x64 antidebug 不触发PG 补充代码

zjh7272

先说antiantidebug
都知道 32位的驱动保护  不用VT说白了就是 HOOK过来 HOOK过去  比的是谁的 钩子深  谁的 钩子更多~~~~
然而 64位呢 很多保护 例如TP/HP/HS 基本就是驱动几个callbacks 应用层 几个钩子 反调试  模拟一场等等    我的 PASS方法呢 例如TP钩子 KIuserdispatcherException 这个 钩子的恢复方法 直接恢复 或者挂钩 游戏会秒掉 因为他自己处理了自己的异常,但是实际 他里面并没有用到检测硬件断点~~~HOOK 方式 过滤异常是他的就跳到他里面 提前计算他的钩子函数 ，不是就自己处理~~(HOOK注意堆栈和标志位)   
其他的就是干线程和忽略 模拟异常了  忽略模拟异常的方式 HOOK OD WaitDebugEvent 过滤000400..07.....随便改一个 然后OK~~~~

最后ANTIDEBUG  ~~~
X64没PASS pg 也没用VT技术的   比较难防御~！~~
枚举所有进程(EPROCESS链) 枚举句柄表 所有句柄项 法相TPYEININDEX为11(win7)的直接 抹掉句柄 当然得正常一点儿的抹掉先设置属性可关闭等等最后  KISTACKattachprocess NTclose(TA的 代码里面有) 出现的效果就是 没法调试了~~ 代码我实现了  没网 所以就不发了 等有网了发把~~
还可以这样阻止搜索内存 打开进程~~~~

放出源码：

有个BUG  如果 移出的目标有线程退出  那么 我的 系统线程就挂了   目测是枚举函数的 问题
这个   我就 不解决了   退出不蓝屏
因为 有 了新的 解决办法  这个 就扔掉了

1. #include "ntddk.h"
   
2. #include "commonfunc.h"
   
3. #define IMAGE_FILENAME_OFFSET 0x2e0
   
4. VOID startthread();
   
5. VOID stopthread();
   
6. KEVENT event;
   
7. HANDLE systemthreadhandle;
   
8. KTIMER cleartimer= { 0 };      
   
9. KDPC cleardpc = { 0 };
   
10. BOOLEAN REMOVING = FALSE;
    
11. typedef struct _HANDLE_TABLE_ENTRY{
    
12.   union{
    
13.     VOID* Object;
    
14.     ULONG32 ObAttributes;
    
15.     PVOID64 InfoTable;
    
16.     ULONG64 Value;
    
17.    };
    
18. 
    
19.   union{
    
20.     ULONG32 GrantedAccess;
    
21.     struct{
    
22.       UINT16  GrantedAccessIndex;
    
23.       UINT16 CreatorBackTraceIndex;
    
24.       UINT8  _PADDING[0x4];
    
25.     };
    
26.     ULONG32  NextFreeTableEntry;
    
27.   };
    
28. 
    
29. }HANDLE_TABLE_ENTRY, *PHANDLE_TABLE_ENTRY;
    
30. 
    
31. typedef struct _save_handlentry{
    
32.   struct _save_handlentry*head;
    
33.   PVOID id;
    
34.   char processname[17];
    
35.   ULONG64 value;
    
36.   ULONG32 GrantedAccess;
    
37.   struct HANDLE_TABLE_ENTRY*address;
    
38.   struct _save_handlentry*next;
    
39. }_save_handlentry, *p_save_handlentry;
    
40. 
    
41. ULONG64 SreachFunctionAddress(ULONG64 uAddress, UCHAR *Signature, ULONG addopcodelength, ULONG addopcodedatasize);
    
42. 
    
43. p_save_handlentry createlist(char*processname){
    
44.   ULONG i;
    
45.   
    
46.   p_save_handlentry phead = (p_save_handlentry) ExAllocatePool(NonPagedPool,sizeof(_save_handlentry));
    
47.   p_save_handlentry ptail = phead;
    
48.   ptail->next = NULL;
    
49.   p_save_handlentry pnew = (p_save_handlentry)ExAllocatePool(NonPagedPool, sizeof(_save_handlentry));
    
50.   memcpy(&pnew->processname, processname, 16);
    
51.   pnew->address = 0;
    
52.   pnew->id = 0;
    
53.   pnew->value = 0;
    
54.   pnew->GrantedAccess = 0;
    
55.   pnew->head = NULL;
    
56.   ptail->next = pnew;
    
57.   pnew->next = NULL;
    
58.   ptail->head = NULL;
    
59.   return phead;
    
60. 
    
61. }
    
62. // 插入链表
    
63. p_save_handlentry insertlist(char*processname, ULONG GrantedAccess, ULONG64 value, PVOID id, PHANDLE_TABLE_ENTRY adress, p_save_handlentry phead){
    
64.   p_save_handlentry p = phead->next;
    
65. 
    
66.   while (p != NULL)
    
67.   {
    
68.     if (p->next == NULL){
    
69.       break;
    
70.     }
    
71.     p = p->next;
    
72.   }
    
73. 
    
74.   p_save_handlentry pnew = (p_save_handlentry)ExAllocatePool(NonPagedPool, sizeof(_save_handlentry));
    
75.   memcpy(&pnew->processname, processname, 16);
    
76. 
    
77.   pnew->GrantedAccess = GrantedAccess;
    
78.   pnew->id = id;
    
79.   pnew->value = value;
    
80.   pnew->address = adress;
    
81.   p->next = pnew;
    
82.   pnew->next = NULL;
    
83.   pnew->head = p;
    
84.   return pnew;
    
85. }
    
86. p_save_handlentry querylist(p_save_handlentry phead, ULONG64 id){
    
87.   p_save_handlentry p = phead->next;
    
88.   while (p != NULL)
    
89.   {
    
90. 
    
91.     if (p->id == id){
    
92. 
    
93.       return p;
    
94.     }
    
95. 
    
96.     p = p->next;
    
97.   }
    
98. 
    
99. 
    
100.   return NULL;
     
101. }
     
102. 
     
103. //删除节点
     
104. void deletelist(p_save_handlentry pclid){
     
105.   p_save_handlentry p, pp;
     
106.   if (pclid->head != NULL){//头部
     
107.     p = pclid->head;
     
108.     pp = pclid->next;
     
109. 
     
110.     if (pp == NULL){//最后节点
     
111.       p->next = NULL;
     
112.       ExFreePool(pclid);
     
113.       return;
     
114.     }
     
115.     p->next = pp;//不是最后节点
     
116.     pp->head = p;
     
117.     ExFreePool(pclid);
     
118.     return;
     
119.   }
     
120. }
     
121. 
     
122. 
     
123. typedef NTSTATUS(__fastcall * pfnEnumObjectTable)(PVOID64 HANDLETABLE, PVOID CALLback, ULONG64 unKonw);
     
124. NTKERNELAPI CHAR* PsGetProcessImageFileName(PEPROCESS Process);
     
125. NTKERNELAPI NTSTATUS PsLookupProcessByProcessId(HANDLE ProcessId, PEPROCESS *Process);
     
126. NTKERNELAPI NTSTATUS PsLookupThreadByThreadId(HANDLE Id, PETHREAD *Thread);
     
127. NTKERNELAPI PEPROCESS IoThreadToProcess(PETHREAD Thread);
     
128. pfnEnumObjectTable EnumObjectTablex = 0;;
     
129. PVOID64 PspCidTable=0;
     
130. NTSTATUS getenumhandletablefunc()
     
131. {
     
132.   UCHAR  opcode[5] = { 0x89, 0x6c, 0x24, 0x30, 0xe8 };
     
133.   UCHAR  opcode1[5] = { 0xdc, 0x48, 0x8b, 0xd1, 0x48 };
     
134.   UNICODE_STRING64 ObFindHandleForObjectsign;
     
135.   ULONG64 temp64 = 0;
     
136.   NTSTATUS state = STATUS_SUCCESS;
     
137. 
     
138.   RtlInitUnicodeString(&ObFindHandleForObjectsign, L"ObFindHandleForObject");//ObFindHandleForObject PAGE 0000000140319DB0 000000B4 00000048 00000028 R . . . . . .
     
139.   temp64 = (ULONG64)MmGetSystemRoutineAddress(&ObFindHandleForObjectsign);
     
140. 
     
141.   if (!MmIsAddressValid(temp64))
     
142.     return state;
     
143.   EnumObjectTablex = (pfnEnumObjectTable)SreachFunctionAddress(temp64, opcode,1,5);
     
144.   PspCidTable = (PVOID64)SreachFunctionAddress(&PsLookupProcessByProcessId, opcode1, 3, 7);
     
145.   PspCidTable = *(PVOID64*)PspCidTable;
     
146. 
     
147.   if (!MmIsAddressValid(EnumObjectTablex) || !MmIsAddressValid(PspCidTable)){
     
148. 
     
149.     DbgPrint("cant get EnumObjectTablex or  PspCidTable  \n");
     
150.   }
     
151.    
     
152.   DbgPrint("Super game protect start~\n");
     
153.   
     
154. }
     
155. p_save_handlentry mainphead = NULL;
     
156. PVOID64 psidprocessobject = 0;
     
157. PVOID64 pscidkthreadbject = 0;
     
158. ULONG64 passmaska = TRUE;
     
159. #define de_o -10
     
160. #define de_s de_o*1000
     
161. LARGE_INTEGER myxx;
     
162. 
     
163. VOID clearDEBUGTOOL(){
     
164.   myxx.QuadPart = de_s;
     
165.   myxx.QuadPart *= 2000;
     
166.   while (passmaska==TRUE)
     
167.   {
     
168.   
     
169.     KeDelayExecutionThread(KernelMode, 0, &myxx);
     
170.     if (REMOVING)
     
171.       continue;
     
172.     enumtable(2);
     
173.    
     
174.     if (psidprocessobject!=0 ){
     
175.       DbgPrint("clear psidprocessobject %p", *(ULONG64*)psidprocessobject);
     
176.       *(ULONG64*)psidprocessobject = 0;
     
177.       DbgPrint("clear psidprocessobject %p", *(ULONG64*)psidprocessobject);
     
178.       psidprocessobject = 0;
     
179.       
     
180.     }  
     
181.     DbgPrint("clearing...");
     
182.     if (pscidkthreadbject != 0){
     
183.       DbgPrint("clear pscidkthreadbject %p", *(ULONG64*)pscidkthreadbject);
     
184.       *(ULONG64*)pscidkthreadbject = 0;
     
185.       DbgPrint("clear pscidkthreadbject %p", *(ULONG64*)pscidkthreadbject);
     
186.       pscidkthreadbject = 0;
     
187.    
     
188. 
     
189.     }
     
190.     continue;
     
191.   }
     
192.   DbgPrint("ending...");
     
193.   KeSetEvent(&event, 0, TRUE);
     
194. }
     
195. BOOLEAN removdebugtoolhandle(PHANDLE_TABLE_ENTRY object, PHANDLE handle, ULONG64 Unkonw){
     
196.   ULONG64 Pobject;
     
197.   ULONG64 object_header;
     
198.   ULONG32 object_type;
     
199. 
     
200.   p_save_handlentry paddress;
     
201.   
     
202.   Pobject = (object->Value)&~7;
     
203.   object_header = Pobject - 0x30;//getobjectheader
     
204.   
     
205.   object_type = (ULONG32)*(UINT8*)(object_header + 0x18);//pspcidtable object_header
     
206.   
     
207.   if (!MmIsAddressValid(Pobject))
     
208.     {
     
209.     return FALSE;//is true
     
210.   
     
211.   }
     
212.   
     
213. 
     
214.   
     
215.   if ( object_type == 7 ){
     
216.   
     
217.     if (strstr(PsGetProcessImageFileName(Pobject), "天网系统") != NULL || strstr(PsGetProcessImageFileName(Pobject), "cheatengine") != NULL || strstr(PsGetProcessImageFileName(Pobject), "ollyice") != NULL){
     
218.       paddress = insertlist(Pobject + IMAGE_FILENAME_OFFSET, object->GrantedAccess, object->Value, handle, &object->Value, mainphead);
     
219.    
     
220.       DbgPrint("process is look~");
     
221. 
     
222.       psidprocessobject = &object->Value;
     
223. 
     
224.     }
     
225.     return FALSE;
     
226.   }
     
227.   
     
228.   if ( object_type == 8 ){
     
229.   
     
230.     ULONG64 tempprocess;
     
231. 
     
232.     tempprocess = IoThreadToProcess(Pobject);
     
233.       if (strstr(PsGetProcessImageFileName(tempprocess), "天网系统") != NULL || strstr(PsGetProcessImageFileName(tempprocess), "cheatengine") != NULL || strstr(PsGetProcessImageFileName(tempprocess), "ollyice") != NULL ){
     
234.         DbgPrint("thread is look~");
     
235.         paddress = insertlist(Pobject + IMAGE_FILENAME_OFFSET, object->GrantedAccess, object->Value, handle, &object->Value, mainphead);
     
236.         pscidkthreadbject = &object->Value;
     
237.     }
     
238.     return FALSE;
     
239.   }
     
240.   return FALSE;
     
241. }
     
242. 
     
243. 
     
244. 
     
245. BOOLEAN removepspcidtabl(HANDLE p){
     
246.   
     
247.   if (PspCidTable == 0 || EnumObjectTablex == 0){
     
248.     getenumhandletablefunc();
     
249.   }
     
250. 
     
251.   if (mainphead==NULL){
     
252.     mainphead = createlist("system");
     
253.   }
     
254.   EnumObjectTablex(PspCidTable, removdebugtoolhandle, p);
     
255. }
     
256. 
     
257. 
     
258. PCREATE_PROCESS_NOTIFY_ROUTINE callback(HANDLE prid, HANDLE pid, BOOLEAN create){
     
259.   ULONG64 EPROCESS;
     
260.   PHANDLE_TABLE_ENTRY phdt;
     
261.   p_save_handlentry tempsave;
     
262.   EPROCESS = IoGetCurrentProcess();
     
263.   if (!create && (strstr(PsGetProcessImageFileName(EPROCESS), "天网系统") != NULL || strstr(PsGetProcessImageFileName(EPROCESS), "cheatengine") != NULL || strstr(PsGetProcessImageFileName(EPROCESS), "ollyice") != NULL)){
     
264.     REMOVING = TRUE;
     
265.    
     
266.     tempsave = querylist(mainphead, pid);
     
267.     if (tempsave != 0){
     
268.       phdt = tempsave->address;
     
269.       //phdt->GrantedAccess = tempsave->GrantedAccess;
     
270.       phdt->Value = tempsave->value;
     
271.       DbgPrint("pid %d pt:%p phdt:%p", tempsave->id, tempsave->address, phdt->Object);
     
272.       //deletelist(tempsave);
     
273.       stopthread();
     
274.       startthread();
     
275.     }
     
276.     //  ObDereferenceObject(leprocess);
     
277.    
     
278.     REMOVING = FALSE;
     
279.   }
     
280.   
     
281. 
     
282. }
     
283. PCREATE_THREAD_NOTIFY_ROUTINE callback2(HANDLE processid, HANDLE threadid, BOOLEAN create){
     
284.   ULONG64 EPROCESS;
     
285.   PHANDLE_TABLE_ENTRY phdt;
     
286.   p_save_handlentry tempsave;
     
287.   EPROCESS = IoGetCurrentProcess();
     
288. 
     
289.   if(!create && (strstr(PsGetProcessImageFileName(EPROCESS), "天网系统") != NULL || strstr(PsGetProcessImageFileName(EPROCESS), "cheatengine") != NULL || strstr(PsGetProcessImageFileName(EPROCESS), "ollyice") != NULL)){
     
290.    
     
291.     REMOVING = TRUE;
     
292.     tempsave = querylist(mainphead, threadid);
     
293.     if (tempsave != 0){
     
294.       phdt = tempsave->address;
     
295.    
     
296.       //phdt->GrantedAccess = tempsave->GrantedAccess;
     
297.       phdt->Value = tempsave->value;
     
298.       DbgPrint("tid %d pt:%p phdt:%p", tempsave->id, tempsave->address, phdt->Object);
     
299.     //  deletelist(tempsave);
     
300.       stopthread();
     
301.       startthread();
     
302.     }
     
303. 
     
304.     REMOVING = FALSE;
     
305.   }
     
306.    
     
307. }
     
308. 
     
309. 
     
310. VOID startthread(){
     
311.   KeInitializeEvent(
     
312.     &event,
     
313.     SynchronizationEvent,//SynchronizationEvent为同步事件  
     
314.     FALSE//  当是TRUE 时初始化事件是有信号状态.，当是FALSE时初始化事件是没信号状态,如果此处为TRUE,则为有信号状态，KeWaitForSingleObject会直接通过，此时需要调用KeResetEvent来设置为无信号  
     
315.     );
     
316.   PsCreateSystemThread(&systemthreadhandle, THREAD_ALL_ACCESS, NULL, NULL, NULL, clearDEBUGTOOL, NULL);
     
317. }
     
318. 
     
319. VOID stopthread(){
     
320.   ZwClose(systemthreadhandle);
     
321. }
     
322. 
     
323. 
     
324. /////////////////////////////////////
     
325. VOID clearprocessinformationRoutine(
     
326.   _In_      struct _KDPC *Dpc,
     
327.   _In_opt_  PVOID DeferredContext,
     
328.   _In_opt_  PVOID SystemArgument1,
     
329.   _In_opt_  PVOID SystemArgument2
     
330.   )
     
331. {
     
332.   UNREFERENCED_PARAMETER(Dpc);
     
333.   UNREFERENCED_PARAMETER(DeferredContext);
     
334.   UNREFERENCED_PARAMETER(SystemArgument1);
     
335.   UNREFERENCED_PARAMETER(SystemArgument2);
     
336. 
     
337.   LARGE_INTEGER lTime = { 0 };
     
338.   ULONG ulMicroSecond = 0;
     
339.   KIRQL irql;
     
340.   //将定时器的时间设置为500ms
     
341.   ulMicroSecond = 5000000;
     
342.   //将32位整数转化成64位整数
     
343.   lTime = RtlConvertLongToLargeInteger(-10 * ulMicroSecond);
     
344. 
     
345.     enumtable(2);
     
346.   
     
347.   KeSetTimer(&cleartimer, lTime, &cleardpc);
     
348. }
     
349. 
     
350. BOOLEAN bTimerStart = FALSE;
     
351. VOID startdpc(){
     
352.   // DPC定时器是否开启标志
     
353.   LARGE_INTEGER lTime = { 0 };
     
354.   ULONG ulMicroSecond = 0;
     
355. 
     
356.   // 初始化定时器
     
357.   KeInitializeTimer(&cleartimer);
     
358. 
     
359.   // 初始化DPC
     
360.   KeInitializeDpc(&cleardpc, clearprocessinformationRoutine, NULL);
     
361.   // 开始定时器
     
362.   //将定时器的时间设置为500ms
     
363.   ulMicroSecond = 5000000;
     
364.   //将32位整数转化成64位整数
     
365.   lTime = RtlConvertLongToLargeInteger(-10 * ulMicroSecond);
     
366.   bTimerStart = KeSetTimer(&cleartimer, lTime, &cleardpc);
     
367.   if (bTimerStart)
     
368.   {
     
369.     DbgPrint("定时器开启成功\n");
     
370.   }
     
371. 
     
372. }
     
373. VOID stopdpc(){
     
374.   if (bTimerStart)
     
375.     KeCancelTimer(&cleartimer);
     
376. 
     
377. }
     
378. 
     
379. 
     
380. void  protectprocessforpspcidtable(){
     
381. 
     
382.   if (mainphead==NULL)
     
383.   {
     
384.     mainphead = createlist("system");
     
385.   }
     
386. 
     
387. 
     
388.   PsSetCreateProcessNotifyRoutine(callback, FALSE);
     
389. 
     
390.   PsSetCreateThreadNotifyRoutine(callback2);
     
391. 
     
392.   //  startdpc();
     
393. 
     
394.     startthread();
     
395. 
     
396. }
     
397. 
     
398. void  unprotectprocessforpspcidtable(){
     
399.   passmaska = FALSE;
     
400. 
     
401.   KeWaitForSingleObject(&event, Executive, KernelMode, TRUE, 0);
     
402.   PsSetCreateProcessNotifyRoutine(callback, TRUE);
     
403.   
     
404.   PsRemoveCreateThreadNotifyRoutine(callback2);
     
405.   //stopdpc();
     
406.   stopthread();
     
407. }
     
408. 
     
409. void enumtable(PHANDLE handle){
     
410. 
     
411.   if (PspCidTable == 0 || EnumObjectTablex == 0){
     
412.     getenumhandletablefunc();
     
413.   }
     
414. 
     
415.   if (mainphead == NULL){
     
416.     mainphead = createlist("system");
     
417.   }
     
418.   EnumObjectTablex(PspCidTable, removdebugtoolhandle, handle);
     
419. }

复制代码