style

Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj

@@ -166,6 +166,7 @@
     <ClCompile Include="process_notify_callback.cpp" />
     <ClCompile Include="protect_filter.cpp" />
     <ClCompile Include="shadow_ssdt.cpp" />
+    <ClCompile Include="ssdt.cpp" />
     <ClCompile Include="utils.cpp" />
   </ItemGroup>
   <ItemGroup>
@@ -193,6 +194,7 @@
     <ClInclude Include="process_notify_callback.h" />
     <ClInclude Include="protect_filter.h" />
     <ClInclude Include="shadow_ssdt.h" />
+    <ClInclude Include="ssdt.h" />
     <ClInclude Include="utils.h" />
   </ItemGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />

Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj.filters

@@ -127,6 +127,9 @@
     <ClCompile Include="mouse_key_win7.cpp">
       <Filter>mouse_keyboard</Filter>
     </ClCompile>
+    <ClCompile Include="ssdt.cpp">
+      <Filter>kernel_extern_api\SSDT</Filter>
+    </ClCompile>
   </ItemGroup>
   <ItemGroup>
     <ClInclude Include="Base.h">
@@ -204,5 +207,8 @@
     <ClInclude Include="mouse_key_win7.h">
       <Filter>mouse_keyboard</Filter>
     </ClInclude>
+    <ClInclude Include="ssdt.h">
+      <Filter>kernel_extern_api\SSDT</Filter>
+    </ClInclude>
   </ItemGroup>
 </Project>

Anti-Cheat_Driver/create_thread_callback.cpp

@@ -2,16 +2,74 @@
 #include "protect_filter.h"
 #include "kernel_function.h"
 #include "utils.h"
+#include "kernel_api.h"
+#include "ssdt.h"
 
 #pragma warning(disable : 4309 4838)
+
+
+EXTERN_C NTKERNELAPI NTSTATUS ZwOpenThread(
+	_Out_ PHANDLE ThreadHandle,
+	_In_ ACCESS_MASK DesiredAccess,
+	_In_ POBJECT_ATTRIBUTES ObjectAttributes,
+	_In_ PCLIENT_ID ClientId
+	);
+
+
 namespace thread_notify_routine
 {
+
+	// 打开线程句柄并终止
+	NTSTATUS TerminateThreadByHandle(
+			HANDLE ProcessId,
+			HANDLE ThreadId)
+	{
+		NTSTATUS status;
+		HANDLE threadHandle = NULL;
+		OBJECT_ATTRIBUTES objAttr;
+		CLIENT_ID clientId;
+
+		clientId.UniqueProcess = ProcessId;
+		clientId.UniqueThread = ThreadId;
+
+		InitializeObjectAttributes(&objAttr, NULL, 0, NULL, NULL);
+
+		// 打开线程句柄
+		status = ZwOpenThread(
+			&threadHandle,
+			THREAD_TERMINATE,
+			&objAttr,
+			&clientId);
+
+		if (!NT_SUCCESS(status)) {
+			DbgPrintEx(77, 0, "[AnitCheat][%s] Failed to open thread %d: 0x%X\n",__FUNCTION__,
+				(ULONG)(ULONG_PTR)ThreadId, status);
+			return status;
+		}
+
+		// 终止线程
+		status = SSDT::ZwTerminateThread(threadHandle, STATUS_THREAD_IS_TERMINATING);
+
+		if (NT_SUCCESS(status)) {
+			/*DbgPrintEx(77, 0, "[ThreadKiller] Thread %d terminated successfully\n",
+				(ULONG)(ULONG_PTR)ThreadId);*/
+		}
+		else {
+			DbgPrintEx(77,0,"[AnitCheat][%s] Failed to terminate thread %d: 0x%X\n", __FUNCTION__,
+				(ULONG)(ULONG_PTR)ThreadId, status);
+		}
+
+		ZwClose(threadHandle);
+		return status;
+	}
+
 	//保护的进程ID
 	//auto protect_id = ULongToHandle(8976);
 	void thread_notify_routine(HANDLE ProcessId, HANDLE ThreadId, BOOLEAN Create)
 	{
 		if (Create)
 		{
+
 			PEPROCESS process{ 0 };
 			auto status = PsLookupProcessByProcessId(ProcessId, &process);
 			if (!NT_SUCCESS(status))
@@ -34,6 +92,8 @@ namespace thread_notify_routine
 
 			if (ProcessId != cutor_process_id)
 			{
+				//DbgBreakPoint();
+
 				DbgPrintEx(77, 0, "[!] 恶意远程线程检测！\n");
 
 				DbgPrintEx(77, 0, "[!] 目标进程ID: %d\n", ProcessId);
@@ -41,6 +101,10 @@ namespace thread_notify_routine
 				DbgPrintEx(77, 0, "[!] 创建者进程ID: %d\n", cutor_process_id);
 
 				DbgPrintEx(77, 0, "[!] 被创建线程ID: %d\n", ThreadId);
+
+
+				TerminateThreadByHandle(ProcessId, ThreadId);
+	
 			}
 		end:	
 			ObDereferenceObject(process);

Anti-Cheat_Driver/driver_main.cpp

@@ -1,72 +1,13 @@
 #include "ob_reg_callback.h"
 #include "create_thread_callback.h"
 #include "process_notify_callback.h"
+#include "load_Image_callback.h"
 #include "protect_filter.h"
 #include "comm.h"
 #include "inline_hooks.h"
 #include "mouse_keybord_hook.h"
+#include "ssdt.h"
 
-typedef NTSTATUS (NTAPI* fnNtOpenProcess)(
-	_Out_ PHANDLE ProcessHandle,
-	_In_ ACCESS_MASK DesiredAccess,
-	_In_ POBJECT_ATTRIBUTES ObjectAttributes,
-	_In_opt_ PCLIENT_ID ClientId);
-
-typedef NTSTATUS(NTAPI* fnNtCreateFile)(
-	_Out_ PHANDLE FileHandle,
-	_In_ ACCESS_MASK DesiredAccess,
-	_In_ POBJECT_ATTRIBUTES ObjectAttributes,
-	_Out_ PIO_STATUS_BLOCK IoStatusBlock,
-	_In_opt_ PLARGE_INTEGER AllocationSize,
-	_In_ ULONG FileAttributes,
-	_In_ ULONG ShareAccess,
-	_In_ ULONG CreateDisposition,
-	_In_ ULONG CreateOptions,
-	_In_reads_bytes_opt_(EaLength) PVOID EaBuffer,
-	_In_ ULONG EaLength
-	);
-
-
-fnNtOpenProcess origon_ntOpenProcess;
-fnNtCreateFile origon_ntCreatFile;
-
-NTSTATUS NTAPI hkNtOpenProcess(
-	_Out_ PHANDLE ProcessHandle,
-	_In_ ACCESS_MASK DesiredAccess,
-	_In_ POBJECT_ATTRIBUTES ObjectAttributes,
-	_In_opt_ PCLIENT_ID ClientId
-)
-{
-
-	DbgPrintEx(77, 0, "NtOpenProcess\n"); 
-
-	return origon_ntOpenProcess(ProcessHandle, DesiredAccess, ObjectAttributes, ClientId);
-}
-
-
-NTSTATUS
-NTAPI
-hkNtCreateFile(
-	_Out_ PHANDLE FileHandle,
-	_In_ ACCESS_MASK DesiredAccess,
-	_In_ POBJECT_ATTRIBUTES ObjectAttributes,
-	_Out_ PIO_STATUS_BLOCK IoStatusBlock,
-	_In_opt_ PLARGE_INTEGER AllocationSize,
-	_In_ ULONG FileAttributes,
-	_In_ ULONG ShareAccess,
-	_In_ ULONG CreateDisposition,
-	_In_ ULONG CreateOptions,
-	_In_reads_bytes_opt_(EaLength) PVOID EaBuffer,
-	_In_ ULONG EaLength
-)
-
-{
-
-	DbgPrintEx(77, 0, "NtCreateFile\n");
-
-
-	return origon_ntCreatFile(FileHandle, DesiredAccess, ObjectAttributes, IoStatusBlock, AllocationSize, FileAttributes, ShareAccess, CreateDisposition, CreateOptions, EaBuffer, EaLength);
-}
 
 EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING)
 {
@@ -75,14 +16,13 @@ EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING)
 		drv_obj->DriverUnload = [](PDRIVER_OBJECT)
 		{
 			kernel_comm_create::remove();
-			ob_call_back::uninstall_ob_callback();
+			//ob_call_back::uninstall_ob_callback();
 			process_notify_callback::remov_process_notify();
 			thread_notify_routine::unload_thread_routine();
 
-			inline_hooks_manager::fn_get_instance()->inline_remov_hook((void**)NtOpenProcess);
-			inline_hooks_manager::fn_get_instance()->inline_remov_hook((void**)NtCreateFile);
-
 			mouse_keybord_hook::remove_mouse_keybord_hook();
+
+			//load_image_notify_routine::remove_image_load_notify_routine();
 		};
 	}
 
@@ -90,20 +30,15 @@ EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING)
 	kernel_api::kernel_api_init();
 	kernel_comm_create::Init();
 
-	//protect_filter::add_protect_list(9624, 0, FALSE);
-
-
-	//protect_filter::add_protect_list(2356, 0, TRUE);
-	//inline_hooks_manager::fn_get_instance()->inline_install_hook(NtOpenProcess, hkNtOpenProcess, (void**)&origon_ntOpenProcess);
-	//inline_hooks_manager::fn_get_instance()->inline_install_hook(NtCreateFile, hkNtCreateFile, (void**)&origon_ntCreatFile);
+	protect_filter::add_protect_list(3632, 0, FALSE);
 
 
 	mouse_keybord_hook::install_mouse_keybord_hook();
-	DbgPrintEx(77, 0, "[+]ob_reg_callback status:%x\n", ob_call_back::register_ob_reg_callback());
+	//DbgPrintEx(77, 0, "[+]ob_reg_callback status:%x\n", ob_call_back::register_ob_reg_callback());
 	DbgPrintEx(77, 0, "[+]process_notify_callback status:%x\n", process_notify_callback::install_process_notify());
 	DbgPrintEx(77, 0, "[+]create_thread_routine status:%x\n", thread_notify_routine::create_thread_routine());
 
-
+	//load_image_notify_routine::create_image_load_notify_routine();
 
 	return STATUS_SUCCESS;
 }

Anti-Cheat_Driver/kernel_api.cpp

@@ -22,6 +22,9 @@ namespace kernel_api
 
 		RtlInitUnicodeString(&unFuncName, L"RtlFindExportedRoutineByName");
 		imported.rtl_findexported_routinebyname = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
+
+		RtlInitUnicodeString(&unFuncName, L"ZwOpenThread");
+		imported.nt_open_thread = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
 	}
 
 	NTSTATUS ntquerysysteminformation(ULONG SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength)
@@ -52,5 +55,10 @@ namespace kernel_api
 		return reinterpret_cast<PVOID(*)(PVOID, PCCH)>(imported.rtl_findexported_routinebyname)
 			(ImageBase, RoutineName);
 	}
+	NTSTATUS ntopenthread(PHANDLE ThreadHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId)
+	{
+		return reinterpret_cast<NTSTATUS(*)(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, PCLIENT_ID)>(imported.nt_open_thread)
+			(ThreadHandle, DesiredAccess, ObjectAttributes, ClientId);
+	}
 }
 	

Anti-Cheat_Driver/kernel_api.h

@@ -19,6 +19,7 @@ struct imported_
 	ULONG64 ps_getprocess_section_baseaddress;
 	ULONG64 ps_getprocess_id;
 	ULONG64 se_locateprocess_imagename;
+	ULONG64 nt_open_thread;
 };
 
 namespace kernel_api
@@ -39,4 +40,6 @@ namespace kernel_api
 	NTSTATUS selocate_process_imagename(PEPROCESS Process, PUNICODE_STRING* pImageFileName);
 
 	PVOID rtlfindexportedroutinebyname(PVOID ImageBase, PCCH RoutineName);
+
+	NTSTATUS ntopenthread(PHANDLE ThreadHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId);
 }

Anti-Cheat_Driver/load_Image_callback.cpp

@@ -2,6 +2,10 @@
 
 namespace load_image_notify_routine
 {
+
+	typedef NTSTATUS(__fastcall* fnMmUnloadSystemImage)(PVOID ImageBase);
+	fnMmUnloadSystemImage _MmUnloadSystemImage = (fnMmUnloadSystemImage)0xfffff800042748a0;
+
 	VOID load_image_notify_routine(
 		PUNICODE_STRING FullImageName,
 		HANDLE ProcessId,
@@ -16,10 +20,13 @@ namespace load_image_notify_routine
 
 			if (wcsstr(FullImageName->Buffer, L"MyDriver1"))
 			{
-				DbgPrintEx(77, 0, "[+] %ws | pid:%d\n", FullImageName->Buffer, ProcessId);
+				//DbgBreakPoint();
 
-				ZwUnmapViewOfSection(PsGetCurrentProcess(), ImageInfo->ImageBase);
+				//DbgPrintEx(77, 0, "[+] %ws | pid:%d\n", FullImageName->Buffer, ProcessId);
 
+				//auto status = _MmUnloadSystemImage(ImageInfo->ImageBase);
+
+				//DbgPrintEx(77, 0, "%x\n", status);
 			}
 
 		}

Anti-Cheat_Driver/shadow_ssdt.h

@@ -3,9 +3,6 @@
 
 namespace ShadowSSDT
 {
-
 	auto fn_get_shadowssdt_extport_func(CONST char* func_name)->uintptr_t;
 
-
-
 }

Anti-Cheat_Driver/ssdt.cpp

@@ -0,0 +1,65 @@
+#include "ssdt.h"
+#include "kernel_function.h"
+#include "utils.h"
+
+
+namespace SSDT
+{
+	auto get_service_descriptortable() -> PSERVICE_DESCRIPTOR_TABLE
+	{
+		auto ntoskrnl = kernel_function::GetKernelModule("ntoskrnl.exe");
+
+		auto KiSystemServiceRepeat = utils::FindSectionsCode(ntoskrnl, "\x4C\x8D\x15\x00\x00\x00\x00\x4C\x8D\x1D\x00\x00\x00\x00\xF7",
+			"xxx????xxx????x", ".text");
+
+		return (PSERVICE_DESCRIPTOR_TABLE)(*(UINT32*)(KiSystemServiceRepeat + 3) + KiSystemServiceRepeat + 7);
+
+	}
+
+	auto get_ssdt_function_aadr(ULONG32 number) -> uintptr_t
+	{
+		auto KeServiceDescriptorTable = get_service_descriptortable();
+		if (!KeServiceDescriptorTable)
+			return NULL;
+
+		auto table_base = KeServiceDescriptorTable->ServiceTableBase;
+		auto offset = (*(ULONG*)((ULONG64)table_base + number * 4)) >> 4;
+		return ((ULONG64)table_base + offset);
+	}
+
+
+	auto get_func_number(unsigned char* function) -> ULONG32
+	{
+		unsigned int count = 0;
+		unsigned int index = 0;
+		while (count < 1)
+		{
+			if (function[index++] == 0xB8) {
+				count++;
+				break;
+			}
+		}
+
+		return *(ULONG32*)&function[index++];
+	}
+
+	
+	auto ZwTerminateThread(HANDLE ThreadHandle, NTSTATUS ExitStatus) -> NTSTATUS
+	{
+		typedef NTSTATUS(__fastcall* fnZwTerminateThread)(HANDLE ThreadHandle, NTSTATUS ExitStatus);
+		static fnZwTerminateThread _ZwTerminateThread;
+		if (_ZwTerminateThread == nullptr)
+		{
+			auto func = utils::kernel_get_expotr_func(L"ZwQuerySection") + 0x40;
+			auto func_index = get_func_number(func);
+
+			_ZwTerminateThread = (fnZwTerminateThread)get_ssdt_function_aadr(func_index);
+		}
+
+
+		return _ZwTerminateThread(ThreadHandle, ExitStatus);
+
+	}
+
+
+}

Anti-Cheat_Driver/ssdt.h

@@ -0,0 +1,21 @@
+#pragma once
+#include "Base.h"
+
+typedef struct _SERVICE_DESCRIPTOR_TABLE {
+    PVOID  ServiceTableBase;       // 核心：系统服务函数地址数组的基址
+    PVOID  ServiceCounterTableBase; // 服务调用计数器（仅x86/早期系统用，x64/Win10+多为NULL）
+    ULONG  NumberOfServices;       // SSDT表中包含的系统服务函数总数
+    PUCHAR ParamTableBase;         // 系统服务函数的参数个数表基址（存储每个函数的参数字节数）
+} SERVICE_DESCRIPTOR_TABLE, * PSERVICE_DESCRIPTOR_TABLE;
+
+namespace SSDT
+{
+	auto get_service_descriptortable()->PSERVICE_DESCRIPTOR_TABLE;
+
+	auto get_ssdt_function_aadr(ULONG32 number)->uintptr_t;
+
+    auto get_func_number(unsigned char* function)->ULONG32;
+
+    auto ZwTerminateThread(HANDLE ThreadHandle, NTSTATUS ExitStatus)->NTSTATUS;
+
+}

Anti-Cheat_Driver/utils.cpp

@@ -57,11 +57,12 @@ namespace utils
 		return 0;
 	}
 
-	auto kernel_get_expotr_func(wchar_t* func_name)-> uintptr_t
+	auto kernel_get_expotr_func(wchar_t* func_name)-> unsigned char*
 	{
+		
 		UNICODE_STRING unicode_func_name{ 0 };
 		RtlInitUnicodeString(&unicode_func_name, func_name);
-		return (uintptr_t)MmGetSystemRoutineAddress(&unicode_func_name);
+		return (unsigned char*)MmGetSystemRoutineAddress(&unicode_func_name);
 	}
 
 

Anti-Cheat_Driver/utils.h

@@ -10,7 +10,7 @@ namespace utils
 
 	auto FindSectionsCode(unsigned long long Base, const char* pattern, const char* mask, const char* name) -> ULONG64;
 
-	auto kernel_get_expotr_func(wchar_t* func_name) -> uintptr_t;
+	auto kernel_get_expotr_func(wchar_t* func_name) -> unsigned char*;
 
 	auto get_beep_trampoline_ptr()->uintptr_t;