【原创】remove some info from pspcidtable WIN7X64

kenhuang

不废话直接防码
补充代码有网了:【分享】x64antidebug不触发PGhttp://bbs.pediy.com/showthread.php?p=1385028#post1385028
有个BUG如果移出的目标有线程退出那么我的系统线程就挂了目测是枚举函数的问题
这个我就不解决了退出不蓝屏
因为有了新的解决办法这个就扔掉了

#include"ntddk.h"
#include"commonfunc.h"
#defineIMAGE_FILENAME_OFFSET0x2e0
VOIDstartthread();
VOIDstopthread();
KEVENTevent;
HANDLEsystemthreadhandle;
KTIMERcleartimer={0};
KDPCcleardpc={0};
BOOLEANREMOVING=FALSE;
typedefstruct_HANDLE_TABLE_ENTRY{


union{
VOID*Object;
ULONG32ObAttributes;
PVOID64InfoTable;
ULONG64Value;


};

union{

ULONG32GrantedAccess;
struct{

UINT16GrantedAccessIndex;
UINT16CreatorBackTraceIndex;
UINT8_PADDING[0x4];
};
ULONG32NextFreeTableEntry;
};

}HANDLE_TABLE_ENTRY,*PHANDLE_TABLE_ENTRY;

typedefstruct_save_handlentry{
struct_save_handlentry*head;
PVOIDid;
charprocessname[17];
ULONG64value;
ULONG32GrantedAccess;
structHANDLE_TABLE_ENTRY*address;
struct_save_handlentry*next;
}_save_handlentry,*p_save_handlentry;

ULONG64SreachFunctionAddress(ULONG64uAddress,UCHAR*Signature,ULONGaddopcodelength,ULONGaddopcodedatasize);

p_save_handlentrycreatelist(char*processname){
ULONGi;

p_save_handlentryphead=(p_save_handlentry)ExAllocatePool(NonPagedPool,sizeof(_save_handlentry));
p_save_handlentryptail=phead;
ptail->next=NULL;
p_save_handlentrypnew=(p_save_handlentry)ExAllocatePool(NonPagedPool,sizeof(_save_handlentry));
memcpy(&pnew->processname,processname,16);
pnew->address=0;
pnew->id=0;
pnew->value=0;
pnew->GrantedAccess=0;
pnew->head=NULL;
ptail->next=pnew;
pnew->next=NULL;
ptail->head=NULL;
returnphead;

}
//插入链表
p_save_handlentryinsertlist(char*processname,ULONGGrantedAccess,ULONG64value,PVOIDid,PHANDLE_TABLE_ENTRYadress,p_save_handlentryphead){
p_save_handlentryp=phead->next;

while(p!=NULL)
{
if(p->next==NULL){
break;
}
p=p->next;
}

p_save_handlentrypnew=(p_save_handlentry)ExAllocatePool(NonPagedPool,sizeof(_save_handlentry));
memcpy(&pnew->processname,processname,16);

pnew->GrantedAccess=GrantedAccess;
pnew->id=id;
pnew->value=value;
pnew->address=adress;
p->next=pnew;
pnew->next=NULL;
pnew->head=p;
returnpnew;
}
p_save_handlentryquerylist(p_save_handlentryphead,ULONG64id){
p_save_handlentryp=phead->next;
while(p!=NULL)
{

if(p->id==id){

returnp;
}

p=p->next;
}


returnNULL;
}
//删除节点
voiddeletelist(p_save_handlentrypclid){
p_save_handlentryp,pp;
if(pclid->head!=NULL){//头部
p=pclid->head;
pp=pclid->next;


if(pp==NULL){//最后节点
p->next=NULL;
ExFreePool(pclid);

return;
}


p->next=pp;//不是最后节点
pp->head=p;
ExFreePool(pclid);
return;
}


}





typedefNTSTATUS(__fastcall*pfnEnumObjectTable)(PVOID64HANDLETABLE,PVOIDCALLback,ULONG64unKonw);
NTKERNELAPICHAR*PsGetProcessImageFileName(PEPROCESSProcess);
NTKERNELAPINTSTATUSPsLookupProcessByProcessId(HANDLEProcessId,PEPROCESS*Process);
NTKERNELAPINTSTATUSPsLookupThreadByThreadId(HANDLEId,PETHREAD*Thread);
NTKERNELAPIPEPROCESSIoThreadToProcess(PETHREADThread);
pfnEnumObjectTableEnumObjectTablex=0;;
PVOID64PspCidTable=0;
NTSTATUSgetenumhandletablefunc()


{
UCHARopcode[5]={0x89,0x6c,0x24,0x30,0xe8};
UCHARopcode1[5]={0xdc,0x48,0x8b,0xd1,0x48};
UNICODE_STRING64ObFindHandleForObjectsign;
ULONG64temp64=0;
NTSTATUSstate=STATUS_SUCCESS;

RtlInitUnicodeString(&ObFindHandleForObjectsign,L"ObFindHandleForObject");//ObFindHandleForObjectPAGE0000000140319DB0000000B40000004800000028R......
temp64=(ULONG64)MmGetSystemRoutineAddress(&ObFindHandleForObjectsign);

if(!MmIsAddressValid(temp64))
returnstate;
EnumObjectTablex=(pfnEnumObjectTable)SreachFunctionAddress(temp64,opcode,1,5);
PspCidTable=(PVOID64)SreachFunctionAddress(&ampsLookupProcessByProcessId,opcode1,3,7);
PspCidTable=*(PVOID64*)PspCidTable;

if(!MmIsAddressValid(EnumObjectTablex)||!MmIsAddressValid(PspCidTable)){

DbgPrint("cantgetEnumObjectTablexorPspCidTable\n");
}

DbgPrint("Supergameprotectstart~\n");

}
p_save_handlentrymainphead=NULL;
PVOID64psidprocessobject=0;
PVOID64pscidkthreadbject=0;
ULONG64passmaska=TRUE;
#definede_o-10
#definede_sde_o*1000
LARGE_INTEGERmyxx;

VOIDclearDEBUGTOOL(){
myxx.QuadPart=de_s;
myxx.QuadPart*=2000;
while(passmaska==TRUE)
{

KeDelayExecutionThread(KernelMode,0,&myxx);
if(REMOVING)
continue;
enumtable(2);

if(psidprocessobject!=0){
DbgPrint("clearpsidprocessobject%p",*(ULONG64*)psidprocessobject);
*(ULONG64*)psidprocessobject=0;
DbgPrint("clearpsidprocessobject%p",*(ULONG64*)psidprocessobject);
psidprocessobject=0;

}
DbgPrint("clearing...");
if(pscidkthreadbject!=0){
DbgPrint("clearpscidkthreadbject%p",*(ULONG64*)pscidkthreadbject);
*(ULONG64*)pscidkthreadbject=0;
DbgPrint("clearpscidkthreadbject%p",*(ULONG64*)pscidkthreadbject);
pscidkthreadbject=0;


}
continue;
}
DbgPrint("ending...");
KeSetEvent(&event,0,TRUE);
}
BOOLEANremovdebugtoolhandle(PHANDLE_TABLE_ENTRYobject,PHANDLEhandle,ULONG64Unkonw){
ULONG64Pobject;
ULONG64object_header;
ULONG32object_type;

p_save_handlentrypaddress;

Pobject=(object->Value)&~7;
object_header=Pobject-0x30;//getobjectheader

object_type=(ULONG32)*(UINT8*)(object_header+0x18);//pspcidtableobject_header

if(!MmIsAddressValid(Pobject))
{
returnFALSE;//istrue

}



if(object_type==7){

if(strstr(PsGetProcessImageFileName(Pobject),"天网系统")!=NULL||strstr(PsGetProcessImageFileName(Pobject),"cheatengine")!=NULL||strstr(PsGetProcessImageFileName(Pobject),"ollyice")!=NULL){
paddress=insertlist(Pobject+IMAGE_FILENAME_OFFSET,object->GrantedAccess,object->Value,handle,&object->Value,mainphead);

DbgPrint("processislook~");

psidprocessobject=&object->Value;

}
returnFALSE;
}

if(object_type==8){

ULONG64tempprocess;

tempprocess=IoThreadToProcess(Pobject);
if(strstr(PsGetProcessImageFileName(tempprocess),"天网系统")!=NULL||strstr(PsGetProcessImageFileName(tempprocess),"cheatengine")!=NULL||strstr(PsGetProcessImageFileName(tempprocess),"ollyice")!=NULL){
DbgPrint("threadislook~");
paddress=insertlist(Pobject+IMAGE_FILENAME_OFFSET,object->GrantedAccess,object->Value,handle,&object->Value,mainphead);


pscidkthreadbject=&object->Value;

}
returnFALSE;
}







returnFALSE;
}



BOOLEANremovepspcidtabl(HANDLEp){

if(PspCidTable==0||EnumObjectTablex==0){
getenumhandletablefunc();
}

if(mainphead==NULL){
mainphead=createlist("system");
}
EnumObjectTablex(PspCidTable,removdebugtoolhandle,p);






}

PCREATE_PROCESS_NOTIFY_ROUTINEcallback(HANDLEprid,HANDLEpid,BOOLEANcreate){
ULONG64EPROCESS;
PHANDLE_TABLE_ENTRYphdt;
p_save_handlentrytempsave;
EPROCESS=IoGetCurrentProcess();
if(!create&&(strstr(PsGetProcessImageFileName(EPROCESS),"天网系统")!=NULL||strstr(PsGetProcessImageFileName(EPROCESS),"cheatengine")!=NULL||strstr(PsGetProcessImageFileName(EPROCESS),"ollyice")!=NULL)){
REMOVING=TRUE;

tempsave=querylist(mainphead,pid);
if(tempsave!=0){
phdt=tempsave->address;



//phdt->GrantedAccess=tempsave->GrantedAccess;
phdt->Value=tempsave->value;
DbgPrint("pid%dpt:%pphdt:%p",tempsave->id,tempsave->address,phdt->Object);
//deletelist(tempsave);
stopthread();
startthread();
}
//ObDereferenceObject(leprocess);

REMOVING=FALSE;
}


}
PCREATE_THREAD_NOTIFY_ROUTINEcallback2(HANDLEprocessid,HANDLEthreadid,BOOLEANcreate){
ULONG64EPROCESS;
PHANDLE_TABLE_ENTRYphdt;
p_save_handlentrytempsave;
EPROCESS=IoGetCurrentProcess();

if(!create&&(strstr(PsGetProcessImageFileName(EPROCESS),"天网系统")!=NULL||strstr(PsGetProcessImageFileName(EPROCESS),"cheatengine")!=NULL||strstr(PsGetProcessImageFileName(EPROCESS),"ollyice")!=NULL)){

REMOVING=TRUE;
tempsave=querylist(mainphead,threadid);
if(tempsave!=0){
phdt=tempsave->address;

//phdt->GrantedAccess=tempsave->GrantedAccess;
phdt->Value=tempsave->value;
DbgPrint("tid%dpt:%pphdt:%p",tempsave->id,tempsave->address,phdt->Object);
//deletelist(tempsave);
stopthread();
startthread();
}

REMOVING=FALSE;
}



}



VOIDstartthread(){
KeInitializeEvent(
&event,
SynchronizationEvent,//SynchronizationEvent为同步事件
FALSE//当是TRUE时初始化事件是有信号状态.，当是FALSE时初始化事件是没信号状态,如果此处为TRUE,则为有信号状态，KeWaitForSingleObject会直接通过，此时需要调用KeResetEvent来设置为无信号
);

PsCreateSystemThread(&systemthreadhandle,THREAD_ALL_ACCESS,NULL,NULL,NULL,clearDEBUGTOOL,NULL);



}

VOIDstopthread(){
ZwClose(systemthreadhandle);
}


/////////////////////////////////////
VOIDclearprocessinformationRoutine(
_In_struct_KDPC*Dpc,
_In_opt_PVOIDDeferredContext,
_In_opt_PVOIDSystemArgument1,
_In_opt_PVOIDSystemArgument2
)
{
UNREFERENCED_PARAMETER(Dpc);
UNREFERENCED_PARAMETER(DeferredContext);
UNREFERENCED_PARAMETER(SystemArgument1);
UNREFERENCED_PARAMETER(SystemArgument2);

LARGE_INTEGERlTime={0};
ULONGulMicroSecond=0;
KIRQLirql;
//将定时器的时间设置为500ms
ulMicroSecond=5000000;
//将32位整数转化成64位整数
lTime=RtlConvertLongToLargeInteger(-10*ulMicroSecond);






enumtable(2);






KeSetTimer(&cleartimer,lTime,&cleardpc);
}
BOOLEANbTimerStart=FALSE;
VOIDstartdpc(){
//DPC定时器是否开启标志
LARGE_INTEGERlTime={0};
ULONGulMicroSecond=0;

//初始化定时器
KeInitializeTimer(&cleartimer);

//初始化DPC
KeInitializeDpc(&cleardpc,clearprocessinformationRoutine,NULL);
//开始定时器
//将定时器的时间设置为500ms
ulMicroSecond=5000000;
//将32位整数转化成64位整数
lTime=RtlConvertLongToLargeInteger(-10*ulMicroSecond);
bTimerStart=KeSetTimer(&cleartimer,lTime,&cleardpc);
if(bTimerStart)
{
DbgPrint("定时器开启成功\n");
}

}
VOIDstopdpc(){
if(bTimerStart)
KeCancelTimer(&cleartimer);

}
//////////////////////////////////////////



voidprotectprocessforpspcidtable(){

if(mainphead==NULL)
{
mainphead=createlist("system");
}


PsSetCreateProcessNotifyRoutine(callback,FALSE);



PsSetCreateThreadNotifyRoutine(callback2);

//startdpc();


startthread();

}
voidunprotectprocessforpspcidtable(){
passmaska=FALSE;

KeWaitForSingleObject(&event,Executive,KernelMode,TRUE,0);
PsSetCreateProcessNotifyRoutine(callback,TRUE);

PsRemoveCreateThreadNotifyRoutine(callback2);
//stopdpc();
stopthread();
}
voidenumtable(PHANDLEhandle){

if(PspCidTable==0||EnumObjectTablex==0){
getenumhandletablefunc();
}

if(mainphead==NULL){
mainphead=createlist("system");
}
EnumObjectTablex(PspCidTable,removdebugtoolhandle,handle);

}