c/c++游戏逆向驱动开发，游戏辅助保护盾

功能介绍:

1.降低游戏权限，提升游戏权限，禁止游戏后台截图。

2.保护进程，隐藏进程，进程内存不被读取。

如图：

 部分功能展示:

//程序降权
NTSTATUS ChangeHandleAccessState(ULONG ulProcessId, ULONG ulProtectPid)
{

    PEPROCESS EProcess = NULL, ProtectEProcess = NULL;
    ULONG_PTR Handle = 0;
    PHANDLE_TABLE_ENTRY Entry = NULL;
    //HANDLE pointed addr
    PVOID Object = NULL;
    POBJECT_TYPE ObjectType = NULL;
    PHANDLE_TABLE HandleTable = NULL;

    if (!(NT_SUCCESS(PsLookupProcessByProcessId((HANDLE)ulProcessId, &EProcess)) && NT_SUCCESS(PsLookupProcessByProcessId((HANDLE)ulProtectPid, &ProtectEProcess))))
    {
        return STATUS_UNSUCCESSFUL;
    }

    for (Handle = 0;; Handle += HANDLE_VALUE_INC)
    {
        Entry = ExpLookupHandleTableEntry(*(PHANDLE_TABLE*)((PUCHAR)EProcess + dynData.ObjTable), *(PEXHANDLE)&Handle);

        HandleTable = *(PHANDLE_TABLE*)((PUCHAR)EProcess + dynData.ObjTable);


        if (Entry == NULL)
        {
            break;
        }

        *(ULONG_PTR*)&Object = Entry->ObjectPointerBits;
        *(ULONG_PTR*)&Object <<= 4;
        if (Object == NULL)
        {
            continue;
        }

        *(ULONG_PTR*)&Object |= 0xFFFF000000000000;
        *(ULONG_PTR*)&Object += 0x30;
        ObjectType = ObGetObjectType(Object);//Object=%llx, Entry=%llx, ObjectType=%llxn======,Object, Entry, ObjectType
        //DbgPrint("Addr=%llx, Entry=%llX, Handle=%llX, QuotaProcess=%llX, HandleTable=%llXn ", Object, Entry, Handle, HandleTable->QuotaProcess, HandleTable);
        //DbgPrint("HandleEprocess=%llx,ProtectEProcess=%llxn", Object, ProtectEProcess);

        if (ObjectType == NULL)
        {
            continue;
        }



        //    //wcscpy(Buffer->szTypeName, *(PCWSTR*)((PUCHAR)ObjectType + 0x18));
        //    //Buffer->Handle = (HANDLE)Handle;
        //    //Buffer->AccessMask = Entry->GrantedAccessBits;
        //    //Buffer->Address = Object;//句柄指向的地址
        //    //Buffer++;

        if ((DWORD64)Object == (DWORD64)ProtectEProcess)
        {
            //Entry->GrantedAccessBits = NewAccessState;
            DPRINT("Found HANDLE, OriAccess:%xn", Entry->GrantedAccessBits);
            if ((Entry->GrantedAccessBits & PROCESS_TERMINATE) == PROCESS_TERMINATE)
            {
                Entry->GrantedAccessBits &= ~PROCESS_TERMINATE;
            }
            if ((Entry->GrantedAccessBits & PROCESS_VM_OPERATION) == PROCESS_VM_OPERATION)
            {
                Entry->GrantedAccessBits &= ~PROCESS_VM_OPERATION;
            }
            if ((Entry->GrantedAccessBits & PROCESS_VM_READ) == PROCESS_VM_READ)
            {
                Entry->GrantedAccessBits &= ~PROCESS_VM_READ;
            }
            if ((Entry->GrantedAccessBits & PROCESS_VM_WRITE) == PROCESS_VM_WRITE)
            {
                Entry->GrantedAccessBits &= ~PROCESS_VM_WRITE;
            }
            DPRINT("New Access:%xn", Entry->GrantedAccessBits);
        }

    }



    ObDereferenceObject(EProcess);
    ObDereferenceObject(ProtectEProcess);

    return STATUS_SUCCESS;
}

演示程序下载:

c/c++游戏逆向驱动开发，游戏辅助保护盾-桌面系统文档类资源-CSDN下载

使用效果图如下:(更多功能自行下载测试，测试觉得有用的铁铁可以联系我)