY32 LdrEntry32 = (PLIST_ENTRY32)((PPEB_LDR_DATA32)Peb32->Ldr)->InLoadOrderModuleList.Flink;
+			while (LdrEntry32 != &((PPEB_LDR_DATA32)Peb32->Ldr)->InLoadOrderModuleList)
+			{
+				PLDR_DATA_TABLE_ENTRY32 LdrDataTableEntry32 = (PLDR_DATA_TABLE_ENTRY32)LdrEntry32;
+				if (LdrDataTableEntry32->BaseDllName.Buffer == NULL) continue;
+
+				RtlInitUnicodeString(&UniCodeName, (PWCHAR)LdrDataTableEntry32->BaseDllName.Buffer);
+				if (RtlEqualUnicodeString(&ModuleName, &UniCodeName, TRUE))
+				{
+					ModuleBase = (uintptr_t)LdrDataTableEntry32->DllBase;
+					break;
+				}
+				LdrEntry32 = (PLIST_ENTRY32)LdrEntry32->Flink;
+			}
+		}
+		else
+		{
+			PPEB64 Peb64 = (PPEB64)utils::PsGetProcessPeb(process);
+			PLIST_ENTRY64 LdrEntry64 = (PLIST_ENTRY64)((PPEB_LDR_DATA64)Peb64->Ldr)->InLoadOrderModuleList.Flink;
+			while (LdrEntry64 != &((PPEB_LDR_DATA64)Peb64->Ldr)->InLoadOrderModuleList)
+			{
+				PLDR_DATA_TABLE_ENTRY64 LdrDataTableEntry64 = (PLDR_DATA_TABLE_ENTRY64)LdrEntry64;
+				if (LdrDataTableEntry64->BaseDllName.Buffer == NULL) continue;
+
+				RtlInitUnicodeString(&UniCodeName, LdrDataTableEntry64->BaseDllName.Buffer);
+				if (RtlEqualUnicodeString(&UniCodeName, &ModuleName, TRUE))
+				{
+					ModuleBase = (uintptr_t)LdrDataTableEntry64->DllBase;
+					break;
+				}
+				LdrEntry64 = (PLIST_ENTRY64)LdrEntry64->Flink;
+			}
+		}
+		KeUnstackDetachProcess(&ApcState);
+		ObDereferenceObject(process);
+		RtlCopyMemory(Buffer, &ModuleBase, sizeof(uintptr_t));
+		return status;
+	}
+
 	auto MmMDLPagesCopy(IN PVOID Address, PVOID Buff, SIZE_T Size, BYTE Type, CHAR AccessMode) -> NTSTATUS
 	{
 		PMDL pMDL = IoAllocateMdl(Address, (ULONG)Size, FALSE, FALSE, NULL);
@@ -169,5 +227,33 @@ namespace kernel_function
 		return TRUE;
 	}
 
+	auto ke_stack_attch_process(PEPROCESS PROCESS) -> KAPC_STATE
+	{
+		KAPC_STATE apc_state{ 0 };
+		KeStackAttachProcess(PROCESS, &apc_state);
+		return apc_state;
+	}
 
+	auto ke_unstack_detach_process(KAPC_STATE apc_state) -> void
+	{
+		KeUnstackDetachProcess(&apc_state);
+	}
+
+	auto GetgSessionGlobalSlots() -> uintptr_t {
+
+		static uintptr_t gSessionGlobalSlots;
+		if (gSessionGlobalSlots == NULL) {
+			auto win32k = GetKernelModule("win32k.sys");
+			if (!win32k)
+				return NULL;
+
+			auto W32GetSessionStateForSession = utils::FindSectionsCode(win32k, "\x48\x8b\x05\x00\x00\x00\x00\xff\xc9\x48\x8b\x04\xc8", "xxx????xxxxxx", ".text");
+			if (!W32GetSessionStateForSession)
+				return NULL;
+
+			gSessionGlobalSlots = (*(ULONG*)(W32GetSessionStateForSession + 3)) + (W32GetSessionStateForSession + 7);
+		}
+
+		return gSessionGlobalSlots;
+	}
 }

Anti-Cheat_Driver/kernel_function.h

@@ -37,11 +37,119 @@ namespace kernel_function
 		RTL_PROCESS_MODULE_INFORMATION Modules[1];
 	} RTL_PROCESS_MODULES, * PRTL_PROCESS_MODULES;
 
+	typedef struct _PEB32
+	{
+		UCHAR InheritedAddressSpace;
+		UCHAR ReadImageFileExecOptions;
+		UCHAR BeingDebugged;
+		UCHAR BitField;
+		ULONG Mutant;
+		ULONG ImageBaseAddress;
+		ULONG Ldr;
+		ULONG ProcessParameters;
+		ULONG SubSystemData;
+		ULONG ProcessHeap;
+		ULONG FastPebLock;
+		ULONG AtlThunkSListPtr;
+		ULONG IFEOKey;
+		ULONG CrossProcessFlags;
+		ULONG UserSharedInfoPtr;
+		ULONG SystemReserved;
+		ULONG AtlThunkSListPtr32;
+		ULONG ApiSetMap;
+	} PEB32, * PPEB32;  ////32 PEB½á¹¹
+
+	typedef struct _LDR_DATA_TABLE_ENTRY32
+	{
+		LIST_ENTRY32 InLoadOrderLinks;
+		LIST_ENTRY32 InMemoryOrderLinks;
+		LIST_ENTRY32 InInitializationOrderLinks;
+		ULONG DllBase;
+		ULONG EntryPoint;
+		ULONG SizeOfImage;
+		UNICODE_STRING32 FullDllName;
+		UNICODE_STRING32 BaseDllName;
+		ULONG Flags;
+		USHORT LoadCount;
+		USHORT TlsIndex;
+		LIST_ENTRY32 HashLinks;
+		ULONG TimeDateStamp;
+	} LDR_DATA_TABLE_ENTRY32, * PLDR_DATA_TABLE_ENTRY32;//32 PEB½á¹¹
+	typedef struct _PEB_LDR_DATA32
+	{
+		ULONG Length;
+		UCHAR Initialized;
+		ULONG SsHandle;
+		LIST_ENTRY32 InLoadOrderModuleList;
+		LIST_ENTRY32 InMemoryOrderModuleList;
+		LIST_ENTRY32 InInitializationOrderModuleList;
+	} PEB_LDR_DATA32, * PPEB_LDR_DATA32;//32 PEB½á¹¹
+
+	typedef struct _PEB64
+	{
+		UCHAR InheritedAddressSpace;
+		UCHAR ReadImageFileExecOptions;
+		UCHAR BeingDebugged;
+		UCHAR BitField;
+		ULONG64 Mutant;
+		ULONG64 ImageBaseAddress;
+		ULONG64 Ldr;
+		ULONG64 ProcessParameters;
+		ULONG64 SubSystemData;
+		ULONG64 ProcessHeap;
+		ULONG64 FastPebLock;
+		ULONG64 AtlThunkSListPtr;
+		ULONG64 IFEOKey;
+		ULONG64 CrossProcessFlags;
+		ULONG64 UserSharedInfoPtr;
+		ULONG SystemReserved;
+		ULONG AtlThunkSListPtr32;
+		ULONG64 ApiSetMap;
+	} PEB64, * PPEB64;
+	typedef struct _PEB_LDR_DATA64
+	{
+		ULONG Length;
+		BOOLEAN Initialized;
+		ULONG64 SsHandle;
+		LIST_ENTRY64 InLoadOrderModuleList;
+		LIST_ENTRY64 InMemoryOrderModuleList;
+		LIST_ENTRY64 InInitializationOrderModuleList;
+		ULONG64 EntryInProgress;
+	} PEB_LDR_DATA64, * PPEB_LDR_DATA64;
+	typedef struct _LDR_DATA_TABLE_ENTRY64
+	{
+		LIST_ENTRY64 InLoadOrderLinks;
+		LIST_ENTRY64 InMemoryOrderLinks;
+		LIST_ENTRY64 InInitializationOrderLinks;
+		PVOID DllBase;
+		ULONG64 EntryPoint;
+		ULONG64 SizeOfImage;
+		UNICODE_STRING FullDllName;
+		UNICODE_STRING BaseDllName;
+		ULONG Flags;
+		USHORT LoadCount;
+		USHORT TlsIndex;
+		LIST_ENTRY64 HashLinks;
+		ULONG64 SectionPointer;
+		ULONG64 CheckSum;
+		ULONG64 TimeDateStamp;
+		ULONG64 LoadedImports;
+		ULONG64 EntryPointActivationContext;
+		ULONG64 PatchInformation;
+		LIST_ENTRY64 ForwarderLinks;
+		LIST_ENTRY64 ServiceTagLinks;
+		LIST_ENTRY64 StaticLinks;
+		ULONG64 ContextInformation;
+		ULONG64 OriginalBase;
+		LARGE_INTEGER LoadTime;
+	} LDR_DATA_TABLE_ENTRY64, * PLDR_DATA_TABLE_ENTRY64;
 
 	auto FindProcess(CONST CHAR* ProcessName)->PEPROCESS;
 
 	auto GetKernelModule(CONST CHAR* Module)->uintptr_t;
 
+	auto GetProcessModule(HANDLE Pid, UNICODE_STRING ModuleName, PVOID Buffer) -> NTSTATUS;
+
 	auto MmMDLPagesCopy(IN PVOID Address, PVOID Buff, SIZE_T Size, BYTE Type, CHAR AccessMode)->NTSTATUS;
 
 	auto GetMmverifyCallBackFlags()->uintptr_t;
@@ -49,4 +157,10 @@ namespace kernel_function
 	auto Mack_MmVerifyCallBackFlags(BYTE** orgin_byte)->BOOL;
 
 	auto Orgin_MmVerifyCallBackFlags(BYTE* orgin_byte)->BOOL;
+
+	auto ke_stack_attch_process(PEPROCESS PROCESS) ->KAPC_STATE;
+
+	auto ke_unstack_detach_process(KAPC_STATE apc_state) -> void;
+
+	auto GetgSessionGlobalSlots()->uintptr_t;
 }

Anti-Cheat_Driver/load_Image_callback.cpp

@@ -2,6 +2,10 @@
 
 namespace load_image_notify_routine
 {
+
+	typedef NTSTATUS(__fastcall* fnMmUnloadSystemImage)(PVOID ImageBase);
+	fnMmUnloadSystemImage _MmUnloadSystemImage = (fnMmUnloadSystemImage)0xfffff800042748a0;
+
 	VOID load_image_notify_routine(
 		PUNICODE_STRING FullImageName,
 		HANDLE ProcessId,
@@ -16,10 +20,13 @@ namespace load_image_notify_routine
 
 			if (wcsstr(FullImageName->Buffer, L"MyDriver1"))
 			{
-				DbgPrintEx(77, 0, "[+] %ws | pid:%d\n", FullImageName->Buffer, ProcessId);
+				//DbgBreakPoint();
 
-				ZwUnmapViewOfSection(PsGetCurrentProcess(), ImageInfo->ImageBase);
+				//DbgPrintEx(77, 0, "[+] %ws | pid:%d\n", FullImageName->Buffer, ProcessId);
 
+				//auto status = _MmUnloadSystemImage(ImageInfo->ImageBase);
+
+				//DbgPrintEx(77, 0, "%x\n", status);
 			}
 
 		}

Anti-Cheat_Driver/mouse_key_win10.cpp

@@ -0,0 +1,19 @@
+#include "mouse_key_win10.h"
+#include "protect_filter.h"
+
+fnNtUserSendInput_win10 origon_NtUserSendInput_win10;
+
+
+namespace mouse_key_win10
+{
+	__int64 __fastcall hkNtUserSendInput(unsigned int a1, volatile void* a2, int a3, int a4)
+	{
+		auto pid = PsGetCurrentProcessId();
+		if (protect_filter::is_white_pid(HandleToLong(pid), NULL))
+			return origon_NtUserSendInput_win10(a1, a2, a3, a4);
+			
+
+		return NULL;
+	}
+
+}

Anti-Cheat_Driver/mouse_key_win10.h

@@ -0,0 +1,12 @@
+#pragma once
+#include "Base.h"
+
+typedef __int64(__fastcall* fnNtUserSendInput_win10)(unsigned int a1, volatile void* a2, int a3, int a4);
+extern fnNtUserSendInput_win10 origon_NtUserSendInput_win10;
+
+namespace mouse_key_win10
+{
+	__int64 __fastcall hkNtUserSendInput(unsigned int a1, volatile void* a2, int a3, int a4);
+
+
+}

Anti-Cheat_Driver/mouse_key_win7.cpp

@@ -0,0 +1,17 @@
+#include "mouse_key_win7.h"
+#include "protect_filter.h"
+fnNtUserSendInput_win7 origon_NtUserSendInput_win7;
+
+namespace mouse_key_win7
+{
+	__int64 __fastcall hkNtUserSendInput(unsigned int a1, unsigned __int64 a2, int a3)
+	{
+		auto pid = PsGetCurrentProcessId();
+
+		if(protect_filter::is_white_pid(HandleToLong(pid), NULL))
+			return origon_NtUserSendInput_win7(a1, a2, a3);
+		
+		return NULL;
+	}
+
+}

Anti-Cheat_Driver/mouse_key_win7.h

@@ -0,0 +1,10 @@
+#pragma once
+#include "Base.h"
+
+typedef __int64(__fastcall* fnNtUserSendInput_win7)(unsigned int a1, unsigned __int64 a2, int a3);
+extern fnNtUserSendInput_win7 origon_NtUserSendInput_win7;
+
+namespace mouse_key_win7
+{
+	__int64 __fastcall hkNtUserSendInput(unsigned int a1, unsigned __int64 a2, int a3);
+}

Anti-Cheat_Driver/mouse_keybord_hook.cpp

@@ -0,0 +1,93 @@
+#include "mouse_keybord_hook.h"
+#include "shadow_ssdt.h"
+#include "kernel_function.h"
+#include "utils.h"
+#include "inline_hooks.h"
+#include "mouse_key_win10.h"
+#include "mouse_key_win7.h"
+
+namespace mouse_keybord_hook
+{
+	unsigned char* _ntSendInput;
+
+	auto get_sendinput_hook_addr() -> unsigned char*
+	{
+		auto os = utils::GetVersion();
+		if (os.dwBuildNumber == 7600 || os.dwBuildNumber == 7601)
+		{
+			auto win32k = kernel_function::GetKernelModule("win32k.sys");
+
+			auto ntSendInput = (unsigned char*)utils::FindSectionsCode(win32k, "\x48\x8B\xC4\x48\x89\x58\x08\x48\x89\x70\x10\x48\x89\x78\x18\x41\x54\x48\x83\xEC\x60\x41\x8B\xD8",
+				"xxxxxxxxxxxxxxxxxxxxxxxx", ".text");
+
+			return ntSendInput;
+		}
+		else if (os.dwBuildNumber >= 26100)
+		{
+			auto gSessionGlobalSlots = kernel_function::GetgSessionGlobalSlots();
+
+			auto W32GetSessionState = *(ULONG64*)(*(ULONG64*)((*(ULONG64*)gSessionGlobalSlots)) + 0x88);
+			W32GetSessionState = *(ULONG64*)(W32GetSessionState + 0x150);
+			auto NtUserSendInput = *(unsigned char**)(W32GetSessionState + 0xB18);
+
+			return NtUserSendInput;
+		}
+		else
+		{
+			auto function = reinterpret_cast<unsigned char*>(ShadowSSDT::fn_get_shadowssdt_extport_func("NtUserSendInput"));
+			if (!function)
+				return NULL;
+
+			unsigned int break_byte_count = 0;
+			unsigned int index = 0;
+			while (break_byte_count < 2)
+			{
+				if (function[index++] == 0x48)
+					break_byte_count++;
+			}
+
+			return *(unsigned char**)((*(ULONG*)&function[index + 2]) + &function[index + 6]);
+		}
+	}
+
+	auto install_mouse_keybord_hook() -> BOOL
+	{
+		auto _eprocess_process = kernel_function::FindProcess("winlogon.exe");
+		if (!_eprocess_process)
+			return FALSE;
+
+		auto apc_state = kernel_function::ke_stack_attch_process(_eprocess_process);
+
+		_ntSendInput = get_sendinput_hook_addr();
+
+		auto os = utils::GetVersion();
+		if (os.dwBuildNumber == 7600 || os.dwBuildNumber == 7601)
+		{
+			inline_hooks_manager::fn_get_instance()->inline_install_hook(_ntSendInput, mouse_key_win7::hkNtUserSendInput, (void**)&origon_NtUserSendInput_win7);
+		}
+		else
+		{
+			inline_hooks_manager::fn_get_instance()->inline_install_hook(_ntSendInput, mouse_key_win10::hkNtUserSendInput, (void**)&origon_NtUserSendInput_win10);
+		}
+
+		kernel_function::ke_unstack_detach_process(apc_state);
+		ObDereferenceObject(_eprocess_process);
+		return 0;
+	}
+
+	auto remove_mouse_keybord_hook() -> BOOL
+	{
+		auto _eprocess_process = kernel_function::FindProcess("winlogon.exe");
+		if (!_eprocess_process)
+			return FALSE;
+
+		auto apc_state = kernel_function::ke_stack_attch_process(_eprocess_process);
+
+		inline_hooks_manager::fn_get_instance()->inline_remov_hook((void**)_ntSendInput);
+
+		kernel_function::ke_unstack_detach_process(apc_state);
+		ObDereferenceObject(_eprocess_process);
+		return 0;
+	}
+
+}

Anti-Cheat_Driver/mouse_keybord_hook.h

@@ -0,0 +1,13 @@
+#pragma once
+#include "Base.h"
+
+namespace mouse_keybord_hook
+{
+	auto get_sendinput_hook_addr() -> unsigned char*;
+
+	auto install_mouse_keybord_hook()->BOOL;
+
+	auto remove_mouse_keybord_hook()->BOOL;
+
+
+}

Anti-Cheat_Driver/process_notify_callback.cpp

@@ -0,0 +1,67 @@
+#include "process_notify_callback.h"
+#include "kernel_function.h"
+#include "protect_filter.h"
+#include "utils.h"
+#pragma warning(disable : 4309 4838)
+namespace process_notify_callback
+{
+	auto process_notify_routine(
+		_In_ HANDLE ParentId,
+		_In_ HANDLE ProcessId,
+		_In_ BOOLEAN Create) -> VOID
+	{
+		UNREFERENCED_PARAMETER(ParentId);
+		if (!Create)	
+		{
+
+			//进程退出时进行 对插链的清理操作
+			if (protect_filter::is_protect_pid(HandleToLong(ProcessId), nullptr))
+				protect_filter::remove_protect_list(g_protect_list, HandleToLong(ProcessId), nullptr);
+
+			if (protect_filter::is_white_pid(HandleToLong(ProcessId), nullptr))
+			{
+
+				DbgBreakPoint();
+				protect_filter::remove_protect_list(g_white_list, HandleToLong(ProcessId), nullptr);
+			}
+		}
+
+		/*DbgPrintEx(77, 0, "ParentId:%d | ProcessId:%d | Create:%d\n",
+			ParentId, ProcessId, Create);*/
+	}
+
+	uintptr_t beep_trampoline_ptr;
+
+	auto install_process_notify() -> NTSTATUS
+	{
+		beep_trampoline_ptr = utils::get_beep_trampoline_ptr();
+		if (!beep_trampoline_ptr)
+			return STATUS_UNSUCCESSFUL;
+
+		char jmprax[] = { 0x48, 0xB8, 0x13, 0x09, 0xFC, 0xD6, 0xFC, 0x7F, 0x00, 0x00, 0xFF, 0xE0 };
+		*(uintptr_t*)&jmprax[2] = (uintptr_t)process_notify_routine;
+		auto status = kernel_function::MmMDLPagesCopy((PVOID)beep_trampoline_ptr, &jmprax, sizeof(jmprax), 0x0000002, KernelMode);
+		if (!NT_SUCCESS(status))
+			return status;
+
+		return PsSetCreateProcessNotifyRoutine((PCREATE_PROCESS_NOTIFY_ROUTINE)beep_trampoline_ptr, FALSE);
+	}
+
+	auto remov_process_notify() -> NTSTATUS
+	{
+		if (!beep_trampoline_ptr)
+			return STATUS_UNSUCCESSFUL;
+
+		auto status = PsSetCreateProcessNotifyRoutine((PCREATE_PROCESS_NOTIFY_ROUTINE)beep_trampoline_ptr, TRUE);
+		if (!NT_SUCCESS(status))
+			return status;
+
+		char nullcode[12]{ 0 };
+		status = kernel_function::MmMDLPagesCopy((PVOID)beep_trampoline_ptr, &nullcode, sizeof(nullcode), 0x0000002, KernelMode);
+		if (!NT_SUCCESS(status))
+			return status;
+
+		return status;
+	}
+
+}

Anti-Cheat_Driver/process_notify_callback.h

@@ -0,0 +1,10 @@
+#pragma once
+#include "Base.h"
+
+namespace process_notify_callback
+{
+	auto install_process_notify()->NTSTATUS;
+
+	auto remov_process_notify()->NTSTATUS;
+
+}

Anti-Cheat_Driver/protect_filter.cpp

@@ -1,15 +1,17 @@
 #include "protect_filter.h"
 
 LIST_ENTRY g_protect_list;
+LIST_ENTRY g_white_list;
 
 namespace protect_filter
 {
 	auto Init() -> VOID
 	{
 		InitializeListHead(&g_protect_list);
+		InitializeListHead(&g_white_list);
 	}
 
-	auto add_list(ULONG Pid, HWND hwnd) -> BOOL
+	auto add_protect_list(ULONG Pid, HWND hwnd, BOOL is_white)->BOOL
 	{
 		auto PFilter = reinterpret_cast<PFILTER>(ExAllocatePoolWithTag(PagedPool, sizeof(FILTER), 'wag'));
 		if (!PFilter)
@@ -31,14 +33,15 @@ namespace protect_filter
 			PFilter->hWnd = hwnd;
 		}
 
-		InsertTailList(&g_protect_list, &PFilter->List);
+		if (is_white)
+			InsertTailList(&g_white_list, &PFilter->List);
+		else InsertTailList(&g_protect_list, &PFilter->List);
 
 		return TRUE;
 	}
 
 	auto is_protect_pid(ULONG Pid, PEPROCESS Eprocess)->BOOL
 	{
-		UNREFERENCED_PARAMETER(Pid);
 		if (IsListEmpty(&g_protect_list))
 			return NULL;
 
@@ -48,6 +51,31 @@ namespace protect_filter
 			auto list_data = reinterpret_cast<PFILTER>(CONTAINING_RECORD(list_head, FILTER, List));
 			list_head = list_head->Flink;
 
+			if (Pid)
+			{
+				if (list_data->Pid == Pid)
+					return TRUE;
+			}
+			if (Eprocess)
+			{
+				if (list_data->Eprocess == Eprocess)
+					return TRUE;
+			}
+		}
+
+		return FALSE;
+	}
+
+	auto is_white_pid(ULONG Pid, PEPROCESS Eprocess)->BOOL
+	{
+		if (IsListEmpty(&g_white_list))
+			return NULL;
+
+		auto list_head = g_white_list.Flink;
+		while (list_head != &g_white_list)
+		{
+			auto list_data = reinterpret_cast<PFILTER>(CONTAINING_RECORD(list_head, FILTER, List));
+			list_head = list_head->Flink;
 
 			if (Pid)
 			{
@@ -60,25 +88,22 @@ namespace protect_filter
 					return TRUE;
 			}
 
-
-			//DbgPrintEx(77, 0, "[+] pid:%d | eproecss:%p\n", list_data->Pid, list_data->Eprocess);
 		}
 
-		return NULL;
+		return FALSE;
 	}
 
-	auto remove_list(ULONG Pid, HWND hwnd) -> BOOL
+	auto remove_protect_list(LIST_ENTRY list_entry, ULONG Pid, HWND hwnd)->BOOL
 	{
 		UNREFERENCED_PARAMETER(hwnd);
 
 		BOOL is_remove_list = FALSE;
 
+		if (IsListEmpty(&list_entry))
+			return FALSE;
 
-		if (IsListEmpty(&g_protect_list))
+		auto list_head = list_entry.Flink;
-			return NULL;
+		while (list_head != &list_entry)
-
-		auto list_head = g_protect_list.Flink;
-		while (list_head != &g_protect_list)
 		{
 			auto list_data = reinterpret_cast<PFILTER>(CONTAINING_RECORD(list_head, FILTER, List));
 			list_head = list_head->Flink;
@@ -93,15 +118,10 @@ namespace protect_filter
 			if (is_remove_list)
 			{
 				ExFreePoolWithTag(list_data, 'wag');
+				return TRUE;
 			}
 		}
+		return FALSE;
 		
-
-		return TRUE;
 	}
-
-
-
-
-
 }

Anti-Cheat_Driver/protect_filter.h

@@ -1,5 +1,6 @@
 #pragma once
 #include "Base.h"
+
 typedef struct _FILTER
 {
 	LIST_ENTRY List;
@@ -8,14 +9,18 @@ typedef struct _FILTER
 	HWND hWnd;
 }FILTER,*PFILTER;
 
+extern LIST_ENTRY g_protect_list;
+extern LIST_ENTRY g_white_list;
 
 namespace protect_filter
 {
 	auto Init()->VOID;
 
-	auto add_list(ULONG Pid, HWND hwnd)->BOOL;
+	auto add_protect_list(ULONG Pid, HWND hwnd, BOOL is_white)->BOOL;
 
 	auto is_protect_pid(ULONG Pid, PEPROCESS Eprocess) -> BOOL;
 
-	auto remove_list(ULONG Pid, HWND hwnd)->BOOL;
+	auto is_white_pid(ULONG Pid, PEPROCESS Eprocess)->BOOL;
+
+	auto remove_protect_list(LIST_ENTRY list_entry, ULONG Pid, HWND hwnd)->BOOL;
 }

Anti-Cheat_Driver/shadow_ssdt.cpp

@@ -0,0 +1,149 @@
+#include "shadow_ssdt.h"
+#include "kernel_function.h"
+#include "kernel_api.h"
+#include "utils.h"
+
+PULONG W32pServiceTable = nullptr;
+
+
+namespace ShadowSSDT
+{
+	ULONG64 get_sssdt_func_addr(ULONG id) {
+		LONG dwtmp = 0;
+		PULONG ServiceTableBase = NULL;
+		ServiceTableBase = W32pServiceTable;
+		dwtmp = ServiceTableBase[id];
+		dwtmp = dwtmp >> 4;
+		return (LONGLONG)dwtmp + (ULONGLONG)ServiceTableBase;
+	}
+
+	auto get_sssdt_extport_func_win10(const char* func_name)-> uintptr_t
+	{
+		uintptr_t fun_addrss = 0;
+
+		auto process = kernel_function::FindProcess("explorer.exe");
+		if (!process)
+		{
+			DbgPrintEx(77, 0, "[+]get explorer fail\n");
+			return 0;
+		}
+
+		const auto win32k_base = reinterpret_cast<PVOID>(kernel_function::GetKernelModule("win32k.sys"));
+		if (!win32k_base)
+		{
+			ObDereferenceObject(process);
+			DbgPrintEx(77, 0, "[+]get win32k_base fail\n");
+			return 0;
+		}
+
+		KAPC_STATE apc_state{ 0 };
+		KeStackAttachProcess(process, &apc_state);
+		W32pServiceTable = (PULONG)kernel_api::rtlfindexportedroutinebyname(win32k_base, "W32pServiceTable");
+		if (!W32pServiceTable)
+		{
+			KeUnstackDetachProcess(&apc_state);
+			ObDereferenceObject(process);
+			DbgPrintEx(77, 0, "[+] getW32pServiceTable fail\n");
+			return 0;
+		}
+
+
+		auto pdos_header = reinterpret_cast<PIMAGE_DOS_HEADER>(win32k_base);
+		auto pNt_header = reinterpret_cast<PIMAGE_NT_HEADERS>((char*)win32k_base + pdos_header->e_lfanew);
+
+
+		//±éÀúµ¼³ö±í
+		const auto export_table = pNt_header->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];
+		const auto export_data = reinterpret_cast<PIMAGE_EXPORT_DIRECTORY>((char*)win32k_base + export_table.VirtualAddress);
+
+		const auto func_name_tab = reinterpret_cast<ULONG*>((char*)win32k_base + export_data->AddressOfNames);
+		const auto func_index_tab = reinterpret_cast<SHORT*>((char*)win32k_base + export_data->AddressOfNameOrdinals);
+		const auto func_addr_tab = reinterpret_cast<ULONG*>((char*)win32k_base + export_data->AddressOfFunctions);
+
+
+		for (size_t i = 0; i < export_data->NumberOfNames; i++)
+		{
+			const char* func_names = reinterpret_cast<const char*>((char*)win32k_base + func_name_tab[i]);
+
+			if (strstr(func_names, "__win32kstub_"))
+			{
+				const auto lpFunc_addr = reinterpret_cast<PUCHAR>((char*)win32k_base + func_addr_tab[func_index_tab[i]]);
+				char* FunctionName = strstr(func_names, "Nt");
+				if (!strcmp(FunctionName, func_name))
+				{
+					auto func_index = *(ULONG*)((uintptr_t)lpFunc_addr + 1);
+					fun_addrss = get_sssdt_func_addr(func_index);
+					break;
+				}
+			}
+		}
+
+		KeUnstackDetachProcess(&apc_state);
+		ObDereferenceObject(process);
+		return fun_addrss;
+	}
+
+	//auto get_sssdt_extport_func_win7(const char* func_name)
+	//{
+	//	UNREFERENCED_PARAMETER(func_name);
+
+	//	auto process = kernel_function::FindProcess("explorer.exe");
+	//	if (!process)
+	//	{
+	//		DbgPrintEx(77, 0, "[+]get explorer fail\n");
+	//		return 0;
+	//	}
+
+	//	KAPC_STATE apc_state{ 0 };
+	//	KeStackAttachProcess(process, &apc_state);
+
+	//	do
+	//	{
+	//		auto dwPid = PsGetProcessId(process);
+
+	//		UNICODE_STRING module_name{ 0 };
+	//		RtlInitUnicodeString(&module_name, L"user32.dll");
+
+	//		unsigned char* moudle_buff = nullptr;
+	//		auto status = kernel_function::GetProcessModule(dwPid, module_name, &moudle_buff);
+	//		if (!NT_SUCCESS(status))
+	//			break;
+
+	//		//char* FunctionName = strstr(func_name, "Nt");
+
+	//		//DbgPrintEx(77,0,"")
+
+	//		/*auto func_addr = utils::get_hmodule_expotr_func(moudle_buff, FunctionName);
+	//		if (!func_addr)
+	//			break;
+
+	//		auto func_index = *(UINT32*)(func_addr + 4);
+
+	//		DbgPrintEx(77, 0, "%p | %d\n", func_addr, func_index);*/
+
+
+
+	//	} while (0);
+
+
+	//	KeUnstackDetachProcess(&apc_state);
+	//	ObDereferenceObject(process);
+	//}
+
+
+	auto fn_get_shadowssdt_extport_func(const char* func_name) -> uintptr_t
+	{
+		auto os = utils::GetVersion();
+		if (os.dwBuildNumber == 7600 || os.dwBuildNumber == 7601)
+		{
+			return NULL;
+		}
+		else
+		{
+			return get_sssdt_extport_func_win10(func_name);
+		}
+
+		
+	}
+
+}

Anti-Cheat_Driver/shadow_ssdt.h

@@ -0,0 +1,8 @@
+#pragma once
+#include "Base.h"
+
+namespace ShadowSSDT
+{
+	auto fn_get_shadowssdt_extport_func(CONST char* func_name)->uintptr_t;
+
+}

Anti-Cheat_Driver/ssdt.cpp

@@ -0,0 +1,65 @@
+#include "ssdt.h"
+#include "kernel_function.h"
+#include "utils.h"
+
+
+namespace SSDT
+{
+	auto get_service_descriptortable() -> PSERVICE_DESCRIPTOR_TABLE
+	{
+		auto ntoskrnl = kernel_function::GetKernelModule("ntoskrnl.exe");
+
+		auto KiSystemServiceRepeat = utils::FindSectionsCode(ntoskrnl, "\x4C\x8D\x15\x00\x00\x00\x00\x4C\x8D\x1D\x00\x00\x00\x00\xF7",
+			"xxx????xxx????x", ".text");
+
+		return (PSERVICE_DESCRIPTOR_TABLE)(*(UINT32*)(KiSystemServiceRepeat + 3) + KiSystemServiceRepeat + 7);
+
+	}
+
+	auto get_ssdt_function_aadr(ULONG32 number) -> uintptr_t
+	{
+		auto KeServiceDescriptorTable = get_service_descriptortable();
+		if (!KeServiceDescriptorTable)
+			return NULL;
+
+		auto table_base = KeServiceDescriptorTable->ServiceTableBase;
+		auto offset = (*(ULONG*)((ULONG64)table_base + number * 4)) >> 4;
+		return ((ULONG64)table_base + offset);
+	}
+
+
+	auto get_func_number(unsigned char* function) -> ULONG32
+	{
+		unsigned int count = 0;
+		unsigned int index = 0;
+		while (count < 1)
+		{
+			if (function[index++] == 0xB8) {
+				count++;
+				break;
+			}
+		}
+
+		return *(ULONG32*)&function[index++];
+	}
+
+	
+	auto ZwTerminateThread(HANDLE ThreadHandle, NTSTATUS ExitStatus) -> NTSTATUS
+	{
+		typedef NTSTATUS(__fastcall* fnZwTerminateThread)(HANDLE ThreadHandle, NTSTATUS ExitStatus);
+		static fnZwTerminateThread _ZwTerminateThread;
+		if (_ZwTerminateThread == nullptr)
+		{
+			auto func = utils::kernel_get_expotr_func(L"ZwQuerySection") + 0x40;
+			auto func_index = get_func_number(func);
+
+			_ZwTerminateThread = (fnZwTerminateThread)get_ssdt_function_aadr(func_index);
+		}
+
+
+		return _ZwTerminateThread(ThreadHandle, ExitStatus);
+
+	}
+
+
+}

Anti-Cheat_Driver/ssdt.h

@@ -0,0 +1,21 @@
+#pragma once
+#include "Base.h"
+
+typedef struct _SERVICE_DESCRIPTOR_TABLE {
+    PVOID  ServiceTableBase;       // 核心：系统服务函数地址数组的基址
+    PVOID  ServiceCounterTableBase; // 服务调用计数器（仅x86/早期系统用，x64/Win10+多为NULL）
+    ULONG  NumberOfServices;       // SSDT表中包含的系统服务函数总数
+    PUCHAR ParamTableBase;         // 系统服务函数的参数个数表基址（存储每个函数的参数字节数）
+} SERVICE_DESCRIPTOR_TABLE, * PSERVICE_DESCRIPTOR_TABLE;
+
+namespace SSDT
+{
+	auto get_service_descriptortable()->PSERVICE_DESCRIPTOR_TABLE;
+
+	auto get_ssdt_function_aadr(ULONG32 number)->uintptr_t;
+
+    auto get_func_number(unsigned char* function)->ULONG32;
+
+    auto ZwTerminateThread(HANDLE ThreadHandle, NTSTATUS ExitStatus)->NTSTATUS;
+
+}

Anti-Cheat_Driver/utils.cpp

@@ -1,4 +1,5 @@
 #include "utils.h"
+#include "kernel_function.h"
 
 namespace utils
 {
@@ -56,18 +57,80 @@ namespace utils
 		return 0;
 	}
 
-	auto kernel_get_expotr_func(wchar_t* func_name)-> uintptr_t
+	auto kernel_get_expotr_func(wchar_t* func_name)-> unsigned char*
 	{
+		
 		UNICODE_STRING unicode_func_name{ 0 };
 		RtlInitUnicodeString(&unicode_func_name, func_name);
-		return (uintptr_t)MmGetSystemRoutineAddress(&unicode_func_name);
+		return (unsigned char*)MmGetSystemRoutineAddress(&unicode_func_name);
 	}
 
 
+	auto get_beep_trampoline_ptr() -> uintptr_t
+	{
+		uintptr_t* trampoline_ptr = NULL;
+
+		auto beep = kernel_function::GetKernelModule("beep.sys");
+		auto nt_header = reinterpret_cast<PIMAGE_NT_HEADERS>(beep + reinterpret_cast<PIMAGE_DOS_HEADER>(beep)->e_lfanew);
+		auto file_header = &nt_header->FileHeader;
+
+		auto section_header = IMAGE_FIRST_SECTION(nt_header);
+		for (size_t i = 0; i < file_header->NumberOfSections; i++)
+		{
+			if (!strcmp((char*)section_header[i].Name, ".text"))
+			{
+				trampoline_ptr = (uintptr_t*)((beep + section_header[i].VirtualAddress) + section_header[i].Misc.VirtualSize);
+			}
+		}
+
+		if (trampoline_ptr)
+		{
+			unsigned int count = NULL;
+			unsigned int index = NULL;
+			while (trampoline_ptr[index] != NULL)
+			{
+				if (trampoline_ptr[index] == NULL)
+					count++;
+
+				if (count > 0x08)
+					break;
+
+				index++;
+			}
+			return (uintptr_t)&trampoline_ptr[index];
+		}
+
+		return NULL;
+	}
+
+	auto get_hmodule_expotr_func(void* modulebase, const char* func_name) -> uintptr_t
+	{
+		char* Base = reinterpret_cast<char*>(modulebase);
+
+		auto pdos_header = reinterpret_cast<PIMAGE_DOS_HEADER>(Base);
+		auto pNt_header = reinterpret_cast<PIMAGE_NT_HEADERS>((char*)Base + pdos_header->e_lfanew);
 
 
+		//±éÀúµ¼³ö±í
+		const auto export_table = pNt_header->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];
+		const auto export_data = reinterpret_cast<PIMAGE_EXPORT_DIRECTORY>((char*)Base + export_table.VirtualAddress);
 
+		const auto func_name_tab = reinterpret_cast<ULONG*>((char*)Base + export_data->AddressOfNames);
+		const auto func_index_tab = reinterpret_cast<SHORT*>((char*)Base + export_data->AddressOfNameOrdinals);
+		const auto func_addr_tab = reinterpret_cast<ULONG*>((char*)Base + export_data->AddressOfFunctions);
 
+		for (size_t i = 0; i < export_data->NumberOfNames; i++)
+		{
+			const char* func_names = reinterpret_cast<const char*>((char*)Base + func_name_tab[i]);
+			const auto lpFunc_addr = reinterpret_cast<PUCHAR>((char*)Base + func_addr_tab[func_index_tab[i]]);
+			if (!strcmp(func_names, func_name))
+			{
+				return (uintptr_t)lpFunc_addr;
+			}
+		}
+
+		return 0;
+	}
 
 
 }

Anti-Cheat_Driver/utils.h

@@ -3,12 +3,16 @@
 
 namespace utils
 {
+	EXTERN_C NTKERNELAPI PVOID PsGetProcessWow64Process(IN PEPROCESS Process);
+	EXTERN_C NTKERNELAPI PVOID PsGetProcessPeb(IN PEPROCESS Process);
+
 	auto GetVersion() -> OSVERSIONINFOW;
 
 	auto FindSectionsCode(unsigned long long Base, const char* pattern, const char* mask, const char* name) -> ULONG64;
 
-	auto kernel_get_expotr_func(wchar_t* func_name) -> uintptr_t;
+	auto kernel_get_expotr_func(wchar_t* func_name) -> unsigned char*;
-
 
+	auto get_beep_trampoline_ptr()->uintptr_t;
 
+	auto get_hmodule_expotr_func(void* modulebase, const char* func_name)->uintptr_t;
 }