style

Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj

@@ -166,6 +166,7 @@
     <ClCompile Include="process_notify_callback.cpp" />
     <ClCompile Include="protect_filter.cpp" />
     <ClCompile Include="shadow_ssdt.cpp" />
+    <ClCompile Include="ssdt.cpp" />
     <ClCompile Include="utils.cpp" />
   </ItemGroup>
   <ItemGroup>
@@ -193,6 +194,7 @@
     <ClInclude Include="process_notify_callback.h" />
     <ClInclude Include="protect_filter.h" />
     <ClInclude Include="shadow_ssdt.h" />
+    <ClInclude Include="ssdt.h" />
     <ClInclude Include="utils.h" />
   </ItemGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />

Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj.filters

@@ -127,6 +127,9 @@
     <ClCompile Include="mouse_key_win7.cpp">
       <Filter>mouse_keyboard</Filter>
     </ClCompile>
+    <ClCompile Include="ssdt.cpp">
+      <Filter>kernel_extern_api\SSDT</Filter>
+    </ClCompile>
   </ItemGroup>
   <ItemGroup>
     <ClInclude Include="Base.h">
@@ -204,5 +207,8 @@
     <ClInclude Include="mouse_key_win7.h">
       <Filter>mouse_keyboard</Filter>
     </ClInclude>
+    <ClInclude Include="ssdt.h">
+      <Filter>kernel_extern_api\SSDT</Filter>
+    </ClInclude>
   </ItemGroup>
 </Project>

Anti-Cheat_Driver/comm_dispatch.cpp

@@ -5,7 +5,6 @@ namespace comm_dispatch
 {
 	auto dispatch(CMD_COMM* data) -> NTSTATUS
 	{
-
 		auto status = STATUS_UNSUCCESSFUL;
 		switch (data->CommID)
 		{
@@ -17,7 +16,13 @@ namespace comm_dispatch
 		case CMD::DRIVER_PROTECT_PROCESS:
 		{
 			auto process_data = (IOCTL_PROCESS*)data->Buf;
-			status = protect_filter::add_list((ULONG)process_data->Pid, NULL);
+			status = protect_filter::add_protect_list((ULONG)process_data->Pid, NULL, FALSE);
+			break;
+		}
+		case CMD::ADD_WHITE_PROCESS:
+		{
+			auto process_data = (IOCTL_PROCESS*)data->Buf;
+			status = protect_filter::add_protect_list((ULONG)process_data->Pid, NULL, TRUE);
 			break;
 		}
 		case CMD::WINDOW_ANIT_SCREEN:

Anti-Cheat_Driver/comm_dispatch.h

@@ -23,6 +23,7 @@ enum CMD
 	MSG_BASE = 0x10000,
 	DRIVER_COMM_TEST,
 	DRIVER_PROTECT_PROCESS,
+	ADD_WHITE_PROCESS,
 	WINDOW_ANIT_SCREEN,
 };
 

Anti-Cheat_Driver/create_thread_callback.cpp

@@ -2,16 +2,74 @@
 #include "protect_filter.h"
 #include "kernel_function.h"
 #include "utils.h"
+#include "kernel_api.h"
+#include "ssdt.h"
 
 #pragma warning(disable : 4309 4838)
+
+
+EXTERN_C NTKERNELAPI NTSTATUS ZwOpenThread(
+	_Out_ PHANDLE ThreadHandle,
+	_In_ ACCESS_MASK DesiredAccess,
+	_In_ POBJECT_ATTRIBUTES ObjectAttributes,
+	_In_ PCLIENT_ID ClientId
+	);
+
+
 namespace thread_notify_routine
 {
+
+	// 打开线程句柄并终止
+	NTSTATUS TerminateThreadByHandle(
+			HANDLE ProcessId,
+			HANDLE ThreadId)
+	{
+		NTSTATUS status;
+		HANDLE threadHandle = NULL;
+		OBJECT_ATTRIBUTES objAttr;
+		CLIENT_ID clientId;
+
+		clientId.UniqueProcess = ProcessId;
+		clientId.UniqueThread = ThreadId;
+
+		InitializeObjectAttributes(&objAttr, NULL, 0, NULL, NULL);
+
+		// 打开线程句柄
+		status = ZwOpenThread(
+			&threadHandle,
+			THREAD_TERMINATE,
+			&objAttr,
+			&clientId);
+
+		if (!NT_SUCCESS(status)) {
+			DbgPrintEx(77, 0, "[AnitCheat][%s] Failed to open thread %d: 0x%X\n",__FUNCTION__,
+				(ULONG)(ULONG_PTR)ThreadId, status);
+			return status;
+		}
+
+		// 终止线程
+		status = SSDT::ZwTerminateThread(threadHandle, STATUS_THREAD_IS_TERMINATING);
+
+		if (NT_SUCCESS(status)) {
+			/*DbgPrintEx(77, 0, "[ThreadKiller] Thread %d terminated successfully\n",
+				(ULONG)(ULONG_PTR)ThreadId);*/
+		}
+		else {
+			DbgPrintEx(77,0,"[AnitCheat][%s] Failed to terminate thread %d: 0x%X\n", __FUNCTION__,
+				(ULONG)(ULONG_PTR)ThreadId, status);
+		}
+
+		ZwClose(threadHandle);
+		return status;
+	}
+
 	//保护的进程ID
 	//auto protect_id = ULongToHandle(8976);
 	void thread_notify_routine(HANDLE ProcessId, HANDLE ThreadId, BOOLEAN Create)
 	{
 		if (Create)
 		{
+
 			PEPROCESS process{ 0 };
 			auto status = PsLookupProcessByProcessId(ProcessId, &process);
 			if (!NT_SUCCESS(status))
@@ -34,6 +92,8 @@ namespace thread_notify_routine
 
 			if (ProcessId != cutor_process_id)
 			{
+				//DbgBreakPoint();
+
 				DbgPrintEx(77, 0, "[!] 恶意远程线程检测！\n");
 
 				DbgPrintEx(77, 0, "[!] 目标进程ID: %d\n", ProcessId);
@@ -41,6 +101,10 @@ namespace thread_notify_routine
 				DbgPrintEx(77, 0, "[!] 创建者进程ID: %d\n", cutor_process_id);
 
 				DbgPrintEx(77, 0, "[!] 被创建线程ID: %d\n", ThreadId);
+
+
+				TerminateThreadByHandle(ProcessId, ThreadId);
+	
 			}
 		end:	
 			ObDereferenceObject(process);

Anti-Cheat_Driver/driver_main.cpp

@@ -1,72 +1,13 @@
 #include "ob_reg_callback.h"
 #include "create_thread_callback.h"
 #include "process_notify_callback.h"
+#include "load_Image_callback.h"
 #include "protect_filter.h"
 #include "comm.h"
 #include "inline_hooks.h"
 #include "mouse_keybord_hook.h"
+#include "ssdt.h"
 
-typedef NTSTATUS (NTAPI* fnNtOpenProcess)(
-	_Out_ PHANDLE ProcessHandle,
-	_In_ ACCESS_MASK DesiredAccess,
-	_In_ POBJECT_ATTRIBUTES ObjectAttributes,
-	_In_opt_ PCLIENT_ID ClientId);
-
-typedef NTSTATUS(NTAPI* fnNtCreateFile)(
-	_Out_ PHANDLE FileHandle,
-	_In_ ACCESS_MASK DesiredAccess,
-	_In_ POBJECT_ATTRIBUTES ObjectAttributes,
-	_Out_ PIO_STATUS_BLOCK IoStatusBlock,
-	_In_opt_ PLARGE_INTEGER AllocationSize,
-	_In_ ULONG FileAttributes,
-	_In_ ULONG ShareAccess,
-	_In_ ULONG CreateDisposition,
-	_In_ ULONG CreateOptions,
-	_In_reads_bytes_opt_(EaLength) PVOID EaBuffer,
-	_In_ ULONG EaLength
-	);
-
-
-fnNtOpenProcess origon_ntOpenProcess;
-fnNtCreateFile origon_ntCreatFile;
-
-NTSTATUS NTAPI hkNtOpenProcess(
-	_Out_ PHANDLE ProcessHandle,
-	_In_ ACCESS_MASK DesiredAccess,
-	_In_ POBJECT_ATTRIBUTES ObjectAttributes,
-	_In_opt_ PCLIENT_ID ClientId
-)
-{
-
-	DbgPrintEx(77, 0, "NtOpenProcess\n");
-
-	return origon_ntOpenProcess(ProcessHandle, DesiredAccess, ObjectAttributes, ClientId);
-}
-
-
-NTSTATUS
-NTAPI
-hkNtCreateFile(
-	_Out_ PHANDLE FileHandle,
-	_In_ ACCESS_MASK DesiredAccess,
-	_In_ POBJECT_ATTRIBUTES ObjectAttributes,
-	_Out_ PIO_STATUS_BLOCK IoStatusBlock,
-	_In_opt_ PLARGE_INTEGER AllocationSize,
-	_In_ ULONG FileAttributes,
-	_In_ ULONG ShareAccess,
-	_In_ ULONG CreateDisposition,
-	_In_ ULONG CreateOptions,
-	_In_reads_bytes_opt_(EaLength) PVOID EaBuffer,
-	_In_ ULONG EaLength
-)
-
-{
-
-	DbgPrintEx(77, 0, "NtCreateFile\n");
-
-
-	return origon_ntCreatFile(FileHandle, DesiredAccess, ObjectAttributes, IoStatusBlock, AllocationSize, FileAttributes, ShareAccess, CreateDisposition, CreateOptions, EaBuffer, EaLength);
-}
 
 EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING)
 {
@@ -75,14 +16,13 @@ EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING)
 		drv_obj->DriverUnload = [](PDRIVER_OBJECT)
 		{
 			kernel_comm_create::remove();
-			ob_call_back::uninstall_ob_callback();
+			//ob_call_back::uninstall_ob_callback();
 			process_notify_callback::remov_process_notify();
 			thread_notify_routine::unload_thread_routine();
 
-			inline_hooks_manager::fn_get_instance()->inline_remov_hook((void**)NtOpenProcess);
-			inline_hooks_manager::fn_get_instance()->inline_remov_hook((void**)NtCreateFile);
-
 			mouse_keybord_hook::remove_mouse_keybord_hook();
+
+			//load_image_notify_routine::remove_image_load_notify_routine();
 		};
 	}
 
@@ -90,17 +30,15 @@ EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING)
 	kernel_api::kernel_api_init();
 	kernel_comm_create::Init();
 
-
+	protect_filter::add_protect_list(3632, 0, FALSE);
-	//inline_hooks_manager::fn_get_instance()->inline_install_hook(NtOpenProcess, hkNtOpenProcess, (void**)&origon_ntOpenProcess);
-	//inline_hooks_manager::fn_get_instance()->inline_install_hook(NtCreateFile, hkNtCreateFile, (void**)&origon_ntCreatFile);
 
 
 	mouse_keybord_hook::install_mouse_keybord_hook();
-	DbgPrintEx(77, 0, "[+]ob_reg_callback status:%x\n", ob_call_back::register_ob_reg_callback());
+	//DbgPrintEx(77, 0, "[+]ob_reg_callback status:%x\n", ob_call_back::register_ob_reg_callback());
 	DbgPrintEx(77, 0, "[+]process_notify_callback status:%x\n", process_notify_callback::install_process_notify());
 	DbgPrintEx(77, 0, "[+]create_thread_routine status:%x\n", thread_notify_routine::create_thread_routine());
 
-
+	//load_image_notify_routine::create_image_load_notify_routine();
 
 	return STATUS_SUCCESS;
 }

Anti-Cheat_Driver/kernel_api.cpp

@@ -22,6 +22,9 @@ namespace kernel_api
 
 		RtlInitUnicodeString(&unFuncName, L"RtlFindExportedRoutineByName");
 		imported.rtl_findexported_routinebyname = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
+
+		RtlInitUnicodeString(&unFuncName, L"ZwOpenThread");
+		imported.nt_open_thread = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
 	}
 
 	NTSTATUS ntquerysysteminformation(ULONG SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength)
@@ -52,5 +55,10 @@ namespace kernel_api
 		return reinterpret_cast<PVOID(*)(PVOID, PCCH)>(imported.rtl_findexported_routinebyname)
 			(ImageBase, RoutineName);
 	}
+	NTSTATUS ntopenthread(PHANDLE ThreadHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId)
+	{
+		return reinterpret_cast<NTSTATUS(*)(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, PCLIENT_ID)>(imported.nt_open_thread)
+			(ThreadHandle, DesiredAccess, ObjectAttributes, ClientId);
+	}
 }
 	

Anti-Cheat_Driver/kernel_api.h

@@ -19,6 +19,7 @@ struct imported_
 	ULONG64 ps_getprocess_section_baseaddress;
 	ULONG64 ps_getprocess_id;
 	ULONG64 se_locateprocess_imagename;
+	ULONG64 nt_open_thread;
 };
 
 namespace kernel_api
@@ -39,4 +40,6 @@ namespace kernel_api
 	NTSTATUS selocate_process_imagename(PEPROCESS Process, PUNICODE_STRING* pImageFileName);
 
 	PVOID rtlfindexportedroutinebyname(PVOID ImageBase, PCCH RoutineName);
+
+	NTSTATUS ntopenthread(PHANDLE ThreadHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId);
 }

Anti-Cheat_Driver/load_Image_callback.cpp

@@ -2,6 +2,10 @@
 
 namespace load_image_notify_routine
 {
+
+	typedef NTSTATUS(__fastcall* fnMmUnloadSystemImage)(PVOID ImageBase);
+	fnMmUnloadSystemImage _MmUnloadSystemImage = (fnMmUnloadSystemImage)0xfffff800042748a0;
+
 	VOID load_image_notify_routine(
 		PUNICODE_STRING FullImageName,
 		HANDLE ProcessId,
@@ -16,10 +20,13 @@ namespace load_image_notify_routine
 
 			if (wcsstr(FullImageName->Buffer, L"MyDriver1"))
 			{
-				DbgPrintEx(77, 0, "[+] %ws | pid:%d\n", FullImageName->Buffer, ProcessId);
+				//DbgBreakPoint();
 
-				ZwUnmapViewOfSection(PsGetCurrentProcess(), ImageInfo->ImageBase);
+				//DbgPrintEx(77, 0, "[+] %ws | pid:%d\n", FullImageName->Buffer, ProcessId);
 
+				//auto status = _MmUnloadSystemImage(ImageInfo->ImageBase);
+
+				//DbgPrintEx(77, 0, "%x\n", status);
 			}
 
 		}

Anti-Cheat_Driver/mouse_key_win10.cpp

@@ -1,20 +1,19 @@
 #include "mouse_key_win10.h"
-#include "mouse_keybord_hook.h"
+#include "protect_filter.h"
-#include "inline_hooks.h"
-
 
 fnNtUserSendInput_win10 origon_NtUserSendInput_win10;
 
 
-
 namespace mouse_key_win10
 {
 	__int64 __fastcall hkNtUserSendInput(unsigned int a1, volatile void* a2, int a3, int a4)
 	{
+		auto pid = PsGetCurrentProcessId();
+		if (protect_filter::is_white_pid(HandleToLong(pid), NULL))
+			return origon_NtUserSendInput_win10(a1, a2, a3, a4);
 			
-		DbgPrintEx(77, 0, "%d\n", PsGetCurrentProcessId());
 
-		return origon_NtUserSendInput_win10(a1, a2, a3, a4);
+		return NULL;
 	}
 
 }

Anti-Cheat_Driver/mouse_key_win7.cpp

@@ -0,0 +1,17 @@
+#include "mouse_key_win7.h"
+#include "protect_filter.h"
+fnNtUserSendInput_win7 origon_NtUserSendInput_win7;
+
+namespace mouse_key_win7
+{
+	__int64 __fastcall hkNtUserSendInput(unsigned int a1, unsigned __int64 a2, int a3)
+	{
+		auto pid = PsGetCurrentProcessId();
+
+		if(protect_filter::is_white_pid(HandleToLong(pid), NULL))
+			return origon_NtUserSendInput_win7(a1, a2, a3);
+		
+		return NULL;
+	}
+
+}

Anti-Cheat_Driver/mouse_key_win7.h

@@ -1 +1,10 @@
 #pragma once
+#include "Base.h"
+
+typedef __int64(__fastcall* fnNtUserSendInput_win7)(unsigned int a1, unsigned __int64 a2, int a3);
+extern fnNtUserSendInput_win7 origon_NtUserSendInput_win7;
+
+namespace mouse_key_win7
+{
+	__int64 __fastcall hkNtUserSendInput(unsigned int a1, unsigned __int64 a2, int a3);
+}

Anti-Cheat_Driver/mouse_keybord_hook.cpp

@@ -6,8 +6,6 @@
 #include "mouse_key_win10.h"
 #include "mouse_key_win7.h"
 
-
-
 namespace mouse_keybord_hook
 {
 	unsigned char* _ntSendInput;
@@ -17,7 +15,12 @@ namespace mouse_keybord_hook
 		auto os = utils::GetVersion();
 		if (os.dwBuildNumber == 7600 || os.dwBuildNumber == 7601)
 		{
-			return NULL;
+			auto win32k = kernel_function::GetKernelModule("win32k.sys");
+
+			auto ntSendInput = (unsigned char*)utils::FindSectionsCode(win32k, "\x48\x8B\xC4\x48\x89\x58\x08\x48\x89\x70\x10\x48\x89\x78\x18\x41\x54\x48\x83\xEC\x60\x41\x8B\xD8",
+				"xxxxxxxxxxxxxxxxxxxxxxxx", ".text");
+
+			return ntSendInput;
 		}
 		else if (os.dwBuildNumber >= 26100)
 		{
@@ -60,7 +63,7 @@ namespace mouse_keybord_hook
 		auto os = utils::GetVersion();
 		if (os.dwBuildNumber == 7600 || os.dwBuildNumber == 7601)
 		{
-
+			inline_hooks_manager::fn_get_instance()->inline_install_hook(_ntSendInput, mouse_key_win7::hkNtUserSendInput, (void**)&origon_NtUserSendInput_win7);
 		}
 		else
 		{
@@ -68,7 +71,7 @@ namespace mouse_keybord_hook
 		}
 
 		kernel_function::ke_unstack_detach_process(apc_state);
-
+		ObDereferenceObject(_eprocess_process);
 		return 0;
 	}
 
@@ -83,6 +86,7 @@ namespace mouse_keybord_hook
 		inline_hooks_manager::fn_get_instance()->inline_remov_hook((void**)_ntSendInput);
 
 		kernel_function::ke_unstack_detach_process(apc_state);
+		ObDereferenceObject(_eprocess_process);
 		return 0;
 	}
 

Anti-Cheat_Driver/process_notify_callback.cpp

@@ -13,9 +13,17 @@ namespace process_notify_callback
 		UNREFERENCED_PARAMETER(ParentId);
 		if (!Create)	
 		{
+
 			//进程退出时进行 对插链的清理操作
 			if (protect_filter::is_protect_pid(HandleToLong(ProcessId), nullptr))
-				protect_filter::remove_list(HandleToLong(ProcessId), nullptr);
+				protect_filter::remove_protect_list(g_protect_list, HandleToLong(ProcessId), nullptr);
+
+			if (protect_filter::is_white_pid(HandleToLong(ProcessId), nullptr))
+			{
+
+				DbgBreakPoint();
+				protect_filter::remove_protect_list(g_white_list, HandleToLong(ProcessId), nullptr);
+			}
 		}
 
 		/*DbgPrintEx(77, 0, "ParentId:%d | ProcessId:%d | Create:%d\n",

Anti-Cheat_Driver/protect_filter.cpp

@@ -1,15 +1,17 @@
 #include "protect_filter.h"
 
 LIST_ENTRY g_protect_list;
+LIST_ENTRY g_white_list;
 
 namespace protect_filter
 {
 	auto Init() -> VOID
 	{
 		InitializeListHead(&g_protect_list);
+		InitializeListHead(&g_white_list);
 	}
 
-	auto add_list(ULONG Pid, HWND hwnd) -> BOOL
+	auto add_protect_list(ULONG Pid, HWND hwnd, BOOL is_white)->BOOL
 	{
 		auto PFilter = reinterpret_cast<PFILTER>(ExAllocatePoolWithTag(PagedPool, sizeof(FILTER), 'wag'));
 		if (!PFilter)
@@ -31,14 +33,15 @@ namespace protect_filter
 			PFilter->hWnd = hwnd;
 		}
 
-		InsertTailList(&g_protect_list, &PFilter->List);
+		if (is_white)
+			InsertTailList(&g_white_list, &PFilter->List);
+		else InsertTailList(&g_protect_list, &PFilter->List);
 
 		return TRUE;
 	}
 
 	auto is_protect_pid(ULONG Pid, PEPROCESS Eprocess)->BOOL
 	{
-		UNREFERENCED_PARAMETER(Pid);
 		if (IsListEmpty(&g_protect_list))
 			return NULL;
 
@@ -60,20 +63,47 @@ namespace protect_filter
 			}
 		}
 
-		return NULL;
+		return FALSE;
 	}
 
-	auto remove_list(ULONG Pid, HWND hwnd) -> BOOL
+	auto is_white_pid(ULONG Pid, PEPROCESS Eprocess)->BOOL
+	{
+		if (IsListEmpty(&g_white_list))
+			return NULL;
+
+		auto list_head = g_white_list.Flink;
+		while (list_head != &g_white_list)
+		{
+			auto list_data = reinterpret_cast<PFILTER>(CONTAINING_RECORD(list_head, FILTER, List));
+			list_head = list_head->Flink;
+
+			if (Pid)
+			{
+				if (list_data->Pid == Pid)
+					return TRUE;
+			}
+			if (Eprocess)
+			{
+				if (list_data->Eprocess == Eprocess)
+					return TRUE;
+			}
+
+		}
+
+		return FALSE;
+	}
+
+	auto remove_protect_list(LIST_ENTRY list_entry, ULONG Pid, HWND hwnd)->BOOL
 	{
 		UNREFERENCED_PARAMETER(hwnd);
 
 		BOOL is_remove_list = FALSE;
 
-		if (IsListEmpty(&g_protect_list))
+		if (IsListEmpty(&list_entry))
-			return NULL;
+			return FALSE;
 
-		auto list_head = g_protect_list.Flink;
+		auto list_head = list_entry.Flink;
-		while (list_head != &g_protect_list)
+		while (list_head != &list_entry)
 		{
 			auto list_data = reinterpret_cast<PFILTER>(CONTAINING_RECORD(list_head, FILTER, List));
 			list_head = list_head->Flink;
@@ -88,9 +118,10 @@ namespace protect_filter
 			if (is_remove_list)
 			{
 				ExFreePoolWithTag(list_data, 'wag');
+				return TRUE;
 			}
 		}
+		return FALSE;
 		
-		return TRUE;
 	}
 }

Anti-Cheat_Driver/protect_filter.h

@@ -1,5 +1,6 @@
 #pragma once
 #include "Base.h"
+
 typedef struct _FILTER
 {
 	LIST_ENTRY List;
@@ -8,14 +9,18 @@ typedef struct _FILTER
 	HWND hWnd;
 }FILTER,*PFILTER;
 
+extern LIST_ENTRY g_protect_list;
+extern LIST_ENTRY g_white_list;
 
 namespace protect_filter
 {
 	auto Init()->VOID;
 
-	auto add_list(ULONG Pid, HWND hwnd)->BOOL;
+	auto add_protect_list(ULONG Pid, HWND hwnd, BOOL is_white)->BOOL;
 
 	auto is_protect_pid(ULONG Pid, PEPROCESS Eprocess) -> BOOL;
 
-	auto remove_list(ULONG Pid, HWND hwnd)->BOOL;
+	auto is_white_pid(ULONG Pid, PEPROCESS Eprocess)->BOOL;
+
+	auto remove_protect_list(LIST_ENTRY list_entry, ULONG Pid, HWND hwnd)->BOOL;
 }

Anti-Cheat_Driver/shadow_ssdt.h

@@ -3,9 +3,6 @@
 
 namespace ShadowSSDT
 {
-
 	auto fn_get_shadowssdt_extport_func(CONST char* func_name)->uintptr_t;
 
-
-
 }

Anti-Cheat_Driver/ssdt.cpp

@@ -0,0 +1,65 @@
+#include "ssdt.h"
+#include "kernel_function.h"
+#include "utils.h"
+
+
+namespace SSDT
+{
+	auto get_service_descriptortable() -> PSERVICE_DESCRIPTOR_TABLE
+	{
+		auto ntoskrnl = kernel_function::GetKernelModule("ntoskrnl.exe");
+
+		auto KiSystemServiceRepeat = utils::FindSectionsCode(ntoskrnl, "\x4C\x8D\x15\x00\x00\x00\x00\x4C\x8D\x1D\x00\x00\x00\x00\xF7",
+			"xxx????xxx????x", ".text");
+
+		return (PSERVICE_DESCRIPTOR_TABLE)(*(UINT32*)(KiSystemServiceRepeat + 3) + KiSystemServiceRepeat + 7);
+
+	}
+
+	auto get_ssdt_function_aadr(ULONG32 number) -> uintptr_t
+	{
+		auto KeServiceDescriptorTable = get_service_descriptortable();
+		if (!KeServiceDescriptorTable)
+			return NULL;
+
+		auto table_base = KeServiceDescriptorTable->ServiceTableBase;
+		auto offset = (*(ULONG*)((ULONG64)table_base + number * 4)) >> 4;
+		return ((ULONG64)table_base + offset);
+	}
+
+
+	auto get_func_number(unsigned char* function) -> ULONG32
+	{
+		unsigned int count = 0;
+		unsigned int index = 0;
+		while (count < 1)
+		{
+			if (function[index++] == 0xB8) {
+				count++;
+				break;
+			}
+		}
+
+		return *(ULONG32*)&function[index++];
+	}
+
+	
+	auto ZwTerminateThread(HANDLE ThreadHandle, NTSTATUS ExitStatus) -> NTSTATUS
+	{
+		typedef NTSTATUS(__fastcall* fnZwTerminateThread)(HANDLE ThreadHandle, NTSTATUS ExitStatus);
+		static fnZwTerminateThread _ZwTerminateThread;
+		if (_ZwTerminateThread == nullptr)
+		{
+			auto func = utils::kernel_get_expotr_func(L"ZwQuerySection") + 0x40;
+			auto func_index = get_func_number(func);
+
+			_ZwTerminateThread = (fnZwTerminateThread)get_ssdt_function_aadr(func_index);
+		}
+
+
+		return _ZwTerminateThread(ThreadHandle, ExitStatus);
+
+	}
+
+
+}

Anti-Cheat_Driver/ssdt.h

@@ -0,0 +1,21 @@
+#pragma once
+#include "Base.h"
+
+typedef struct _SERVICE_DESCRIPTOR_TABLE {
+    PVOID  ServiceTableBase;       // 核心：系统服务函数地址数组的基址
+    PVOID  ServiceCounterTableBase; // 服务调用计数器（仅x86/早期系统用，x64/Win10+多为NULL）
+    ULONG  NumberOfServices;       // SSDT表中包含的系统服务函数总数
+    PUCHAR ParamTableBase;         // 系统服务函数的参数个数表基址（存储每个函数的参数字节数）
+} SERVICE_DESCRIPTOR_TABLE, * PSERVICE_DESCRIPTOR_TABLE;
+
+namespace SSDT
+{
+	auto get_service_descriptortable()->PSERVICE_DESCRIPTOR_TABLE;
+
+	auto get_ssdt_function_aadr(ULONG32 number)->uintptr_t;
+
+    auto get_func_number(unsigned char* function)->ULONG32;
+
+    auto ZwTerminateThread(HANDLE ThreadHandle, NTSTATUS ExitStatus)->NTSTATUS;
+
+}

Anti-Cheat_Driver/utils.cpp

@@ -57,11 +57,12 @@ namespace utils
 		return 0;
 	}
 
-	auto kernel_get_expotr_func(wchar_t* func_name)-> uintptr_t
+	auto kernel_get_expotr_func(wchar_t* func_name)-> unsigned char*
 	{
+		
 		UNICODE_STRING unicode_func_name{ 0 };
 		RtlInitUnicodeString(&unicode_func_name, func_name);
-		return (uintptr_t)MmGetSystemRoutineAddress(&unicode_func_name);
+		return (unsigned char*)MmGetSystemRoutineAddress(&unicode_func_name);
 	}
 
 

Anti-Cheat_Driver/utils.h

@@ -10,7 +10,7 @@ namespace utils
 
 	auto FindSectionsCode(unsigned long long Base, const char* pattern, const char* mask, const char* name) -> ULONG64;
 
-	auto kernel_get_expotr_func(wchar_t* func_name) -> uintptr_t;
+	auto kernel_get_expotr_func(wchar_t* func_name) -> unsigned char*;
 
 	auto get_beep_trampoline_ptr()->uintptr_t;