调戏GameGuard

  //反正也是白菜价了多发点少发点也无所谓，藏着掖着也没用。
jmp_code jmp_code_MmMapViewOfSection;
pjmp_code pjmp_code_MmMapViewOfSection;
#pragma PAGEDCODE
VOID Hook_MmMapViewOfSection()
{
  pjmp_code_MmMapViewOfSection=(pjmp_code)addr_MmMapViewOfSection;
  jmp_code_MmMapViewOfSection.E9=pjmp_code_MmMapViewOfSection->E9;
  jmp_code_MmMapViewOfSection.Addr=pjmp_code_MmMapViewOfSection->Addr;
  ULONG u_addr;
  __asm
  {
    push eax
    mov eax,My_MmMapViewOfSection
    mov u_addr,eax
    pop eax
  }
  PAGED_Open();
  pjmp_code_MmMapViewOfSection->E9=0xE9;
  pjmp_code_MmMapViewOfSection->Addr=(ULONG)(u_addr-addr_MmMapViewOfSection-5);
  PAGED_Exit();
}
ANSI_STRING str_a0;
ANSI_STRING str_a1;
ANSI_STRING str_a2;
ANSI_STRING str_a3;
ANSI_STRING str_a4;
ANSI_STRING str_a5;
ANSI_STRING str_a6;
ANSI_STRING str_a7;
ANSI_STRING str_a8;
ANSI_STRING str_a9;
ANSI_STRING str_a10;
ANSI_STRING str_a11;
ANSI_STRING str_a12;
WCHAR m_name[0x500];
PUNICODE_STRING p_name;
ULONG m_Process;
ULONG pFileObject;
#pragma PAGEDCODE
BOOL __stdcall b_MmMapViewOfSection(__in PVOID SectionHandle,__in PEPROCESS SectionEprocess)
{
  RtlInitString(&str_a0,(PCSZ)((ULONG)SectionEprocess+0x174));
  RtlInitString(&str_a1,_process_name1);
  RtlInitString(&str_a2,_process_name2);
  RtlInitString(&str_a3,_process_name3);
  RtlInitString(&str_a4,_process_name4);
  RtlInitString(&str_a5,_process_name5);
  RtlInitString(&str_a6,_process_name6);
  RtlInitString(&str_a7,_process_name7);
  RtlInitString(&str_a8,_process_name8);
  RtlInitString(&str_a9,_process_name9);
  RtlInitString(&str_a10,_process_name10);
  RtlInitString(&str_a11,_process_name11);
  RtlInitString(&str_a12,_process_name12);
  pFileObject=*((PULONG)((ULONG)SectionHandle+20));
    pFileObject=*((PULONG)pFileObject);
  pFileObject=*((PULONG)(pFileObject+36));
  if(pFileObject)
  {
    if( (RtlCompareString(&str_a1,&str_a0,TRUE)==0)||
      (RtlCompareString(&str_a2,&str_a0,TRUE)==0)||
      (RtlCompareString(&str_a3,&str_a0,TRUE)==0)||
      (RtlCompareString(&str_a4,&str_a0,TRUE)==0)||
      (RtlCompareString(&str_a5,&str_a0,TRUE)==0)||
      (RtlCompareString(&str_a6,&str_a0,TRUE)==0)||
      (RtlCompareString(&str_a7,&str_a0,TRUE)==0)||
      (RtlCompareString(&str_a8,&str_a0,TRUE)==0)||
      (RtlCompareString(&str_a9,&str_a0,TRUE)==0)||
      (RtlCompareString(&str_a10,&str_a0,TRUE)==0)||
      (RtlCompareString(&str_a11,&str_a0,TRUE)==0)||
      (RtlCompareString(&str_a12,&str_a0,TRUE)==0) )
    {
      p_name=(PUNICODE_STRING)m_name;
      Ob_QueryNameString((PVOID)pFileObject,(POBJECT_NAME_INFORMATION)p_name,0x500,&m_Process);
      //  KdPrint(("名:%wZ    :%Z\r\n",p_name,&str_ProcessName_2));
      if(wcsstr(p_name->Buffer,_NpggNt_Name))
      {
        //  KdPrint(("发现要卸载的模块!\r\n"));
        return FALSE;
      }
    }
  }
  return TRUE;
}
#pragma PAGEDCODE
VOID __declspec(naked) My_MmMapViewOfSection()
{
  __asm
  {
    mov esp_save,esp
    pushad
    pushfd
    mov eax,esp_save
    mov eax,[eax+8]
    push eax
    mov eax,esp_save
    mov eax,[eax+4]
    push eax
    call b_MmMapViewOfSection
    cmp eax,1
    jz __Game_Dll
    popfd
    popad
    mov eax,0xFFFFFFFF
    ret 28h
__Game_Dll:
    popfd
    popad
    mov edi,edi
    push ebp
    mov ebp,esp
    jmp jmp_MmMapViewOfSection
  }
}
#pragma PAGEDCODE
VOID UnHook_MmMapViewOfSection()
{
  PAGED_Open();
  pjmp_code_MmMapViewOfSection->E9=jmp_code_MmMapViewOfSection.E9;
  pjmp_code_MmMapViewOfSection->Addr=jmp_code_MmMapViewOfSection.Addr;
  PAGED_Exit();
}
//-----------------------------------------------------------
#pragma INITCODE
extern "C"
NTSTATUS DriverEntry(PDRIVER_OBJECT driver,PUNICODE_STRING unicode_string)
{
  //---------------------------------------
  GetWindowVersion_LoadDriver(driver);
  Get_NtOpenProcess();
  Get_NtOpenSection();
  Get_NtProtectVirtualMemroy();
  Get_NtReadVirtualMemory();
  Get_NtWriteVirtualMemory();
  Get_MmMapViewOfSection();
  Get_KeAttachProcess();
  Get_KeStackAttachProcess();
  Get_NtDeviceIoControlFile();
  Get_NtWriteFile();
  Get_IofCallDriver();
  Get_NtSetInformationThread();
  Get_KiAttachProcess();
  Get_KiMoveApcState();
  Hook_KiFastCall();
  Hook_MmMapViewOfSection();
  Hook_DebugPort();          //这里是多于的。
                SSDt_NtGetContextThread();
//-----------------------------------------------------
#pragma PAGEDCODE
NTSTATUS DisPathchIrp(PDEVICE_OBJECT device_object,PIRP irp)
{
  NTSTATUS status;
  ULONG uin;
  ULONG uout;
  ULONG ucontrol;
  PIO_STACK_LOCATION stirp=IoGetCurrentIrpStackLocation(irp);
  ULONG irpindex=stirp->MajorFunction;
  switch(irpindex)
  {
  case IRP_MJ_DEVICE_CONTROL:
    status=STATUS_SUCCESS;
    uin=stirp->Parameters.DeviceIoControl.InputBufferLength;
    uout=stirp->Parameters.DeviceIoControl.OutputBufferLength;
    ucontrol=stirp->Parameters.DeviceIoControl.IoControlCode;
    switch(ucontrol)
    {
    case Un_hook:
      DbgPrint("与应用程序通讯成功……\n");
      Get_PsActiveProcessHead();  //这里能google到，详细的Code就不贴了。
      __try
      {
        EnumPspCidTable();
      }
      __except(1)
      {
        DbgPrint("Error!\n");
      }
      break;
    }
    break;
    case IRP_MJ_CREATE:
      break;
    case IRP_MJ_READ:
      break;
    case IRP_MJ_WRITE:
      break;
    case IRP_MJ_CLOSE:
      
      break;
  }
  irp->IoStatus.Status=STATUS_SUCCESS;
  irp->IoStatus.Information=0;
  IoCompleteRequest(irp,IO_NO_INCREMENT);
  return STATUS_SUCCESS;
}