anit-cheat/Anit-Cheat_DLL/active_check.cpp

#include "active_check.h"
#include "utils.h"


static const NTSTATUS StatusInfoLengthMismatch = 0xC0000004L;

namespace active_check
{
	auto check_awesun_process() -> bool
	{
		auto dwPid = utils::GetProcessByName(L"AweSun.exe");

		auto hwnd = FindWindow(L"FLUTTERVIEW", NULL);

		if (dwPid || hwnd)
			return true;

		return false;
	}

	auto check_todesk_process() -> bool
	{
		auto dwPid = utils::GetProcessByName(L"ToDesk.exe");

		auto hwnd = FindWindow(NULL, L"ToDesk");

		if (dwPid || hwnd)
			return true;

		return false;
	}

	auto check_asklink_process() -> bool
	{
		auto dwPid = utils::GetProcessByName(L"AskLink.exe");

		auto hwnd = FindWindow(NULL, L"AskLink");

		if (dwPid || hwnd)
			return true;

		return false;
	}

	auto check_uu_remote_process() -> bool
	{
		auto dwPid = utils::GetProcessByName(L"GameViewer.exe");

		auto hwnd = FindWindow(NULL, L"ÍøÒ×UUÔ¶³Ì");

		if (dwPid || hwnd)
			return true;

		return false;
	}

	auto check_remote_app_process() -> bool
	{
		if (check_awesun_process() || 
			check_todesk_process() ||
			check_asklink_process() || 
			check_uu_remote_process())
		{
			return true;
		}


		return false;
	}

    DWORD GetProcessIdFromHandle(
        HANDLE ProcessHandle
    )
    {
        PROCESS_BASIC_INFORMATION_CUSTOM
            _ProcessBasicInformation{};

        ULONG ReturnLength = 0;


        NTSTATUS Status =
            NtQueryInformationProcess(
                ProcessHandle,
                ProcessBasicInformation,
                &_ProcessBasicInformation,
                sizeof(_ProcessBasicInformation),
                &ReturnLength
            );


        if (Status < 0)
            return 0;


        return _ProcessBasicInformation.UniqueProcessId;
    }

    auto ScanProcessHandles(DWORD CurrentProcessId, PROCESS_HANDLE_RESULTS* Results) -> BOOL
    {
        if (!Results)
            return FALSE;

        ZeroMemory(
            Results,
            sizeof(PROCESS_HANDLE_RESULTS)
        );

        ULONG BufferSize = 1024 * 1024;
        ULONG ReturnLength = 0;
        PVOID Buffer = nullptr;
        NTSTATUS Status;


        while (true)
        {
            Buffer = HeapAlloc(
                GetProcessHeap(),
                HEAP_ZERO_MEMORY,
                BufferSize
            );

            if (!Buffer)
                return FALSE;


            Status = NtQuerySystemInformation(
                SystemExtendedHandleInformation,
                Buffer,
                BufferSize,
                &ReturnLength
            );


            if (Status != StatusInfoLengthMismatch)
                break;


            HeapFree(GetProcessHeap(), 0, Buffer);

            Buffer = nullptr;

            BufferSize =
                ReturnLength > BufferSize
                ? ReturnLength + 0x10000
                : BufferSize * 2;
        }


        if (Status < 0)
        {
            HeapFree(GetProcessHeap(), 0, Buffer);
            return FALSE;
        }


        SYSTEM_HANDLE_INFORMATION_EX*
            HandleInformation =
            (SYSTEM_HANDLE_INFORMATION_EX*)Buffer;


        for (ULONG_PTR Index = 0;
            Index < HandleInformation->NumberOfHandles;
            ++Index)
        {
            SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX*
                HandleEntry =
                &HandleInformation->Handles[Index];


            auto OwnerProcessId = HandleEntry->UniqueProcessId;

            if (OwnerProcessId == CurrentProcessId)
                continue;


            HANDLE OwnerProcessHandle = OpenProcess(PROCESS_DUP_HANDLE, FALSE, OwnerProcessId);


            if (!OwnerProcessHandle)
                continue;


            HANDLE DuplicatedHandle = nullptr;


            BOOL DuplicateResult =
                DuplicateHandle(
                    OwnerProcessHandle,
                    (HANDLE)HandleEntry->HandleValue,
                    GetCurrentProcess(),
                    &DuplicatedHandle,
                    0,
                    FALSE,
                    DUPLICATE_SAME_ACCESS
                );


            if (DuplicateResult)
            {
                auto TargetProcessId = GetProcessIdFromHandle(DuplicatedHandle);

                if (TargetProcessId == CurrentProcessId)
                {
                    if (Results->Count < MAX_PROCESS_HANDLE_RESULTS)
                    {
                        auto Result = &Results->Items[Results->Count];


                        Result->ProcessId = OwnerProcessId;

                        Result->TargetProcessId = TargetProcessId;

                        Result->HandleValue = HandleEntry->HandleValue;

                        Result->GrantedAccess = HandleEntry->GrantedAccess;


                        utils::GetProcessName(
                            OwnerProcessId,
                            Result->ProcessName,
                            sizeof(Result->ProcessName)
                        );


                        Results->Count++;
                    }
                }
                CloseHandle(DuplicatedHandle);
            }
            CloseHandle(OwnerProcessHandle);
        }


        HeapFree(GetProcessHeap(), 0, Buffer);


        return TRUE;
    }



}