maowengrui/anit-cheat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: maowengrui/anit-cheat:91bd5436f6993e88a7039dda7012e6cb3eb85155
Branches Tags
maowengrui/anit-cheat:main
...
compare: maowengrui/anit-cheat:3e7beaa4ecabd750fd649cb7c3dbd55f78c29578
Branches Tags
maowengrui/anit-cheat:main

8 Commits
91bd5436f6 ... 3e7beaa4ec

Author SHA1 Message Date
maowengrui 3e7beaa4ec fix disable fail 2026-06-23 13:18:59 +08:00
maowengrui 9c8c165efa fix unload thread 2026-06-23 13:18:29 +08:00
maowengrui 0df0e40cf2 fix remove func 2026-06-23 13:18:06 +08:00
maowengrui 351ffe7413 feat dispatch protect and anit screen 2026-06-23 13:17:33 +08:00
maowengrui ec66fbbf8a fix func 2026-06-23 13:16:44 +08:00
maowengrui 8dc46d22ff init 2026-06-23 13:16:04 +08:00
maowengrui 60884491e7 feat get_hmodule_expotr_func 2026-06-23 13:15:34 +08:00
maowengrui afc667b1da init 2026-06-23 13:14:31 +08:00
32 changed files with 1571 additions and 48 deletions
Expand all files Collapse all files
Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj
+17
View File
@@ -152,13 +152,20 @@
<ClCompile Include="comm_win7.cpp" />
<ClCompile Include="create_thread_callback.cpp" />
<ClCompile Include="driver_main.cpp" />
<ClCompile Include="hde\hde64.cpp" />
<ClCompile Include="inline_hooks.cpp" />
<ClCompile Include="io_ctl.cpp" />
<ClCompile Include="kernel_api.cpp" />
<ClCompile Include="kernel_function.cpp" />
<ClCompile Include="load_Image_callback.cpp" />
<ClCompile Include="mouse_keybord_hook.cpp" />
<ClCompile Include="mouse_key_win10.cpp" />
<ClCompile Include="mouse_key_win7.cpp" />
<ClCompile Include="ob_reg_callback.cpp" />
<ClCompile Include="process_func.cpp" />
<ClCompile Include="process_notify_callback.cpp" />
<ClCompile Include="protect_filter.cpp" />
<ClCompile Include="shadow_ssdt.cpp" />
<ClCompile Include="utils.cpp" />
</ItemGroup>
<ItemGroup>
@@ -169,13 +176,23 @@
<ClInclude Include="comm_win10.h" />
<ClInclude Include="comm_win7.h" />
<ClInclude Include="create_thread_callback.h" />
<ClInclude Include="hde\hde64.h" />
<ClInclude Include="hde\headers.hpp" />
<ClInclude Include="hde\pstdint.h" />
<ClInclude Include="hde\table64.h" />
<ClInclude Include="inline_hooks.h" />
<ClInclude Include="io_ctl.h" />
<ClInclude Include="kernel_api.h" />
<ClInclude Include="kernel_function.h" />
<ClInclude Include="load_Image_callback.h" />
<ClInclude Include="mouse_keybord_hook.h" />
<ClInclude Include="mouse_key_win10.h" />
<ClInclude Include="mouse_key_win7.h" />
<ClInclude Include="ob_reg_callback.h" />
<ClInclude Include="process_func.h" />
<ClInclude Include="process_notify_callback.h" />
<ClInclude Include="protect_filter.h" />
<ClInclude Include="shadow_ssdt.h" />
<ClInclude Include="utils.h" />
</ItemGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
Anti-Cheat_Driver/Anti-Cheat_Driver.vcxproj.filters
+74 -5
View File
@@ -19,9 +19,6 @@
<Filter Include="kernel_extern_api">
<UniqueIdentifier>{b3f98251-c1bf-4bd0-a5bd-d5425c272a5e}</UniqueIdentifier>
</Filter>
<Filter Include="Iocontrol">
<UniqueIdentifier>{1373c16e-e769-4553-b7b9-0f87b2f6ab0e}</UniqueIdentifier>
</Filter>
<Filter Include="Resource Files">
<UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
<Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
@@ -41,6 +38,27 @@
<Filter Include="comm">
<UniqueIdentifier>{39d8ef92-d541-4aee-9850-0a3d878333dc}</UniqueIdentifier>
</Filter>
<Filter Include="comm\Iocontrol">
<UniqueIdentifier>{1373c16e-e769-4553-b7b9-0f87b2f6ab0e}</UniqueIdentifier>
</Filter>
<Filter Include="utils\hde">
<UniqueIdentifier>{eb37b22e-76b8-4afe-9adb-bc5b6842ee98}</UniqueIdentifier>
</Filter>
<Filter Include="Hooks">
<UniqueIdentifier>{ea698d6c-d13f-4cc1-9129-3f8e935ee10d}</UniqueIdentifier>
</Filter>
<Filter Include="Hooks\InlineHook">
<UniqueIdentifier>{c6d3ba67-35ff-487d-b42b-beaf95752ea6}</UniqueIdentifier>
</Filter>
<Filter Include="mouse_keyboard">
<UniqueIdentifier>{d29bdd3e-0035-4cad-a658-7b272bd7d199}</UniqueIdentifier>
</Filter>
<Filter Include="kernel_extern_api\SSDT">
<UniqueIdentifier>{14cf9a07-d604-4163-8bfc-ded4b6e62df5}</UniqueIdentifier>
</Filter>
<Filter Include="kernel_extern_api\ShadowSSDT">
<UniqueIdentifier>{4f8c4f4e-0ff6-4cfa-804b-27bd50fca679}</UniqueIdentifier>
</Filter>
</ItemGroup>
<ItemGroup>
<ClCompile Include="driver_main.cpp">
@@ -53,7 +71,7 @@
<Filter>kernel_extern_api</Filter>
</ClCompile>
<ClCompile Include="io_ctl.cpp">
<Filter>Iocontrol</Filter>
<Filter>comm\Iocontrol</Filter>
</ClCompile>
<ClCompile Include="utils.cpp">
<Filter>utils</Filter>
@@ -88,6 +106,27 @@
<ClCompile Include="comm.cpp">
<Filter>comm</Filter>
</ClCompile>
<ClCompile Include="process_notify_callback.cpp">
<Filter>kernel_callback</Filter>
</ClCompile>
<ClCompile Include="hde\hde64.cpp">
<Filter>utils\hde</Filter>
</ClCompile>
<ClCompile Include="inline_hooks.cpp">
<Filter>Hooks\InlineHook</Filter>
</ClCompile>
<ClCompile Include="mouse_keybord_hook.cpp">
<Filter>mouse_keyboard</Filter>
</ClCompile>
<ClCompile Include="shadow_ssdt.cpp">
<Filter>kernel_extern_api\ShadowSSDT</Filter>
</ClCompile>
<ClCompile Include="mouse_key_win10.cpp">
<Filter>mouse_keyboard</Filter>
</ClCompile>
<ClCompile Include="mouse_key_win7.cpp">
<Filter>mouse_keyboard</Filter>
</ClCompile>
</ItemGroup>
<ItemGroup>
<ClInclude Include="Base.h">
@@ -100,7 +139,7 @@
<Filter>kernel_extern_api</Filter>
</ClInclude>
<ClInclude Include="io_ctl.h">
<Filter>Iocontrol</Filter>
<Filter>comm\Iocontrol</Filter>
</ClInclude>
<ClInclude Include="utils.h">
<Filter>utils</Filter>
@@ -135,5 +174,35 @@
<ClInclude Include="comm.h">
<Filter>comm</Filter>
</ClInclude>
<ClInclude Include="process_notify_callback.h">
<Filter>kernel_callback</Filter>
</ClInclude>
<ClInclude Include="hde\hde64.h">
<Filter>utils\hde</Filter>
</ClInclude>
<ClInclude Include="hde\headers.hpp">
<Filter>utils\hde</Filter>
</ClInclude>
<ClInclude Include="hde\pstdint.h">
<Filter>utils\hde</Filter>
</ClInclude>
<ClInclude Include="hde\table64.h">
<Filter>utils\hde</Filter>
</ClInclude>
<ClInclude Include="inline_hooks.h">
<Filter>Hooks\InlineHook</Filter>
</ClInclude>
<ClInclude Include="mouse_keybord_hook.h">
<Filter>mouse_keyboard</Filter>
</ClInclude>
<ClInclude Include="shadow_ssdt.h">
<Filter>kernel_extern_api\ShadowSSDT</Filter>
</ClInclude>
<ClInclude Include="mouse_key_win10.h">
<Filter>mouse_keyboard</Filter>
</ClInclude>
<ClInclude Include="mouse_key_win7.h">
<Filter>mouse_keyboard</Filter>
</ClInclude>
</ItemGroup>
</Project>
Anti-Cheat_Driver/anit_screen_grap.cpp
-11
View File
@@ -7,16 +7,6 @@ namespace anit_screen_grap
{
auto GreProtectSpriteContent(HWND hWnd, UINT Flags) -> BOOL
{
UNREFERENCED_PARAMETER(hWnd);
UNREFERENCED_PARAMETER(Flags);
auto eprocess = kernel_function::FindProcess("IHuan.exe");
ObDereferenceObject(eprocess);
KAPC_STATE apc{ 0 };
KeStackAttachProcess(eprocess, &apc);
typedef BOOL(__fastcall* fn_GreProtectSpriteContent)(LPVOID, HWND, INT, UINT);
static fn_GreProtectSpriteContent _GreProtectSpriteContent = nullptr;
if (!_GreProtectSpriteContent) {
@@ -41,7 +31,6 @@ namespace anit_screen_grap
auto suc = _GreProtectSpriteContent(NULL, hWnd, TRUE, Flags);
KeUnstackDetachProcess(&apc);
return suc;
}
Anti-Cheat_Driver/comm_dispatch.cpp
+13 -2
View File
@@ -1,10 +1,11 @@
#include "comm_dispatch.h"
#include "protect_filter.h"
#include "anit_screen_grap.h"
namespace comm_dispatch
{
auto dispatch(CMD_COMM* data) -> NTSTATUS
{
auto status = STATUS_UNSUCCESSFUL;
switch (data->CommID)
{
@@ -15,7 +16,17 @@ namespace comm_dispatch
}
case CMD::DRIVER_PROTECT_PROCESS:
{
status = protect_filter::add_list((ULONG)data->Pid, NULL);
auto process_data = (IOCTL_PROCESS*)data->Buf;
status = protect_filter::add_list((ULONG)process_data->Pid, NULL);
break;
}
case CMD::WINDOW_ANIT_SCREEN:
{
auto window_data = (IOCTL_WINDOW*)data->Buf;
status = anit_screen_grap::GreProtectSpriteContent(
(HWND)window_data->HWND, (UINT)window_data->Flags);
break;
}
default:
Anti-Cheat_Driver/comm_dispatch.h
+13 -2
View File
@@ -4,15 +4,26 @@
struct CMD_COMM
{
DWORD64 CommID;
DWORD64 Pid;
DWORD64 Buf;
DWORD64 status;
};
struct IOCTL_PROCESS
{
DWORD64 Pid;
};
struct IOCTL_WINDOW
{
DWORD64 HWND;
DWORD64 Flags;
};
enum CMD
{
MSG_BASE = 0x10000,
DRIVER_COMM_TEST,
DRIVER_PROTECT_PROCESS
DRIVER_PROTECT_PROCESS,
WINDOW_ANIT_SCREEN,
};
namespace comm_dispatch
Anti-Cheat_Driver/comm_win10.cpp
+2 -3
View File
@@ -2,8 +2,7 @@
#include "comm_dispatch.h"
#include "utils.h"
#include "kernel_function.h"
#pragma warning(disable : 4309)
#pragma warning(disable : 4838)
#pragma warning(disable : 4309 4838)
typedef NTSTATUS(__fastcall* fnHalpTimerConvertAuxiliaryCounterToPerformanceCounter)(PVOID, PVOID, PVOID);
fnHalpTimerConvertAuxiliaryCounterToPerformanceCounter _HalpTimerConvertAuxiliaryCounterToPerformanceCounter = 0;
@@ -33,6 +32,7 @@ namespace comm_win10
// mov rax,comm_callback
// jmp rax
char jmprax[] = { 0x48, 0xB8, 0x13, 0x09, 0xFC, 0xD6, 0xFC, 0x7F, 0x00, 0x00, 0xFF, 0xE0 };
*(uintptr_t*)&jmprax[2] = (uintptr_t)comm_callback;
@@ -62,7 +62,6 @@ namespace comm_win10
if (!beep_trampoline_ptr)
return FALSE;
char nullcode[12]{ 0 };
auto status = kernel_function::MmMDLPagesCopy((PVOID)beep_trampoline_ptr, &nullcode, sizeof(nullcode), 0x0000002, KernelMode);
if (!NT_SUCCESS(status))
Anti-Cheat_Driver/comm_win7.cpp
+13 -3
View File
@@ -3,8 +3,7 @@
#include "utils.h"
#include "kernel_function.h"
#pragma warning(disable : 4309)
#pragma warning(disable : 4838)
#pragma warning(disable : 4309 4838)
PFILE_OBJECT file_obj{ 0 };
PDEVICE_OBJECT device_obj{ 0 };
@@ -39,6 +38,8 @@ namespace comm_win7
return status;
};
uintptr_t beep_trampoline = NULL;
auto comm_install_hook() -> BOOL
{
auto drv_obj = device_obj->DriverObject;
@@ -47,7 +48,7 @@ namespace comm_win7
orign_maj_function = drv_obj->MajorFunction[IRP_MJ_DEVICE_CONTROL];
auto beep_trampoline = utils::get_beep_trampoline_ptr();
beep_trampoline = utils::get_beep_trampoline_ptr();
if (!beep_trampoline)
return FALSE;
@@ -73,6 +74,15 @@ namespace comm_win7
{
drv_obj->MajorFunction[IRP_MJ_DEVICE_CONTROL] =
(PDRIVER_DISPATCH)orign_maj_function;
if (!beep_trampoline)
return FALSE;
char nullcode[12]{ 0 };
auto status = kernel_function::MmMDLPagesCopy((PVOID)beep_trampoline, &nullcode, sizeof(nullcode), 0x0000002, KernelMode);
if (!NT_SUCCESS(status))
return FALSE;
}
return TRUE;
Anti-Cheat_Driver/create_thread_callback.cpp
+14 -14
View File
@@ -3,15 +3,11 @@
#include "kernel_function.h"
#include "utils.h"
#pragma warning(disable : 4309)
#pragma warning(disable : 4838)
#pragma warning(disable : 4309 4838)
namespace thread_notify_routine
{
//保护的进程ID
//auto protect_id = ULongToHandle(8976);
void thread_notify_routine(HANDLE ProcessId, HANDLE ThreadId, BOOLEAN Create)
{
if (Create)
@@ -46,17 +42,16 @@ namespace thread_notify_routine
DbgPrintEx(77, 0, "[!] 被创建线程ID: %d\n", ThreadId);
}
end:
ObDereferenceObject(process);
}
}
uintptr_t trampoline_ptr = NULL;
auto create_thread_routine() -> NTSTATUS
{
auto trampoline_ptr = utils::get_beep_trampoline_ptr();
trampoline_ptr = utils::get_beep_trampoline_ptr();
if (trampoline_ptr)
{
char jmprax[] = { 0x48, 0xB8, 0xA0, 0x9A, 0xD5, 0x3E, 0xFE, 0x7F, 0x00, 0x00, 0xFF, 0xE0 };
@@ -74,10 +69,15 @@ namespace thread_notify_routine
auto unload_thread_routine() -> NTSTATUS
{
//auto trampoline_ptr = utils::get_beep_trampoline_ptr();
return PsRemoveCreateThreadNotifyRoutine(thread_notify_routine);
auto status = PsRemoveCreateThreadNotifyRoutine((PCREATE_PROCESS_NOTIFY_ROUTINE)trampoline_ptr);
if (!NT_SUCCESS(status))
return status;
char nullcode[12]{ 0 };
status = kernel_function::MmMDLPagesCopy((PVOID)trampoline_ptr, &nullcode, sizeof(nullcode), 0x0000002, KernelMode);
if (!NT_SUCCESS(status))
return status;
return STATUS_SUCCESS;
}
}
Anti-Cheat_Driver/driver_main.cpp
+82 -3
View File
@@ -1,8 +1,72 @@
#include "ob_reg_callback.h"
#include "create_thread_callback.h"
#include "process_notify_callback.h"
#include "protect_filter.h"
#include "comm.h"
#include "inline_hooks.h"
#include "mouse_keybord_hook.h"
typedef NTSTATUS (NTAPI* fnNtOpenProcess)(
_Out_ PHANDLE ProcessHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_opt_ PCLIENT_ID ClientId);
typedef NTSTATUS(NTAPI* fnNtCreateFile)(
_Out_ PHANDLE FileHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
_In_opt_ PLARGE_INTEGER AllocationSize,
_In_ ULONG FileAttributes,
_In_ ULONG ShareAccess,
_In_ ULONG CreateDisposition,
_In_ ULONG CreateOptions,
_In_reads_bytes_opt_(EaLength) PVOID EaBuffer,
_In_ ULONG EaLength
);
fnNtOpenProcess origon_ntOpenProcess;
fnNtCreateFile origon_ntCreatFile;
NTSTATUS NTAPI hkNtOpenProcess(
_Out_ PHANDLE ProcessHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_opt_ PCLIENT_ID ClientId
)
{
DbgPrintEx(77, 0, "NtOpenProcess\n");
return origon_ntOpenProcess(ProcessHandle, DesiredAccess, ObjectAttributes, ClientId);
}
NTSTATUS
NTAPI
hkNtCreateFile(
_Out_ PHANDLE FileHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
_In_opt_ PLARGE_INTEGER AllocationSize,
_In_ ULONG FileAttributes,
_In_ ULONG ShareAccess,
_In_ ULONG CreateDisposition,
_In_ ULONG CreateOptions,
_In_reads_bytes_opt_(EaLength) PVOID EaBuffer,
_In_ ULONG EaLength
)
{
DbgPrintEx(77, 0, "NtCreateFile\n");
return origon_ntCreatFile(FileHandle, DesiredAccess, ObjectAttributes, IoStatusBlock, AllocationSize, FileAttributes, ShareAccess, CreateDisposition, CreateOptions, EaBuffer, EaLength);
}
EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING)
{
@@ -12,16 +76,31 @@ EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING)
{
kernel_comm_create::remove();
ob_call_back::uninstall_ob_callback();
//DbgPrintEx(77,0,"%x\n", thread_notify_routine::unload_thread_routine());
process_notify_callback::remov_process_notify();
thread_notify_routine::unload_thread_routine();
inline_hooks_manager::fn_get_instance()->inline_remov_hook((void**)NtOpenProcess);
inline_hooks_manager::fn_get_instance()->inline_remov_hook((void**)NtCreateFile);
mouse_keybord_hook::remove_mouse_keybord_hook();
};
}
kernel_api::kernel_api_init();
protect_filter::Init();
kernel_api::kernel_api_init();
kernel_comm_create::Init();
//inline_hooks_manager::fn_get_instance()->inline_install_hook(NtOpenProcess, hkNtOpenProcess, (void**)&origon_ntOpenProcess);
//inline_hooks_manager::fn_get_instance()->inline_install_hook(NtCreateFile, hkNtCreateFile, (void**)&origon_ntCreatFile);
mouse_keybord_hook::install_mouse_keybord_hook();
DbgPrintEx(77, 0, "[+]ob_reg_callback status:%x\n", ob_call_back::register_ob_reg_callback());
//DbgPrintEx(77, 0, "[+]create_thread_routine status:%x\n", thread_notify_routine::create_thread_routine());
DbgPrintEx(77, 0, "[+]process_notify_callback status:%x\n", process_notify_callback::install_process_notify());
DbgPrintEx(77, 0, "[+]create_thread_routine status:%x\n", thread_notify_routine::create_thread_routine());
return STATUS_SUCCESS;
}
Anti-Cheat_Driver/hde/hde64.cpp
+350
View File
@@ -0,0 +1,350 @@
/*
* Hacker Disassembler Engine 64 C
* Copyright (c) 2008-2009, Vyacheslav Patkov.
* All rights reserved.
*
*/
#include "headers.hpp"
#if defined(_M_X64) || defined(__x86_64__)
#pragma warning(push, 0)
#pragma warning(disable: 4701 4706 26451)
#include "hde64.h"
#include "table64.h"
unsigned int hde64_disasm(const void* code, hde64s* hs)
{
uint8_t x, c, * p = (uint8_t*)code, cflags, opcode, pref = 0;
uint8_t* ht = hde64_table, m_mod, m_reg, m_rm, disp_size = 0;
uint8_t op64 = 0;
// Avoid using memset to reduce the footprint.
memset(hs, 0, sizeof(hde64s));
for (x = 16; x; x--)
switch (c = *p++) {
case 0xf3:
hs->p_rep = c;
pref |= PRE_F3;
break;
case 0xf2:
hs->p_rep = c;
pref |= PRE_F2;
break;
case 0xf0:
hs->p_lock = c;
pref |= PRE_LOCK;
break;
case 0x26: case 0x2e: case 0x36:
case 0x3e: case 0x64: case 0x65:
hs->p_seg = c;
pref |= PRE_SEG;
break;
case 0x66:
hs->p_66 = c;
pref |= PRE_66;
break;
case 0x67:
hs->p_67 = c;
pref |= PRE_67;
break;
default:
goto pref_done;
}
pref_done:
hs->flags = (uint32_t)pref << 23;
if (!pref)
pref |= PRE_NONE;
if ((c & 0xf0) == 0x40) {
hs->flags |= F_PREFIX_REX;
if ((hs->rex_w = (c & 0xf) >> 3) && (*p & 0xf8) == 0xb8)
op64++;
hs->rex_r = (c & 7) >> 2;
hs->rex_x = (c & 3) >> 1;
hs->rex_b = c & 1;
if (((c = *p++) & 0xf0) == 0x40) {
opcode = c;
goto error_opcode;
}
}
if ((hs->opcode = c) == 0x0f) {
hs->opcode2 = c = *p++;
ht += DELTA_OPCODES;
}
else if (c >= 0xa0 && c <= 0xa3) {
op64++;
if (pref & PRE_67)
pref |= PRE_66;
else
pref &= ~PRE_66;
}
opcode = c;
cflags = ht[ht[opcode / 4] + (opcode % 4)];
if (cflags == C_ERROR) {
error_opcode:
hs->flags |= F_ERROR | F_ERROR_OPCODE;
cflags = 0;
if ((opcode & -3) == 0x24)
cflags++;
}
x = 0;
if (cflags & C_GROUP) {
uint16_t t;
t = *(uint16_t*)(ht + (cflags & 0x7f));
cflags = (uint8_t)t;
x = (uint8_t)(t >> 8);
}
if (hs->opcode2) {
ht = hde64_table + DELTA_PREFIXES;
if (ht[ht[opcode / 4] + (opcode % 4)] & pref)
hs->flags |= F_ERROR | F_ERROR_OPCODE;
}
if (cflags & C_MODRM) {
hs->flags |= F_MODRM;
hs->modrm = c = *p++;
hs->modrm_mod = m_mod = c >> 6;
hs->modrm_rm = m_rm = c & 7;
hs->modrm_reg = m_reg = (c & 0x3f) >> 3;
if (x && ((x << m_reg) & 0x80))
hs->flags |= F_ERROR | F_ERROR_OPCODE;
if (!hs->opcode2 && opcode >= 0xd9 && opcode <= 0xdf) {
uint8_t t = opcode - 0xd9;
if (m_mod == 3) {
ht = hde64_table + DELTA_FPU_MODRM + t * 8;
t = ht[m_reg] << m_rm;
}
else {
ht = hde64_table + DELTA_FPU_REG;
t = ht[t] << m_reg;
}
if (t & 0x80)
hs->flags |= F_ERROR | F_ERROR_OPCODE;
}
if (pref & PRE_LOCK) {
if (m_mod == 3) {
hs->flags |= F_ERROR | F_ERROR_LOCK;
}
else {
uint8_t* table_end, op = opcode;
if (hs->opcode2) {
ht = hde64_table + DELTA_OP2_LOCK_OK;
table_end = ht + DELTA_OP_ONLY_MEM - DELTA_OP2_LOCK_OK;
}
else {
ht = hde64_table + DELTA_OP_LOCK_OK;
table_end = ht + DELTA_OP2_LOCK_OK - DELTA_OP_LOCK_OK;
op &= -2;
}
for (; ht != table_end; ht++)
if (*ht++ == op) {
if (!((*ht << m_reg) & 0x80))
goto no_lock_error;
else
break;
}
hs->flags |= F_ERROR | F_ERROR_LOCK;
no_lock_error:
;
}
}
if (hs->opcode2) {
switch (opcode) {
case 0x20: case 0x22:
m_mod = 3;
if (m_reg > 4 || m_reg == 1)
goto error_operand;
else
goto no_error_operand;
case 0x21: case 0x23:
m_mod = 3;
if (m_reg == 4 || m_reg == 5)
goto error_operand;
else
goto no_error_operand;
}
}
else {
switch (opcode) {
case 0x8c:
if (m_reg > 5)
goto error_operand;
else
goto no_error_operand;
case 0x8e:
if (m_reg == 1 || m_reg > 5)
goto error_operand;
else
goto no_error_operand;
}
}
if (m_mod == 3) {
uint8_t* table_end;
if (hs->opcode2) {
ht = hde64_table + DELTA_OP2_ONLY_MEM;
table_end = ht + sizeof(hde64_table) - DELTA_OP2_ONLY_MEM;
}
else {
ht = hde64_table + DELTA_OP_ONLY_MEM;
table_end = ht + DELTA_OP2_ONLY_MEM - DELTA_OP_ONLY_MEM;
}
for (; ht != table_end; ht += 2)
if (*ht++ == opcode) {
if (*ht++ & pref && !((*ht << m_reg) & 0x80))
goto error_operand;
else
break;
}
goto no_error_operand;
}
else if (hs->opcode2) {
switch (opcode) {
case 0x50: case 0xd7: case 0xf7:
if (pref & (PRE_NONE | PRE_66))
goto error_operand;
break;
case 0xd6:
if (pref & (PRE_F2 | PRE_F3))
goto error_operand;
break;
case 0xc5:
goto error_operand;
}
goto no_error_operand;
}
else
goto no_error_operand;
error_operand:
hs->flags |= F_ERROR | F_ERROR_OPERAND;
no_error_operand:
c = *p++;
if (m_reg <= 1) {
if (opcode == 0xf6)
cflags |= C_IMM8;
else if (opcode == 0xf7)
cflags |= C_IMM_P66;
}
switch (m_mod) {
case 0:
if (pref & PRE_67) {
if (m_rm == 6)
disp_size = 2;
}
else
if (m_rm == 5)
disp_size = 4;
break;
case 1:
disp_size = 1;
break;
case 2:
disp_size = 2;
if (!(pref & PRE_67))
disp_size <<= 1;
}
if (m_mod != 3 && m_rm == 4) {
hs->flags |= F_SIB;
p++;
hs->sib = c;
hs->sib_scale = c >> 6;
hs->sib_index = (c & 0x3f) >> 3;
if ((hs->sib_base = c & 7) == 5 && !(m_mod & 1))
disp_size = 4;
}
p--;
switch (disp_size) {
case 1:
hs->flags |= F_DISP8;
hs->disp.disp8 = *p;
break;
case 2:
hs->flags |= F_DISP16;
hs->disp.disp16 = *(uint16_t*)p;
break;
case 4:
hs->flags |= F_DISP32;
hs->disp.disp32 = *(uint32_t*)p;
}
p += disp_size;
}
else if (pref & PRE_LOCK)
hs->flags |= F_ERROR | F_ERROR_LOCK;
if (cflags & C_IMM_P66) {
if (cflags & C_REL32) {
if (pref & PRE_66) {
hs->flags |= F_IMM16 | F_RELATIVE;
hs->imm.imm16 = *(uint16_t*)p;
p += 2;
goto disasm_done;
}
goto rel32_ok;
}
if (op64) {
hs->flags |= F_IMM64;
hs->imm.imm64 = *(uint64_t*)p;
p += 8;
}
else if (!(pref & PRE_66)) {
hs->flags |= F_IMM32;
hs->imm.imm32 = *(uint32_t*)p;
p += 4;
}
else
goto imm16_ok;
}
if (cflags & C_IMM16) {
imm16_ok:
hs->flags |= F_IMM16;
hs->imm.imm16 = *(uint16_t*)p;
p += 2;
}
if (cflags & C_IMM8) {
hs->flags |= F_IMM8;
hs->imm.imm8 = *p++;
}
if (cflags & C_REL32) {
rel32_ok:
hs->flags |= F_IMM32 | F_RELATIVE;
hs->imm.imm32 = *(uint32_t*)p;
p += 4;
}
else if (cflags & C_REL8) {
hs->flags |= F_IMM8 | F_RELATIVE;
hs->imm.imm8 = *p++;
}
disasm_done:
if ((hs->len = (uint8_t)(p - (uint8_t*)code)) > 15) {
hs->flags |= F_ERROR | F_ERROR_LENGTH;
hs->len = 15;
}
return (unsigned int)hs->len;
}
#pragma warning(pop)
#endif // defined(_M_X64) || defined(__x86_64__)
Anti-Cheat_Driver/hde/hde64.h
+112
View File
@@ -0,0 +1,112 @@
/*
* Hacker Disassembler Engine 64
* Copyright (c) 2008-2009, Vyacheslav Patkov.
* All rights reserved.
*
* hde64.h: C/C++ header file
*
*/
#ifndef _HDE64_H_
#define _HDE64_H_
/* stdint.h - C99 standard header
* http://en.wikipedia.org/wiki/stdint.h
*
* if your compiler doesn't contain "stdint.h" header (for
* example, Microsoft Visual C++), you can download file:
* http://www.azillionmonkeys.com/qed/pstdint.h
* and change next line to:
* #include "pstdint.h"
*/
#include "pstdint.h"
#define F_MODRM 0x00000001
#define F_SIB 0x00000002
#define F_IMM8 0x00000004
#define F_IMM16 0x00000008
#define F_IMM32 0x00000010
#define F_IMM64 0x00000020
#define F_DISP8 0x00000040
#define F_DISP16 0x00000080
#define F_DISP32 0x00000100
#define F_RELATIVE 0x00000200
#define F_ERROR 0x00001000
#define F_ERROR_OPCODE 0x00002000
#define F_ERROR_LENGTH 0x00004000
#define F_ERROR_LOCK 0x00008000
#define F_ERROR_OPERAND 0x00010000
#define F_PREFIX_REPNZ 0x01000000
#define F_PREFIX_REPX 0x02000000
#define F_PREFIX_REP 0x03000000
#define F_PREFIX_66 0x04000000
#define F_PREFIX_67 0x08000000
#define F_PREFIX_LOCK 0x10000000
#define F_PREFIX_SEG 0x20000000
#define F_PREFIX_REX 0x40000000
#define F_PREFIX_ANY 0x7f000000
#define PREFIX_SEGMENT_CS 0x2e
#define PREFIX_SEGMENT_SS 0x36
#define PREFIX_SEGMENT_DS 0x3e
#define PREFIX_SEGMENT_ES 0x26
#define PREFIX_SEGMENT_FS 0x64
#define PREFIX_SEGMENT_GS 0x65
#define PREFIX_LOCK 0xf0
#define PREFIX_REPNZ 0xf2
#define PREFIX_REPX 0xf3
#define PREFIX_OPERAND_SIZE 0x66
#define PREFIX_ADDRESS_SIZE 0x67
#pragma pack(push,1)
typedef struct {
uint8_t len;
uint8_t p_rep;
uint8_t p_lock;
uint8_t p_seg;
uint8_t p_66;
uint8_t p_67;
uint8_t rex;
uint8_t rex_w;
uint8_t rex_r;
uint8_t rex_x;
uint8_t rex_b;
uint8_t opcode;
uint8_t opcode2;
uint8_t modrm;
uint8_t modrm_mod;
uint8_t modrm_reg;
uint8_t modrm_rm;
uint8_t sib;
uint8_t sib_scale;
uint8_t sib_index;
uint8_t sib_base;
union {
uint8_t imm8;
uint16_t imm16;
uint32_t imm32;
uint64_t imm64;
} imm;
union {
uint8_t disp8;
uint16_t disp16;
uint32_t disp32;
} disp;
uint32_t flags;
} hde64s;
#pragma pack(pop)
#ifdef __cplusplus
extern "C" {
#endif
/* __cdecl */
unsigned int hde64_disasm(const void *code, hde64s *hs);
#ifdef __cplusplus
}
#endif
#endif /* _HDE64_H_ */
Anti-Cheat_Driver/hde/headers.hpp
+11
View File
@@ -0,0 +1,11 @@
#pragma once
#include <ntifs.h>
#include <ntdef.h>
#include <ntddk.h>
#include <wdm.h>
#include <ntstatus.h>
#include <ntimage.h>
#include <ntstrsafe.h>
#include <intrin.h>
#include <intsafe.h>
Anti-Cheat_Driver/hde/pstdint.h
+37
View File
@@ -0,0 +1,37 @@
/*
* MinHook - The Minimalistic API Hooking Library for x64/x86
* Copyright (C) 2009-2017 Tsuda Kageyu. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR "AS IS" AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#pragma once
// Integer types for HDE.
typedef INT8 int8_t;
typedef INT16 int16_t;
typedef INT32 int32_t;
typedef INT64 int64_t;
typedef UINT8 uint8_t;
typedef UINT16 uint16_t;
typedef UINT32 uint32_t;
typedef UINT64 uint64_t;
Anti-Cheat_Driver/hde/table64.h
+74
View File
@@ -0,0 +1,74 @@
/*
* Hacker Disassembler Engine 64 C
* Copyright (c) 2008-2009, Vyacheslav Patkov.
* All rights reserved.
*
*/
#define C_NONE 0x00
#define C_MODRM 0x01
#define C_IMM8 0x02
#define C_IMM16 0x04
#define C_IMM_P66 0x10
#define C_REL8 0x20
#define C_REL32 0x40
#define C_GROUP 0x80
#define C_ERROR 0xff
#define PRE_ANY 0x00
#define PRE_NONE 0x01
#define PRE_F2 0x02
#define PRE_F3 0x04
#define PRE_66 0x08
#define PRE_67 0x10
#define PRE_LOCK 0x20
#define PRE_SEG 0x40
#define PRE_ALL 0xff
#define DELTA_OPCODES 0x4a
#define DELTA_FPU_REG 0xfd
#define DELTA_FPU_MODRM 0x104
#define DELTA_PREFIXES 0x13c
#define DELTA_OP_LOCK_OK 0x1ae
#define DELTA_OP2_LOCK_OK 0x1c6
#define DELTA_OP_ONLY_MEM 0x1d8
#define DELTA_OP2_ONLY_MEM 0x1e7
unsigned char hde64_table[] = {
0xa5,0xaa,0xa5,0xb8,0xa5,0xaa,0xa5,0xaa,0xa5,0xb8,0xa5,0xb8,0xa5,0xb8,0xa5,
0xb8,0xc0,0xc0,0xc0,0xc0,0xc0,0xc0,0xc0,0xc0,0xac,0xc0,0xcc,0xc0,0xa1,0xa1,
0xa1,0xa1,0xb1,0xa5,0xa5,0xa6,0xc0,0xc0,0xd7,0xda,0xe0,0xc0,0xe4,0xc0,0xea,
0xea,0xe0,0xe0,0x98,0xc8,0xee,0xf1,0xa5,0xd3,0xa5,0xa5,0xa1,0xea,0x9e,0xc0,
0xc0,0xc2,0xc0,0xe6,0x03,0x7f,0x11,0x7f,0x01,0x7f,0x01,0x3f,0x01,0x01,0xab,
0x8b,0x90,0x64,0x5b,0x5b,0x5b,0x5b,0x5b,0x92,0x5b,0x5b,0x76,0x90,0x92,0x92,
0x5b,0x5b,0x5b,0x5b,0x5b,0x5b,0x5b,0x5b,0x5b,0x5b,0x5b,0x5b,0x6a,0x73,0x90,
0x5b,0x52,0x52,0x52,0x52,0x5b,0x5b,0x5b,0x5b,0x77,0x7c,0x77,0x85,0x5b,0x5b,
0x70,0x5b,0x7a,0xaf,0x76,0x76,0x5b,0x5b,0x5b,0x5b,0x5b,0x5b,0x5b,0x5b,0x5b,
0x5b,0x5b,0x86,0x01,0x03,0x01,0x04,0x03,0xd5,0x03,0xd5,0x03,0xcc,0x01,0xbc,
0x03,0xf0,0x03,0x03,0x04,0x00,0x50,0x50,0x50,0x50,0xff,0x20,0x20,0x20,0x20,
0x01,0x01,0x01,0x01,0xc4,0x02,0x10,0xff,0xff,0xff,0x01,0x00,0x03,0x11,0xff,
0x03,0xc4,0xc6,0xc8,0x02,0x10,0x00,0xff,0xcc,0x01,0x01,0x01,0x00,0x00,0x00,
0x00,0x01,0x01,0x03,0x01,0xff,0xff,0xc0,0xc2,0x10,0x11,0x02,0x03,0x01,0x01,
0x01,0xff,0xff,0xff,0x00,0x00,0x00,0xff,0x00,0x00,0xff,0xff,0xff,0xff,0x10,
0x10,0x10,0x10,0x02,0x10,0x00,0x00,0xc6,0xc8,0x02,0x02,0x02,0x02,0x06,0x00,
0x04,0x00,0x02,0xff,0x00,0xc0,0xc2,0x01,0x01,0x03,0x03,0x03,0xca,0x40,0x00,
0x0a,0x00,0x04,0x00,0x00,0x00,0x00,0x7f,0x00,0x33,0x01,0x00,0x00,0x00,0x00,
0x00,0x00,0xff,0xbf,0xff,0xff,0x00,0x00,0x00,0x00,0x07,0x00,0x00,0xff,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xff,0xff,
0x00,0x00,0x00,0xbf,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x7f,0x00,0x00,
0xff,0x40,0x40,0x40,0x40,0x41,0x49,0x40,0x40,0x40,0x40,0x4c,0x42,0x40,0x40,
0x40,0x40,0x40,0x40,0x40,0x40,0x4f,0x44,0x53,0x40,0x40,0x40,0x44,0x57,0x43,
0x5c,0x40,0x60,0x40,0x40,0x40,0x40,0x40,0x40,0x40,0x40,0x40,0x40,0x40,0x40,
0x40,0x40,0x64,0x66,0x6e,0x6b,0x40,0x40,0x6a,0x46,0x40,0x40,0x44,0x46,0x40,
0x40,0x5b,0x44,0x40,0x40,0x00,0x00,0x00,0x00,0x06,0x06,0x06,0x06,0x01,0x06,
0x06,0x02,0x06,0x06,0x00,0x06,0x00,0x0a,0x0a,0x00,0x00,0x00,0x02,0x07,0x07,
0x06,0x02,0x0d,0x06,0x06,0x06,0x0e,0x05,0x05,0x02,0x02,0x00,0x00,0x04,0x04,
0x04,0x04,0x05,0x06,0x06,0x06,0x00,0x00,0x00,0x0e,0x00,0x00,0x08,0x00,0x10,
0x00,0x18,0x00,0x20,0x00,0x28,0x00,0x30,0x00,0x80,0x01,0x82,0x01,0x86,0x00,
0xf6,0xcf,0xfe,0x3f,0xab,0x00,0xb0,0x00,0xb1,0x00,0xb3,0x00,0xba,0xf8,0xbb,
0x00,0xc0,0x00,0xc1,0x00,0xc7,0xbf,0x62,0xff,0x00,0x8d,0xff,0x00,0xc4,0xff,
0x00,0xc5,0xff,0x00,0xff,0xff,0xeb,0x01,0xff,0x0e,0x12,0x08,0x00,0x13,0x09,
0x00,0x16,0x08,0x00,0x17,0x09,0x00,0x2b,0x09,0x00,0xae,0xff,0x07,0xb2,0xff,
0x00,0xb4,0xff,0x00,0xb5,0xff,0x00,0xc3,0x01,0x00,0xc7,0xff,0xbf,0xe7,0x08,
0x00,0xf0,0x02,0x00
};
Anti-Cheat_Driver/inline_hooks.cpp
+110
View File
@@ -0,0 +1,110 @@
#include "inline_hooks.h"
#include "kernel_function.h"
#include "hde/hde64.h"
#pragma warning(disable : 4309 4838)
inline_hooks_manager* inline_hooks_manager::instance;
inline_hooks_manager* inline_hooks_manager::fn_get_instance()
{
if (instance == nullptr)
{
instance = (inline_hooks_manager*)ExAllocatePoolWithTag(NonPagedPool, sizeof(inline_hooks_manager), 'hook');
instance->m_cur_hook_count = 0;
instance->m_trampo_line = (unsigned char*)ExAllocatePoolWithTag(NonPagedPool, PAGE_SIZE, 'line');
RtlSecureZeroMemory(instance->m_Info, sizeof(HOOK_INFO) * HOOK_MAX_COUNT);
RtlSecureZeroMemory(instance->m_trampo_line, PAGE_SIZE);
}
return instance;
}
auto inline_hooks_manager::inline_install_hook(void* target_func, void* my_function, void** origon_func) -> BOOL
{
if (m_cur_hook_count > HOOK_MAX_COUNT)
return FALSE;
auto ori_func_addr = reinterpret_cast<unsigned char*>(target_func);
hde64s hde{ 0 };
uint64_t break_byte_count = NULL;
while (break_byte_count < 14)
{
hde64_disasm(ori_func_addr + break_byte_count, &hde);
break_byte_count += hde.len;
}
//保存原来的hook信息方便进行恢复
m_Info[m_cur_hook_count].origon_func = target_func;
memcpy(m_Info[m_cur_hook_count].destroy_code, target_func, 14);
m_cur_hook_count++;
//开始hook
//2D963190000 - FF25 00000000 A09AA40CFC7F0000 - jmp USER32.GetWindow
char jmpcode[14] = { 0xFF,0x25,0,0,0,0,0xA0,0x9A,0xA4,0x0C,0xFC,0x7F,0x00,0x00 };
*(uint64_t*)&jmpcode[6] = (uint64_t)my_function;
//蹦床构建
*origon_func = bulid_trampo_line(ori_func_addr, break_byte_count);
auto status = kernel_function::MmMDLPagesCopy(ori_func_addr, &jmpcode, sizeof(jmpcode), 0x0000002, KernelMode);
if (!NT_SUCCESS(status))
return FALSE;
return TRUE;
}
auto inline_hooks_manager::inline_remov_hook(void** origon_func) -> BOOL
{
for (size_t i = 0; i < HOOK_MAX_COUNT; i++)
{
if (m_cur_hook_count <= i)
break;
if (m_Info[i].origon_func)
{
if (m_Info[i].origon_func == origon_func)
{
kernel_function::MmMDLPagesCopy(m_Info[i].origon_func,
&m_Info[i].destroy_code, 14, 0x0000002, KernelMode);
}
if (origon_func == nullptr) {
kernel_function::MmMDLPagesCopy(m_Info[i].origon_func,
&m_Info[i].destroy_code, 14, 0x0000002, KernelMode);
}
}
}
return TRUE;
}
auto inline_hooks_manager::bulid_trampo_line(void* target_func, UINT64 break_byte_count) -> void*
{
//push 低32位
//mov[rsp+4],高32位
//ret
/*138DADF0000 - 68 A09AA40C - push 0CA49AA0
138DADF0005 - C7 44 24 04 FC7F0000 - mov[rsp + 04], 00007FFC
138DADF000D - C3 - ret*/
char push_mov_ret[] =
{ 0x68, 0xA0, 0x9A, 0xA4, 0x0C,
0xC7, 0x44, 0x24, 0x04, 0xFC, 0x7F, 0x00, 0x00,
0xC3
};
*(uint32_t*)&push_mov_ret[1] = (((uint64_t)target_func + break_byte_count) & 0xffffffff);
*(uint32_t*)&push_mov_ret[9] = ((((uint64_t)target_func + break_byte_count) >> 32) & 0xffffffff);
memcpy(instance->m_trampo_line, target_func, break_byte_count);
memcpy(instance->m_trampo_line + break_byte_count, &push_mov_ret, sizeof(push_mov_ret));
auto ret = reinterpret_cast<void*>(instance->m_trampo_line);
instance->m_trampo_line += break_byte_count + sizeof(push_mov_ret);
return ret;
}
Anti-Cheat_Driver/inline_hooks.h
+36
View File
@@ -0,0 +1,36 @@
#pragma once
#include "Base.h"
#define HOOK_MAX_COUNT 0x100
typedef struct _HOOK_INFO
{
void* origon_func;
unsigned char* destroy_code[14];
unsigned char* m_trampo_line;
}HOOK_INFO, * PHOOK_INFO;
class inline_hooks_manager
{
public:
static inline_hooks_manager* fn_get_instance();
auto inline_install_hook(void* target_func,void* my_function, void** origon_func) -> BOOL;
auto inline_remov_hook(void** origon_func)->BOOL;
auto inline_remov_all_hook()->BOOL;
auto bulid_trampo_line(void* target_func, UINT64 break_byte_count) -> void*;
private:
static inline_hooks_manager* instance;
unsigned char* m_trampo_line;
UINT64 m_cur_hook_count;
_HOOK_INFO m_Info[HOOK_MAX_COUNT];
};
Anti-Cheat_Driver/kernel_api.cpp
+12 -2
View File
@@ -1,9 +1,9 @@
#include "kernel_api.h"
struct imported_ imported { 0 };
namespace kernel_api
{
struct imported_ imported { 0 };
auto kernel_api_init() -> void
{
UNICODE_STRING unFuncName{ 0 };
@@ -19,6 +19,9 @@ namespace kernel_api
RtlInitUnicodeString(&unFuncName, L"SeLocateProcessImageName");
imported.se_locateprocess_imagename = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
RtlInitUnicodeString(&unFuncName, L"RtlFindExportedRoutineByName");
imported.rtl_findexported_routinebyname = (ULONG64)MmGetSystemRoutineAddress(&unFuncName);
}
NTSTATUS ntquerysysteminformation(ULONG SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength)
@@ -43,4 +46,11 @@ namespace kernel_api
return reinterpret_cast<NTSTATUS(*)(PEPROCESS, PUNICODE_STRING*)>
(imported.se_locateprocess_imagename)(Process, pImageFileName);
}
PVOID rtlfindexportedroutinebyname(PVOID ImageBase, PCCH RoutineName)
{
return reinterpret_cast<PVOID(*)(PVOID, PCCH)>(imported.rtl_findexported_routinebyname)
(ImageBase, RoutineName);
}
}
Anti-Cheat_Driver/kernel_api.h
+2 -1
View File
@@ -23,7 +23,7 @@ struct imported_
namespace kernel_api
{
extern struct imported_ imported;
//extern struct imported_ imported;
auto kernel_api_init() -> void;
@@ -38,4 +38,5 @@ namespace kernel_api
NTSTATUS selocate_process_imagename(PEPROCESS Process, PUNICODE_STRING* pImageFileName);
PVOID rtlfindexportedroutinebyname(PVOID ImageBase, PCCH RoutineName);
}
Anti-Cheat_Driver/kernel_function.cpp
+88 -2
View File
@@ -5,10 +5,9 @@
#pragma warning(disable : 4838)
namespace kernel_function
{
PEPROCESS process{ 0 };
auto FindProcess(const CHAR* ProcessName) -> PEPROCESS
{
PEPROCESS process{ 0 };
for (ULONG i = 4; i < 0x401000; i += 4)
{
auto status = PsLookupProcessByProcessId(ULongToHandle(i), &process);
@@ -68,6 +67,65 @@ namespace kernel_function
return base;
}
auto GetProcessModule(HANDLE Pid, UNICODE_STRING ModuleName, PVOID Buffer) -> NTSTATUS
{
NTSTATUS status = STATUS_SUCCESS;
PEPROCESS process = NULL;
UNICODE_STRING UniCodeName{ 0 };
uintptr_t ModuleBase = 0;
status = PsLookupProcessByProcessId(Pid, &process);
if (!NT_SUCCESS(status))
{
DbgPrintEx(77, 0, "[drv_memory] PsLookupProcessByProcessId failed with status %x\n", status);
return status;
}
BOOLEAN Is64 = (utils::PsGetProcessWow64Process(process) != NULL) ? TRUE : FALSE;
KAPC_STATE ApcState;
KeStackAttachProcess(process, &ApcState);
if (Is64)
{
PPEB32 Peb32 = (PPEB32)utils::PsGetProcessWow64Process(process);
PLIST_ENTRY32 LdrEntry32 = (PLIST_ENTRY32)((PPEB_LDR_DATA32)Peb32->Ldr)->InLoadOrderModuleList.Flink;
while (LdrEntry32 != &((PPEB_LDR_DATA32)Peb32->Ldr)->InLoadOrderModuleList)
{
PLDR_DATA_TABLE_ENTRY32 LdrDataTableEntry32 = (PLDR_DATA_TABLE_ENTRY32)LdrEntry32;
if (LdrDataTableEntry32->BaseDllName.Buffer == NULL) continue;
RtlInitUnicodeString(&UniCodeName, (PWCHAR)LdrDataTableEntry32->BaseDllName.Buffer);
if (RtlEqualUnicodeString(&ModuleName, &UniCodeName, TRUE))
{
ModuleBase = (uintptr_t)LdrDataTableEntry32->DllBase;
break;
}
LdrEntry32 = (PLIST_ENTRY32)LdrEntry32->Flink;
}
}
else
{
PPEB64 Peb64 = (PPEB64)utils::PsGetProcessPeb(process);
PLIST_ENTRY64 LdrEntry64 = (PLIST_ENTRY64)((PPEB_LDR_DATA64)Peb64->Ldr)->InLoadOrderModuleList.Flink;
while (LdrEntry64 != &((PPEB_LDR_DATA64)Peb64->Ldr)->InLoadOrderModuleList)
{
PLDR_DATA_TABLE_ENTRY64 LdrDataTableEntry64 = (PLDR_DATA_TABLE_ENTRY64)LdrEntry64;
if (LdrDataTableEntry64->BaseDllName.Buffer == NULL) continue;
RtlInitUnicodeString(&UniCodeName, LdrDataTableEntry64->BaseDllName.Buffer);
if (RtlEqualUnicodeString(&UniCodeName, &ModuleName, TRUE))
{
ModuleBase = (uintptr_t)LdrDataTableEntry64->DllBase;
break;
}
LdrEntry64 = (PLIST_ENTRY64)LdrEntry64->Flink;
}
}
KeUnstackDetachProcess(&ApcState);
ObDereferenceObject(process);
RtlCopyMemory(Buffer, &ModuleBase, sizeof(uintptr_t));
return status;
}
auto MmMDLPagesCopy(IN PVOID Address, PVOID Buff, SIZE_T Size, BYTE Type, CHAR AccessMode) -> NTSTATUS
{
PMDL pMDL = IoAllocateMdl(Address, (ULONG)Size, FALSE, FALSE, NULL);
@@ -169,5 +227,33 @@ namespace kernel_function
return TRUE;
}
auto ke_stack_attch_process(PEPROCESS PROCESS) -> KAPC_STATE
{
KAPC_STATE apc_state{ 0 };
KeStackAttachProcess(PROCESS, &apc_state);
return apc_state;
}
auto ke_unstack_detach_process(KAPC_STATE apc_state) -> void
{
KeUnstackDetachProcess(&apc_state);
}
auto GetgSessionGlobalSlots() -> uintptr_t {
static uintptr_t gSessionGlobalSlots;
if (gSessionGlobalSlots == NULL) {
auto win32k = GetKernelModule("win32k.sys");
if (!win32k)
return NULL;
auto W32GetSessionStateForSession = utils::FindSectionsCode(win32k, "\x48\x8b\x05\x00\x00\x00\x00\xff\xc9\x48\x8b\x04\xc8", "xxx????xxxxxx", ".text");
if (!W32GetSessionStateForSession)
return NULL;
gSessionGlobalSlots = (*(ULONG*)(W32GetSessionStateForSession + 3)) + (W32GetSessionStateForSession + 7);
}
return gSessionGlobalSlots;
}
}
Anti-Cheat_Driver/kernel_function.h
+114
View File
@@ -37,11 +37,119 @@ namespace kernel_function
RTL_PROCESS_MODULE_INFORMATION Modules[1];
} RTL_PROCESS_MODULES, * PRTL_PROCESS_MODULES;
typedef struct _PEB32
{
UCHAR InheritedAddressSpace;
UCHAR ReadImageFileExecOptions;
UCHAR BeingDebugged;
UCHAR BitField;
ULONG Mutant;
ULONG ImageBaseAddress;
ULONG Ldr;
ULONG ProcessParameters;
ULONG SubSystemData;
ULONG ProcessHeap;
ULONG FastPebLock;
ULONG AtlThunkSListPtr;
ULONG IFEOKey;
ULONG CrossProcessFlags;
ULONG UserSharedInfoPtr;
ULONG SystemReserved;
ULONG AtlThunkSListPtr32;
ULONG ApiSetMap;
} PEB32, * PPEB32; ////32 PEB½á¹¹
typedef struct _LDR_DATA_TABLE_ENTRY32
{
LIST_ENTRY32 InLoadOrderLinks;
LIST_ENTRY32 InMemoryOrderLinks;
LIST_ENTRY32 InInitializationOrderLinks;
ULONG DllBase;
ULONG EntryPoint;
ULONG SizeOfImage;
UNICODE_STRING32 FullDllName;
UNICODE_STRING32 BaseDllName;
ULONG Flags;
USHORT LoadCount;
USHORT TlsIndex;
LIST_ENTRY32 HashLinks;
ULONG TimeDateStamp;
} LDR_DATA_TABLE_ENTRY32, * PLDR_DATA_TABLE_ENTRY32;//32 PEB½á¹¹
typedef struct _PEB_LDR_DATA32
{
ULONG Length;
UCHAR Initialized;
ULONG SsHandle;
LIST_ENTRY32 InLoadOrderModuleList;
LIST_ENTRY32 InMemoryOrderModuleList;
LIST_ENTRY32 InInitializationOrderModuleList;
} PEB_LDR_DATA32, * PPEB_LDR_DATA32;//32 PEB½á¹¹
typedef struct _PEB64
{
UCHAR InheritedAddressSpace;
UCHAR ReadImageFileExecOptions;
UCHAR BeingDebugged;
UCHAR BitField;
ULONG64 Mutant;
ULONG64 ImageBaseAddress;
ULONG64 Ldr;
ULONG64 ProcessParameters;
ULONG64 SubSystemData;
ULONG64 ProcessHeap;
ULONG64 FastPebLock;
ULONG64 AtlThunkSListPtr;
ULONG64 IFEOKey;
ULONG64 CrossProcessFlags;
ULONG64 UserSharedInfoPtr;
ULONG SystemReserved;
ULONG AtlThunkSListPtr32;
ULONG64 ApiSetMap;
} PEB64, * PPEB64;
typedef struct _PEB_LDR_DATA64
{
ULONG Length;
BOOLEAN Initialized;
ULONG64 SsHandle;
LIST_ENTRY64 InLoadOrderModuleList;
LIST_ENTRY64 InMemoryOrderModuleList;
LIST_ENTRY64 InInitializationOrderModuleList;
ULONG64 EntryInProgress;
} PEB_LDR_DATA64, * PPEB_LDR_DATA64;
typedef struct _LDR_DATA_TABLE_ENTRY64
{
LIST_ENTRY64 InLoadOrderLinks;
LIST_ENTRY64 InMemoryOrderLinks;
LIST_ENTRY64 InInitializationOrderLinks;
PVOID DllBase;
ULONG64 EntryPoint;
ULONG64 SizeOfImage;
UNICODE_STRING FullDllName;
UNICODE_STRING BaseDllName;
ULONG Flags;
USHORT LoadCount;
USHORT TlsIndex;
LIST_ENTRY64 HashLinks;
ULONG64 SectionPointer;
ULONG64 CheckSum;
ULONG64 TimeDateStamp;
ULONG64 LoadedImports;
ULONG64 EntryPointActivationContext;
ULONG64 PatchInformation;
LIST_ENTRY64 ForwarderLinks;
LIST_ENTRY64 ServiceTagLinks;
LIST_ENTRY64 StaticLinks;
ULONG64 ContextInformation;
ULONG64 OriginalBase;
LARGE_INTEGER LoadTime;
} LDR_DATA_TABLE_ENTRY64, * PLDR_DATA_TABLE_ENTRY64;
auto FindProcess(CONST CHAR* ProcessName)->PEPROCESS;
auto GetKernelModule(CONST CHAR* Module)->uintptr_t;
auto GetProcessModule(HANDLE Pid, UNICODE_STRING ModuleName, PVOID Buffer) -> NTSTATUS;
auto MmMDLPagesCopy(IN PVOID Address, PVOID Buff, SIZE_T Size, BYTE Type, CHAR AccessMode)->NTSTATUS;
auto GetMmverifyCallBackFlags()->uintptr_t;
@@ -49,4 +157,10 @@ namespace kernel_function
auto Mack_MmVerifyCallBackFlags(BYTE** orgin_byte)->BOOL;
auto Orgin_MmVerifyCallBackFlags(BYTE* orgin_byte)->BOOL;
auto ke_stack_attch_process(PEPROCESS PROCESS) ->KAPC_STATE;
auto ke_unstack_detach_process(KAPC_STATE apc_state) -> void;
auto GetgSessionGlobalSlots()->uintptr_t;
}
Anti-Cheat_Driver/mouse_key_win10.cpp
+20
View File
@@ -0,0 +1,20 @@
#include "mouse_key_win10.h"
#include "mouse_keybord_hook.h"
#include "inline_hooks.h"
fnNtUserSendInput_win10 origon_NtUserSendInput_win10;
namespace mouse_key_win10
{
__int64 __fastcall hkNtUserSendInput(unsigned int a1, volatile void* a2, int a3, int a4)
{
DbgPrintEx(77, 0, "%d\n", PsGetCurrentProcessId());
return origon_NtUserSendInput_win10(a1, a2, a3, a4);
}
}
Anti-Cheat_Driver/mouse_key_win10.h
+12
View File
@@ -0,0 +1,12 @@
#pragma once
#include "Base.h"
typedef __int64(__fastcall* fnNtUserSendInput_win10)(unsigned int a1, volatile void* a2, int a3, int a4);
extern fnNtUserSendInput_win10 origon_NtUserSendInput_win10;
namespace mouse_key_win10
{
__int64 __fastcall hkNtUserSendInput(unsigned int a1, volatile void* a2, int a3, int a4);
}
Anti-Cheat_Driver/mouse_key_win7.cpp
View File
Anti-Cheat_Driver/mouse_key_win7.h
+1
View File
@@ -0,0 +1 @@
#pragma once
Anti-Cheat_Driver/mouse_keybord_hook.cpp
+89
View File
@@ -0,0 +1,89 @@
#include "mouse_keybord_hook.h"
#include "shadow_ssdt.h"
#include "kernel_function.h"
#include "utils.h"
#include "inline_hooks.h"
#include "mouse_key_win10.h"
#include "mouse_key_win7.h"
namespace mouse_keybord_hook
{
unsigned char* _ntSendInput;
auto get_sendinput_hook_addr() -> unsigned char*
{
auto os = utils::GetVersion();
if (os.dwBuildNumber == 7600 || os.dwBuildNumber == 7601)
{
return NULL;
}
else if (os.dwBuildNumber >= 26100)
{
auto gSessionGlobalSlots = kernel_function::GetgSessionGlobalSlots();
auto W32GetSessionState = *(ULONG64*)(*(ULONG64*)((*(ULONG64*)gSessionGlobalSlots)) + 0x88);
W32GetSessionState = *(ULONG64*)(W32GetSessionState + 0x150);
auto NtUserSendInput = *(unsigned char**)(W32GetSessionState + 0xB18);
return NtUserSendInput;
}
else
{
auto function = reinterpret_cast<unsigned char*>(ShadowSSDT::fn_get_shadowssdt_extport_func("NtUserSendInput"));
if (!function)
return NULL;
unsigned int break_byte_count = 0;
unsigned int index = 0;
while (break_byte_count < 2)
{
if (function[index++] == 0x48)
break_byte_count++;
}
return *(unsigned char**)((*(ULONG*)&function[index + 2]) + &function[index + 6]);
}
}
auto install_mouse_keybord_hook() -> BOOL
{
auto _eprocess_process = kernel_function::FindProcess("winlogon.exe");
if (!_eprocess_process)
return FALSE;
auto apc_state = kernel_function::ke_stack_attch_process(_eprocess_process);
_ntSendInput = get_sendinput_hook_addr();
auto os = utils::GetVersion();
if (os.dwBuildNumber == 7600 || os.dwBuildNumber == 7601)
{
}
else
{
inline_hooks_manager::fn_get_instance()->inline_install_hook(_ntSendInput, mouse_key_win10::hkNtUserSendInput, (void**)&origon_NtUserSendInput_win10);
}
kernel_function::ke_unstack_detach_process(apc_state);
return 0;
}
auto remove_mouse_keybord_hook() -> BOOL
{
auto _eprocess_process = kernel_function::FindProcess("winlogon.exe");
if (!_eprocess_process)
return FALSE;
auto apc_state = kernel_function::ke_stack_attch_process(_eprocess_process);
inline_hooks_manager::fn_get_instance()->inline_remov_hook((void**)_ntSendInput);
kernel_function::ke_unstack_detach_process(apc_state);
return 0;
}
}
Anti-Cheat_Driver/mouse_keybord_hook.h
+13
View File
@@ -0,0 +1,13 @@
#pragma once
#include "Base.h"
namespace mouse_keybord_hook
{
auto get_sendinput_hook_addr() -> unsigned char*;
auto install_mouse_keybord_hook()->BOOL;
auto remove_mouse_keybord_hook()->BOOL;
}
Anti-Cheat_Driver/process_notify_callback.cpp
+59
View File
@@ -0,0 +1,59 @@
#include "process_notify_callback.h"
#include "kernel_function.h"
#include "protect_filter.h"
#include "utils.h"
#pragma warning(disable : 4309 4838)
namespace process_notify_callback
{
auto process_notify_routine(
_In_ HANDLE ParentId,
_In_ HANDLE ProcessId,
_In_ BOOLEAN Create) -> VOID
{
UNREFERENCED_PARAMETER(ParentId);
if (!Create)
{
//进程退出时进行 对插链的清理操作
if (protect_filter::is_protect_pid(HandleToLong(ProcessId), nullptr))
protect_filter::remove_list(HandleToLong(ProcessId), nullptr);
}
/*DbgPrintEx(77, 0, "ParentId:%d | ProcessId:%d | Create:%d\n",
ParentId, ProcessId, Create);*/
}
uintptr_t beep_trampoline_ptr;
auto install_process_notify() -> NTSTATUS
{
beep_trampoline_ptr = utils::get_beep_trampoline_ptr();
if (!beep_trampoline_ptr)
return STATUS_UNSUCCESSFUL;
char jmprax[] = { 0x48, 0xB8, 0x13, 0x09, 0xFC, 0xD6, 0xFC, 0x7F, 0x00, 0x00, 0xFF, 0xE0 };
*(uintptr_t*)&jmprax[2] = (uintptr_t)process_notify_routine;
auto status = kernel_function::MmMDLPagesCopy((PVOID)beep_trampoline_ptr, &jmprax, sizeof(jmprax), 0x0000002, KernelMode);
if (!NT_SUCCESS(status))
return status;
return PsSetCreateProcessNotifyRoutine((PCREATE_PROCESS_NOTIFY_ROUTINE)beep_trampoline_ptr, FALSE);
}
auto remov_process_notify() -> NTSTATUS
{
if (!beep_trampoline_ptr)
return STATUS_UNSUCCESSFUL;
auto status = PsSetCreateProcessNotifyRoutine((PCREATE_PROCESS_NOTIFY_ROUTINE)beep_trampoline_ptr, TRUE);
if (!NT_SUCCESS(status))
return status;
char nullcode[12]{ 0 };
status = kernel_function::MmMDLPagesCopy((PVOID)beep_trampoline_ptr, &nullcode, sizeof(nullcode), 0x0000002, KernelMode);
if (!NT_SUCCESS(status))
return status;
return status;
}
}
Anti-Cheat_Driver/process_notify_callback.h
+10
View File
@@ -0,0 +1,10 @@
#pragma once
#include "Base.h"
namespace process_notify_callback
{
auto install_process_notify()->NTSTATUS;
auto remov_process_notify()->NTSTATUS;
}
Anti-Cheat_Driver/shadow_ssdt.cpp
+149
View File
@@ -0,0 +1,149 @@
#include "shadow_ssdt.h"
#include "kernel_function.h"
#include "kernel_api.h"
#include "utils.h"
PULONG W32pServiceTable = nullptr;
namespace ShadowSSDT
{
ULONG64 get_sssdt_func_addr(ULONG id) {
LONG dwtmp = 0;
PULONG ServiceTableBase = NULL;
ServiceTableBase = W32pServiceTable;
dwtmp = ServiceTableBase[id];
dwtmp = dwtmp >> 4;
return (LONGLONG)dwtmp + (ULONGLONG)ServiceTableBase;
}
auto get_sssdt_extport_func_win10(const char* func_name)-> uintptr_t
{
uintptr_t fun_addrss = 0;
auto process = kernel_function::FindProcess("explorer.exe");
if (!process)
{
DbgPrintEx(77, 0, "[+]get explorer fail\n");
return 0;
}
const auto win32k_base = reinterpret_cast<PVOID>(kernel_function::GetKernelModule("win32k.sys"));
if (!win32k_base)
{
ObDereferenceObject(process);
DbgPrintEx(77, 0, "[+]get win32k_base fail\n");
return 0;
}
KAPC_STATE apc_state{ 0 };
KeStackAttachProcess(process, &apc_state);
W32pServiceTable = (PULONG)kernel_api::rtlfindexportedroutinebyname(win32k_base, "W32pServiceTable");
if (!W32pServiceTable)
{
KeUnstackDetachProcess(&apc_state);
ObDereferenceObject(process);
DbgPrintEx(77, 0, "[+] getW32pServiceTable fail\n");
return 0;
}
auto pdos_header = reinterpret_cast<PIMAGE_DOS_HEADER>(win32k_base);
auto pNt_header = reinterpret_cast<PIMAGE_NT_HEADERS>((char*)win32k_base + pdos_header->e_lfanew);
//±éÀúµ¼³ö±í
const auto export_table = pNt_header->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];
const auto export_data = reinterpret_cast<PIMAGE_EXPORT_DIRECTORY>((char*)win32k_base + export_table.VirtualAddress);
const auto func_name_tab = reinterpret_cast<ULONG*>((char*)win32k_base + export_data->AddressOfNames);
const auto func_index_tab = reinterpret_cast<SHORT*>((char*)win32k_base + export_data->AddressOfNameOrdinals);
const auto func_addr_tab = reinterpret_cast<ULONG*>((char*)win32k_base + export_data->AddressOfFunctions);
for (size_t i = 0; i < export_data->NumberOfNames; i++)
{
const char* func_names = reinterpret_cast<const char*>((char*)win32k_base + func_name_tab[i]);
if (strstr(func_names, "__win32kstub_"))
{
const auto lpFunc_addr = reinterpret_cast<PUCHAR>((char*)win32k_base + func_addr_tab[func_index_tab[i]]);
char* FunctionName = strstr(func_names, "Nt");
if (!strcmp(FunctionName, func_name))
{
auto func_index = *(ULONG*)((uintptr_t)lpFunc_addr + 1);
fun_addrss = get_sssdt_func_addr(func_index);
break;
}
}
}
KeUnstackDetachProcess(&apc_state);
ObDereferenceObject(process);
return fun_addrss;
}
//auto get_sssdt_extport_func_win7(const char* func_name)
//{
// UNREFERENCED_PARAMETER(func_name);
// auto process = kernel_function::FindProcess("explorer.exe");
// if (!process)
// {
// DbgPrintEx(77, 0, "[+]get explorer fail\n");
// return 0;
// }
// KAPC_STATE apc_state{ 0 };
// KeStackAttachProcess(process, &apc_state);
// do
// {
// auto dwPid = PsGetProcessId(process);
// UNICODE_STRING module_name{ 0 };
// RtlInitUnicodeString(&module_name, L"user32.dll");
// unsigned char* moudle_buff = nullptr;
// auto status = kernel_function::GetProcessModule(dwPid, module_name, &moudle_buff);
// if (!NT_SUCCESS(status))
// break;
// //char* FunctionName = strstr(func_name, "Nt");
// //DbgPrintEx(77,0,"")
// /*auto func_addr = utils::get_hmodule_expotr_func(moudle_buff, FunctionName);
// if (!func_addr)
// break;
// auto func_index = *(UINT32*)(func_addr + 4);
// DbgPrintEx(77, 0, "%p | %d\n", func_addr, func_index);*/
// } while (0);
// KeUnstackDetachProcess(&apc_state);
// ObDereferenceObject(process);
//}
auto fn_get_shadowssdt_extport_func(const char* func_name) -> uintptr_t
{
auto os = utils::GetVersion();
if (os.dwBuildNumber == 7600 || os.dwBuildNumber == 7601)
{
return NULL;
}
else
{
return get_sssdt_extport_func_win10(func_name);
}
}
}
Anti-Cheat_Driver/shadow_ssdt.h
+11
View File
@@ -0,0 +1,11 @@
#pragma once
#include "Base.h"
namespace ShadowSSDT
{
auto fn_get_shadowssdt_extport_func(CONST char* func_name)->uintptr_t;
}
Anti-Cheat_Driver/utils.cpp
+29
View File
@@ -102,5 +102,34 @@ namespace utils
return NULL;
}
auto get_hmodule_expotr_func(void* modulebase, const char* func_name) -> uintptr_t
{
char* Base = reinterpret_cast<char*>(modulebase);
auto pdos_header = reinterpret_cast<PIMAGE_DOS_HEADER>(Base);
auto pNt_header = reinterpret_cast<PIMAGE_NT_HEADERS>((char*)Base + pdos_header->e_lfanew);
//±éÀúµ¼³ö±í
const auto export_table = pNt_header->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];
const auto export_data = reinterpret_cast<PIMAGE_EXPORT_DIRECTORY>((char*)Base + export_table.VirtualAddress);
const auto func_name_tab = reinterpret_cast<ULONG*>((char*)Base + export_data->AddressOfNames);
const auto func_index_tab = reinterpret_cast<SHORT*>((char*)Base + export_data->AddressOfNameOrdinals);
const auto func_addr_tab = reinterpret_cast<ULONG*>((char*)Base + export_data->AddressOfFunctions);
for (size_t i = 0; i < export_data->NumberOfNames; i++)
{
const char* func_names = reinterpret_cast<const char*>((char*)Base + func_name_tab[i]);
const auto lpFunc_addr = reinterpret_cast<PUCHAR>((char*)Base + func_addr_tab[func_index_tab[i]]);
if (!strcmp(func_names, func_name))
{
return (uintptr_t)lpFunc_addr;
}
}
return 0;
}
}
Anti-Cheat_Driver/utils.h
+4
View File
@@ -3,6 +3,9 @@
namespace utils
{
EXTERN_C NTKERNELAPI PVOID PsGetProcessWow64Process(IN PEPROCESS Process);
EXTERN_C NTKERNELAPI PVOID PsGetProcessPeb(IN PEPROCESS Process);
auto GetVersion() -> OSVERSIONINFOW;
auto FindSectionsCode(unsigned long long Base, const char* pattern, const char* mask, const char* name) -> ULONG64;
@@ -11,4 +14,5 @@ namespace utils
auto get_beep_trampoline_ptr()->uintptr_t;
auto get_hmodule_expotr_func(void* modulebase, const char* func_name)->uintptr_t;
}