78 lines
1.9 KiB
C++
78 lines
1.9 KiB
C++
#include "driver_func.h"
|
|
#include "kdmapper/kd_driver.h"
|
|
#include "kdmapper/kdmapper.h"
|
|
#include "Anti_Cheat_Driver.h"
|
|
|
|
|
|
typedef ULONG(WINAPI* NtConvertBetweenAuxiliaryCounterAndPerformanceCounterProc)(char a1, PVOID a2, PVOID a3, PVOID a4);
|
|
NtConvertBetweenAuxiliaryCounterAndPerformanceCounterProc gNtConvertBetweenAuxiliary = NULL;
|
|
|
|
HANDLE null_device_handle;
|
|
|
|
OSVERSIONINFOW os{ 0 };
|
|
|
|
namespace driver_func
|
|
{
|
|
auto init() -> BOOL
|
|
{
|
|
os = utils::GetVersion();
|
|
if (os.dwBuildNumber == 7600 || os.dwBuildNumber == 7601)
|
|
{
|
|
null_device_handle = CreateFileA(XorStr("\\\\.\\Nul"), GENERIC_READ | GENERIC_WRITE, 0, 0, OPEN_EXISTING, FILE_ATTRIBUTE_SYSTEM, 0);
|
|
if (null_device_handle != NULL && null_device_handle != INVALID_HANDLE_VALUE)
|
|
return TRUE;
|
|
}
|
|
else if (os.dwBuildNumber >= 14393)
|
|
{
|
|
HMODULE ntdll = GetModuleHandleA("ntdll.dll");
|
|
if (ntdll)
|
|
{
|
|
if (gNtConvertBetweenAuxiliary == nullptr)
|
|
{
|
|
gNtConvertBetweenAuxiliary = (NtConvertBetweenAuxiliaryCounterAndPerformanceCounterProc)
|
|
GetProcAddress(ntdll, XorStr("NtConvertBetweenAuxiliaryCounterAndPerformanceCounter"));
|
|
|
|
return gNtConvertBetweenAuxiliary ? TRUE : FALSE;
|
|
}
|
|
}
|
|
}
|
|
|
|
return FALSE;
|
|
}
|
|
|
|
auto kdmaper_load_driver(PDWORD status) -> BOOL
|
|
{
|
|
if (kd_driver::Load(status))
|
|
{
|
|
if (kdmapper::MapDriver(kd_driver::iqvw64e_device_handle, kd_driver::ntoskrnlbase, (char*)Anti_Cheat_Driver))
|
|
{
|
|
kd_driver::Unload();
|
|
|
|
*status = 0;
|
|
|
|
return TRUE;
|
|
}
|
|
}
|
|
|
|
return FALSE;
|
|
}
|
|
|
|
auto driver_comm_func(LPVOID Buf, DWORD bufSize)->BOOL
|
|
{
|
|
if (os.dwBuildNumber == 7600 || os.dwBuildNumber == 7601)
|
|
{
|
|
DWORD retlen = 0;
|
|
return DeviceIoControl(null_device_handle, 0x12345678, Buf, bufSize, Buf, bufSize, &retlen, NULL);
|
|
}
|
|
else if (os.dwBuildNumber >= 14393)
|
|
{
|
|
ULONG64 xxx = 0;
|
|
auto data = (ULONG64)Buf;
|
|
gNtConvertBetweenAuxiliary(1, &data, (PVOID)&xxx, NULL);
|
|
return TRUE;
|
|
}
|
|
|
|
return FALSE;
|
|
}
|
|
|
|
} |