driver_callback_bypass_1909

研究和移除各种内核回调,在anti anti cheat的路上越走越远

测试系统

全部代码运行在1909系统下(Microsoft Windows [版本 10.0.18363.592])

主要回调都绕过,分析出来自会上传,完毕后写一个专门的小工具

修改PspNotifyEnableMask为00000009,创建和退出进程时就不会触发回调

修改PspNotifyEnableMask为00000007,创建和退出线程时就不会触发回调

修改PspNotifyEnableMask为0000000e,就不会触发模块回调

Name		Name	Last commit message	Last commit date
Latest commit History 26 Commits
callback_remove		callback_remove
.gitignore		.gitignore
CmRegisterCallback_bypass.cpp		CmRegisterCallback_bypass.cpp
LICENSE		LICENSE
ObRegisterCallbacks_bypass.cpp		ObRegisterCallbacks_bypass.cpp
PsSetCreateProcessNotifyRoutine_bypass.cpp		PsSetCreateProcessNotifyRoutine_bypass.cpp
PsSetCreateThreadNotifyRoutine_bypass.cpp		PsSetCreateThreadNotifyRoutine_bypass.cpp
PsSetLoadImageNotifyRoutine_bypass.cpp		PsSetLoadImageNotifyRoutine_bypass.cpp
README.md		README.md
dse_disable.cpp		dse_disable.cpp
overrider_sig.cpp		overrider_sig.cpp