fix win7 getNtSendInput

Anti-Cheat_Driver/comm_dispatch.cpp

@@ -5,7 +5,6 @@ namespace comm_dispatch
 {
 	auto dispatch(CMD_COMM* data) -> NTSTATUS
 	{
-
 		auto status = STATUS_UNSUCCESSFUL;
 		switch (data->CommID)
 		{
@@ -17,7 +16,13 @@ namespace comm_dispatch
 		case CMD::DRIVER_PROTECT_PROCESS:
 		{
 			auto process_data = (IOCTL_PROCESS*)data->Buf;
-			status = protect_filter::add_list((ULONG)process_data->Pid, NULL);
+			status = protect_filter::add_protect_list((ULONG)process_data->Pid, NULL, FALSE);
+			break;
+		}
+		case CMD::ADD_WHITE_PROCESS:
+		{
+			auto process_data = (IOCTL_PROCESS*)data->Buf;
+			status = protect_filter::add_protect_list((ULONG)process_data->Pid, NULL, TRUE);
 			break;
 		}
 		case CMD::WINDOW_ANIT_SCREEN:

Anti-Cheat_Driver/comm_dispatch.h

@@ -23,6 +23,7 @@ enum CMD
 	MSG_BASE = 0x10000,
 	DRIVER_COMM_TEST,
 	DRIVER_PROTECT_PROCESS,
+	ADD_WHITE_PROCESS,
 	WINDOW_ANIT_SCREEN,
 };
 

Anti-Cheat_Driver/driver_main.cpp

@@ -90,7 +90,10 @@ EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING)
 	kernel_api::kernel_api_init();
 	kernel_comm_create::Init();
 
+	//protect_filter::add_protect_list(9624, 0, FALSE);
 
+
+	//protect_filter::add_protect_list(2356, 0, TRUE);
 	//inline_hooks_manager::fn_get_instance()->inline_install_hook(NtOpenProcess, hkNtOpenProcess, (void**)&origon_ntOpenProcess);
 	//inline_hooks_manager::fn_get_instance()->inline_install_hook(NtCreateFile, hkNtCreateFile, (void**)&origon_ntCreatFile);
 

Anti-Cheat_Driver/mouse_key_win10.cpp

@@ -1,20 +1,19 @@
 #include "mouse_key_win10.h"
-#include "mouse_keybord_hook.h"
-#include "inline_hooks.h"
-
+#include "protect_filter.h"
 
 fnNtUserSendInput_win10 origon_NtUserSendInput_win10;
 
 
-
 namespace mouse_key_win10
 {
 	__int64 __fastcall hkNtUserSendInput(unsigned int a1, volatile void* a2, int a3, int a4)
 	{
+		auto pid = PsGetCurrentProcessId();
+		if (protect_filter::is_white_pid(HandleToLong(pid), NULL))
+			return origon_NtUserSendInput_win10(a1, a2, a3, a4);
 			
-		DbgPrintEx(77, 0, "%d\n", PsGetCurrentProcessId());
 
-		return origon_NtUserSendInput_win10(a1, a2, a3, a4);
+		return NULL;
 	}
 
 }

Anti-Cheat_Driver/mouse_key_win7.cpp

@@ -0,0 +1,17 @@
+#include "mouse_key_win7.h"
+#include "protect_filter.h"
+fnNtUserSendInput_win7 origon_NtUserSendInput_win7;
+
+namespace mouse_key_win7
+{
+	__int64 __fastcall hkNtUserSendInput(unsigned int a1, unsigned __int64 a2, int a3)
+	{
+		auto pid = PsGetCurrentProcessId();
+
+		if(protect_filter::is_white_pid(HandleToLong(pid), NULL))
+			return origon_NtUserSendInput_win7(a1, a2, a3);
+		
+		return NULL;
+	}
+
+}

Anti-Cheat_Driver/mouse_key_win7.h

@@ -1 +1,10 @@
 #pragma once
+#include "Base.h"
+
+typedef __int64(__fastcall* fnNtUserSendInput_win7)(unsigned int a1, unsigned __int64 a2, int a3);
+extern fnNtUserSendInput_win7 origon_NtUserSendInput_win7;
+
+namespace mouse_key_win7
+{
+	__int64 __fastcall hkNtUserSendInput(unsigned int a1, unsigned __int64 a2, int a3);
+}

Anti-Cheat_Driver/mouse_keybord_hook.cpp

@@ -6,8 +6,6 @@
 #include "mouse_key_win10.h"
 #include "mouse_key_win7.h"
 
-
-
 namespace mouse_keybord_hook
 {
 	unsigned char* _ntSendInput;
@@ -17,7 +15,12 @@ namespace mouse_keybord_hook
 		auto os = utils::GetVersion();
 		if (os.dwBuildNumber == 7600 || os.dwBuildNumber == 7601)
 		{
-			return NULL;
+			auto win32k = kernel_function::GetKernelModule("win32k.sys");
+
+			auto ntSendInput = (unsigned char*)utils::FindSectionsCode(win32k, "\x48\x8B\xC4\x48\x89\x58\x08\x48\x89\x70\x10\x48\x89\x78\x18\x41\x54\x48\x83\xEC\x60\x41\x8B\xD8",
+				"xxxxxxxxxxxxxxxxxxxxxxxx", ".text");
+
+			return ntSendInput;
 		}
 		else if (os.dwBuildNumber >= 26100)
 		{
@@ -60,7 +63,7 @@ namespace mouse_keybord_hook
 		auto os = utils::GetVersion();
 		if (os.dwBuildNumber == 7600 || os.dwBuildNumber == 7601)
 		{
-
+			inline_hooks_manager::fn_get_instance()->inline_install_hook(_ntSendInput, mouse_key_win7::hkNtUserSendInput, (void**)&origon_NtUserSendInput_win7);
 		}
 		else
 		{

Anti-Cheat_Driver/process_notify_callback.cpp

@@ -13,9 +13,17 @@ namespace process_notify_callback
 		UNREFERENCED_PARAMETER(ParentId);
 		if (!Create)	
 		{
+
 			//进程退出时进行 对插链的清理操作
 			if (protect_filter::is_protect_pid(HandleToLong(ProcessId), nullptr))
-				protect_filter::remove_list(HandleToLong(ProcessId), nullptr);
+				protect_filter::remove_protect_list(g_protect_list, HandleToLong(ProcessId), nullptr);
+
+			if (protect_filter::is_white_pid(HandleToLong(ProcessId), nullptr))
+			{
+
+				DbgBreakPoint();
+				protect_filter::remove_protect_list(g_white_list, HandleToLong(ProcessId), nullptr);
+			}
 		}
 
 		/*DbgPrintEx(77, 0, "ParentId:%d | ProcessId:%d | Create:%d\n",

Anti-Cheat_Driver/protect_filter.cpp

@@ -1,15 +1,17 @@
 #include "protect_filter.h"
 
 LIST_ENTRY g_protect_list;
+LIST_ENTRY g_white_list;
 
 namespace protect_filter
 {
 	auto Init() -> VOID
 	{
 		InitializeListHead(&g_protect_list);
+		InitializeListHead(&g_white_list);
 	}
 
-	auto add_list(ULONG Pid, HWND hwnd) -> BOOL
+	auto add_protect_list(ULONG Pid, HWND hwnd, BOOL is_white)->BOOL
 	{
 		auto PFilter = reinterpret_cast<PFILTER>(ExAllocatePoolWithTag(PagedPool, sizeof(FILTER), 'wag'));
 		if (!PFilter)
@@ -31,14 +33,15 @@ namespace protect_filter
 			PFilter->hWnd = hwnd;
 		}
 
-		InsertTailList(&g_protect_list, &PFilter->List);
+		if (is_white)
+			InsertTailList(&g_white_list, &PFilter->List);
+		else InsertTailList(&g_protect_list, &PFilter->List);
 
 		return TRUE;
 	}
 
 	auto is_protect_pid(ULONG Pid, PEPROCESS Eprocess)->BOOL
 	{
-		UNREFERENCED_PARAMETER(Pid);
 		if (IsListEmpty(&g_protect_list))
 			return NULL;
 
@@ -60,20 +63,47 @@ namespace protect_filter
 			}
 		}
 
-		return NULL;
+		return FALSE;
 	}
 
-	auto remove_list(ULONG Pid, HWND hwnd) -> BOOL
+	auto is_white_pid(ULONG Pid, PEPROCESS Eprocess)->BOOL
+	{
+		if (IsListEmpty(&g_white_list))
+			return NULL;
+
+		auto list_head = g_white_list.Flink;
+		while (list_head != &g_white_list)
+		{
+			auto list_data = reinterpret_cast<PFILTER>(CONTAINING_RECORD(list_head, FILTER, List));
+			list_head = list_head->Flink;
+
+			if (Pid)
+			{
+				if (list_data->Pid == Pid)
+					return TRUE;
+			}
+			if (Eprocess)
+			{
+				if (list_data->Eprocess == Eprocess)
+					return TRUE;
+			}
+
+		}
+
+		return FALSE;
+	}
+
+	auto remove_protect_list(LIST_ENTRY list_entry, ULONG Pid, HWND hwnd)->BOOL
 	{
 		UNREFERENCED_PARAMETER(hwnd);
 
 		BOOL is_remove_list = FALSE;
 
-		if (IsListEmpty(&g_protect_list))
-			return NULL;
+		if (IsListEmpty(&list_entry))
+			return FALSE;
 
-		auto list_head = g_protect_list.Flink;
-		while (list_head != &g_protect_list)
+		auto list_head = list_entry.Flink;
+		while (list_head != &list_entry)
 		{
 			auto list_data = reinterpret_cast<PFILTER>(CONTAINING_RECORD(list_head, FILTER, List));
 			list_head = list_head->Flink;
@@ -88,9 +118,10 @@ namespace protect_filter
 			if (is_remove_list)
 			{
 				ExFreePoolWithTag(list_data, 'wag');
+				return TRUE;
 			}
 		}
+		return FALSE;
 		
-		return TRUE;
 	}
 }

Anti-Cheat_Driver/protect_filter.h

@@ -1,5 +1,6 @@
 #pragma once
 #include "Base.h"
+
 typedef struct _FILTER
 {
 	LIST_ENTRY List;
@@ -8,14 +9,18 @@ typedef struct _FILTER
 	HWND hWnd;
 }FILTER,*PFILTER;
 
+extern LIST_ENTRY g_protect_list;
+extern LIST_ENTRY g_white_list;
 
 namespace protect_filter
 {
 	auto Init()->VOID;
 
-	auto add_list(ULONG Pid, HWND hwnd)->BOOL;
+	auto add_protect_list(ULONG Pid, HWND hwnd, BOOL is_white)->BOOL;
 
 	auto is_protect_pid(ULONG Pid, PEPROCESS Eprocess) -> BOOL;
 
-	auto remove_list(ULONG Pid, HWND hwnd)->BOOL;
+	auto is_white_pid(ULONG Pid, PEPROCESS Eprocess)->BOOL;
+
+	auto remove_protect_list(LIST_ENTRY list_entry, ULONG Pid, HWND hwnd)->BOOL;
 }