test protect list

Anti-Cheat_Driver/create_thread_callback.cpp

@@ -1,5 +1,5 @@
 #include "create_thread_callback.h"
-
+#include "protect_filter.h"
 
 
 
@@ -19,13 +19,19 @@ namespace thread_notify_routine
 			if (!NT_SUCCESS(status))
 				goto end;
 
-			PEPROCESS protect_process{ 0 };
+
+			
+			
+			/*PEPROCESS protect_process{ 0 };
 			status = PsLookupProcessByProcessId(protect_id, &protect_process);
 			if (!NT_SUCCESS(status))
+				goto end;*/
+
+			if(!protect_filter::is_protect_pid(0, process))
 				goto end;
 
-			if (protect_process != process)
+			/*if (protect_process != process)
-				goto end;
+				goto end;*/
 
 			auto cutor_process_id = PsGetCurrentProcessId();
 			if (HandleToLong(cutor_process_id) == 4)

Anti-Cheat_Driver/driver_main.cpp

@@ -16,14 +16,14 @@ EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING)
 	kernel_api::kernel_api_init();
 
 	protect_filter::Init();
-	protect_filter::add_list(7868, 0);
+	protect_filter::add_list(4504, 0);
 	protect_filter::add_list(8152, 0);
 	protect_filter::add_list(8224, 0);
 
-	protect_filter::is_protect_pid(0);
+	//protect_filter::is_protect_pid(0);
 
-	protect_filter::remove_list(7868,0);
+	//protect_filter::remove_list(7868,0);
-	protect_filter::is_protect_pid(0);
+	//protect_filter::is_protect_pid(0);
 
 
 	ob_call_back::register_ob_reg_callback();

Anti-Cheat_Driver/ob_reg_callback.cpp

@@ -34,7 +34,7 @@ auto ob_call_back::register_ob_reg_callback() -> NTSTATUS
 			if(is_allow_process(image_file_name))
 				goto end;
 				
-			if (protect_filter::is_protect_pid(HandleToLong(dwPid)))
+			if (protect_filter::is_protect_pid(HandleToLong(dwPid), nullptr))
 			{
 				pOperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess = 0;
 				pOperationInformation->Parameters->DuplicateHandleInformation.OriginalDesiredAccess = 0;

Anti-Cheat_Driver/protect_filter.cpp

@@ -36,7 +36,7 @@ namespace protect_filter
 		return TRUE;
 	}
 
-	auto is_protect_pid(ULONG Pid) -> BOOL
+	auto is_protect_pid(ULONG Pid, PEPROCESS Eprocess)->BOOL
 	{
 		UNREFERENCED_PARAMETER(Pid);
 		if (IsListEmpty(&g_protect_list))
@@ -48,8 +48,18 @@ namespace protect_filter
 			auto list_data = reinterpret_cast<PFILTER>(CONTAINING_RECORD(list_head, FILTER, List));
 			list_head = list_head->Flink;
 
-			if (list_data->Pid == Pid)
+
-				return TRUE;
+			if (Pid)
+			{
+				if (list_data->Pid == Pid)
+					return TRUE;
+			}
+			if (Eprocess)
+			{
+				if (list_data->Eprocess == Eprocess)
+					return TRUE;
+			}
+		
 
 			//DbgPrintEx(77, 0, "[+] pid:%d | eproecss:%p\n", list_data->Pid, list_data->Eprocess);
 		}

Anti-Cheat_Driver/protect_filter.h

@@ -15,7 +15,7 @@ namespace protect_filter
 
 	auto add_list(ULONG Pid, HWND hwnd)->BOOL;
 
-	auto is_protect_pid(ULONG Pid) -> BOOL;
+	auto is_protect_pid(ULONG Pid, PEPROCESS Eprocess) -> BOOL;
 
 	auto remove_list(ULONG Pid, HWND hwnd)->BOOL;
 }