eac 反调试_自己动手制作一个过保护调试器-CSDN博客

本文链接：https://blog.csdn.net/weixin_39847034/article/details/111528336

本文介绍了作者初次接触驱动开发，尝试制作一个调试器保护程序来对抗EAC（Easy Anti-Cheat）的过程。通过ETW Hook技术隐藏API参数，作者详细阐述了如何编写驱动，包括设置回调、绕过调试器检测、处理EAC的系统调用检查等。然而，由于EAC在内核层扫描句柄，作者的方法在某些情况下仍无法完全防止被检测。尽管存在局限性，但作者分享了这一学习过程和解决方案。

摘要由CSDN通过智能技术生成

原标题：自己动手制作一个过保护调试器

一、起因

本人是新手第一次接触驱动开发的小白，事情是这样的，一个星期前突发奇想想做一个调试器保护程序用于调试游戏，既然要调试驱动保护的程序，自然也要深入驱动底层。做调试器必须要hook api去隐藏调试器的参数，所以就有了今天这篇文章。

二、准备的东西

第一个版本的调试器保护程序就是今天要说的用到 ETW(Event Tracing for Windows) hook 去Hook api 实现隐藏参数的

ETW Hook(下文叫做 InfinityHook

原理简单点概括为 ETW在记录系统函数被调用事件的时候被调用的系统函数的指针还存放在栈上,能对应的指针从而实现Hook. 更多关于InfinityHook的可以百度一下 “InfinityHook” 看雪的大佬写的比我好,理解比我深入,就不卖丑了.

infinityhook的优点是简单好用,兼容性高,不像VT只能在intel cpu用而AMD必须另写SVM很麻烦,坏处是只能做r3层的api hook,R0的API是无法拦截的.github地址:https://github.com/everdox/InfinityHook

基本的思路:

1.设置CreateProcessNotify去标记调试器进程的PID

2. 利用ObRegisterCallbacks注册process和thread的回调,当调试器打开进程时被反作弊的回调降权后再升级回去

3.hook NtQuerySystemInformation、NtSetInformationThread、NtQueryObject、NtQueryInformationThread、NtGetContextThread、NtQueryInformationProcess、pfn_NtGetContextThread XXOO anti debug三、驱动编写

首先是抄了两个传家的ssdt函数获取的东西,通用的框架.不需要多言:

extern "C" NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath) { DebugPrint("\n[DebugMessage] Driver Loading!\n"); RtlInitUnicodeString(&DeviceName, L"\\Device\\HuojiDebuger"); RtlInitUnicodeString(&Win32Device, L"\\DosDevices\\HuojiDebuger"); PDEVICE_OBJECT DeviceObject = NULL; NTSTATUS status = IoCreateDevice(DriverObject, 0, &DeviceName, FILE_DEVICE_UNKNOWN, FILE_DEVICE_SECURE_OPEN, FALSE, &DeviceObject); if (!NT_SUCCESS(status)) { DebugPrint("[DeugMessage] IoCreateDevice Error...\r\n"); return status; } if (!DeviceObject) { DebugPrint("[DeugMessage] Unexpected I/O Error...\r\n"); return STATUS_UNEXPECTED_IO_ERROR; } DebugPrint("[DeugMessage] Device %.*ws created successfully!\r\n", DeviceName.Length / sizeof(WCHAR), DeviceName.Buffer); DriverObject->DriverUnload = DriverUnload; if (!NT_SUCCESS(NTDLL::Initialize)) { DebugPrint("[DebugMessage] Ntdll::Initialize failed...\r\n"); return STATUS_UNSUCCESSFUL; } //获取SSDT函数 pfn_NtQueryInformationProcess = (NTQUERYINFORMATIONPROCESS)SSDT::GetFunctionAddress("NtQueryInformationProcess"); DebugPrint("[DebugMessage] NtQueryInformationProcess: 0x%08X...\r\n", pfn_NtQueryInformationProcess); pfn_NtGetContextThread = (NTGETCONTEXTHREAD)SSDT::GetFunctionAddress("NtGetContextThread"); DebugPrint("[DebugMessage] NtGetContextThread: 0x%08X...\r\n", pfn_NtGetContextThread); pfn_NtQueryInformationThread = (NTQUERYINFORMATIONTHREAD)SSDT::GetFunctionAddress("NtQueryInformationThread"); DebugPrint("[DebugMessage] NtQueryInformationThread: 0x%08X...\r\n", pfn_NtQueryInformationThread); pfn_NtQueryObject = (NTQUERYOBJECT)SSDT::GetFunctionAddress("NtQueryObject"); DebugPrint("[DebugMessage] NtQueryObject: 0x%08X...\r\n", pfn_NtQueryObject); pfn_NtSetInformationThread = (NTSETINFORMATIONTHREAD)SSDT::GetFunctionAddress("NtSetInformationThread"); DebugPrint("[DebugMessage] NtSetInformationThread: 0x%08X...\r\n", pfn_NtSetInformationThread); pfn_NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)SSDT::GetFunctionAddress("NtQuerySystemInformation"); DebugPrint("[DebugMessage] NtQuerySystemInformation: 0x%08X...\r\n", pfn_NtQuerySystemInformation); pfn_NtOpenProcess = (NTOPENPROCESS)SSDT::GetFunctionAddress("NtOpenProcess"); DebugPrint("[DebugMessage] NtOpenProcess: 0x%08X...\r\n", pfn_NtOpenProcess); pfn_NtReadVirtualMemory = (NTREADVIRTUALMEMORY)SSDT::GetFunctionAddress("NtReadVirtualMemory"); DebugPrint("[DebugMessage] NtReadVirtualMemory: 0x%08X...\r\n", pfn_NtReadVirtualMemory); pfn_NtWriteVirtualMemory = (NTWRITEVIRTUALMEMORY)SSDT::GetFunctionAddress("NtWriteVirtualMemory"); DebugPrint("[DebugMessage] NtWriteVirtualMemory: 0x%08X...\r\n", pfn_NtWriteVirtualMemory); pfn_NtCreateThread = (NTCREATETHREAD)SSDT::GetFunctionAddress("NtCreateThread"); DebugPrint("[DebugMessage] NtCreateThread: 0x%08X...\r\n", pfn_NtCreateThread); pfn_NtTerminateProcess = (NTTERMINATEPROCESS)SSDT::GetFunctionAddress("NtTerminateProcess"); DebugPrint("[DebugMessage] NtTerminateProcess: 0x%08X...\r\n", pfn_NtTerminateProcess); // 绕过MmVerifyCallbackFunction。 PLDR_DATA_TABLE_ENTRY64 ldr = (PLDR_DATA_TABLE_ENTRY64)DriverObject->DriverSection; ldr->Flags |= 0x20; //安装回调 InstallCallBacks; //初始化ETW HOOK if (!NT_SUCCESS(IfhInitialize(SyscallCallBack))) DebugPrint("[DebugMessage] IfhInitialize failed...\r\n"); return STATUS_SUCCESS; }

其中

IfhInitialize(SyscallCallBack))

注册后在SyscallCallBack捕获我们的要hook api函数:

void __fastcall SyscallCallBack(_In_ unsigned int SystemCallIndex, _Inout_ void** SystemCallFunction) { if (*SystemCallFunction == pfn_NtOpenProcess) *SystemCallFunction = HookNtOpenProcess; else if (*SystemCallFunction == pfn_NtReadVirtualMemory) *SystemCallFunction = HookNtReadVirtualMemory; else if (*SystemCallFunction == pfn_NtWriteVirtualMemory) *SystemCallFunction = HookNtWriteVirtualMemory;