├── demo.jpg
├── grant_access
├── grant_access
│ ├── main.cpp
│ ├── grant_access.vcxproj.user
│ ├── grant_access.inf
│ ├── grant_access.vcxproj.filters
│ ├── main.h
│ └── grant_access.vcxproj
├── grant_access_user
│ ├── main.cpp
│ ├── loader.hpp
│ ├── grant_access_user.vcxproj.user
│ ├── grant_access_user.vcxproj.filters
│ └── grant_access_user.vcxproj
└── grant_access.sln
├── README.md
├── .gitignore
└── LICENSE
/demo.jpg:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/FiYHer/handle_grant_access/HEAD/demo.jpg
--------------------------------------------------------------------------------
/grant_access/grant_access/main.cpp:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/FiYHer/handle_grant_access/HEAD/grant_access/grant_access/main.cpp
--------------------------------------------------------------------------------
/grant_access/grant_access_user/main.cpp:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/FiYHer/handle_grant_access/HEAD/grant_access/grant_access_user/main.cpp
--------------------------------------------------------------------------------
/grant_access/grant_access_user/loader.hpp:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/FiYHer/handle_grant_access/HEAD/grant_access/grant_access_user/loader.hpp
--------------------------------------------------------------------------------
/grant_access/grant_access_user/grant_access_user.vcxproj.user:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
--------------------------------------------------------------------------------
/grant_access/grant_access/grant_access.vcxproj.user:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 | Off
5 |
6 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # handle_grant_access
2 | 句柄提权 无视反作弊读写游戏内存 用于分析游戏结构工具
3 |
4 | # 测试图片(APEX)
5 |
6 |
7 |
8 |
9 |
10 | # 测试视频
11 | https://www.ixigua.com/7001756524129288712?utm_source=xiguastudio
12 |
13 | # 测试系统
14 | Microsoft Windows [版本 10.0.18363.592]
15 |
16 | # 原理
17 | 遍历进程句柄表,修改句柄权限为0x1fffff
18 |
19 |
--------------------------------------------------------------------------------
/.gitignore:
--------------------------------------------------------------------------------
1 | # Prerequisites
2 | *.d
3 |
4 | # Compiled Object files
5 | *.slo
6 | *.lo
7 | *.o
8 | *.obj
9 |
10 | # Precompiled Headers
11 | *.gch
12 | *.pch
13 |
14 | # Compiled Dynamic libraries
15 | *.so
16 | *.dylib
17 | *.dll
18 |
19 | # Fortran module files
20 | *.mod
21 | *.smod
22 |
23 | # Compiled Static libraries
24 | *.lai
25 | *.la
26 | *.a
27 | *.lib
28 |
29 | # Executables
30 | *.exe
31 | *.out
32 | *.app
33 |
--------------------------------------------------------------------------------
/grant_access/grant_access/grant_access.inf:
--------------------------------------------------------------------------------
1 | ;
2 | ; grant_access.inf
3 | ;
4 |
5 | [Version]
6 | Signature="$WINDOWS NT$"
7 | Class=System
8 | ClassGuid={4d36e97d-e325-11ce-bfc1-08002be10318}
9 | Provider=%ManufacturerName%
10 | DriverVer=
11 | CatalogFile=grant_access.cat
12 | PnpLockDown=1
13 |
14 | [DestinationDirs]
15 | DefaultDestDir = 12
16 |
17 |
18 | [SourceDisksNames]
19 | 1 = %DiskName%,,,""
20 |
21 | [SourceDisksFiles]
22 |
23 | [Strings]
24 | ManufacturerName="" ;TODO: Replace with your manufacturer name
25 | ClassName=""
26 | DiskName="grant_access Source Disk"
27 |
--------------------------------------------------------------------------------
/grant_access/grant_access_user/grant_access_user.vcxproj.filters:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF}
6 | cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx
7 |
8 |
9 | {93995380-89BD-4b04-88EB-625FBE52EBFB}
10 | h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd
11 |
12 |
13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01}
14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms
15 |
16 |
17 |
18 |
19 | 源文件
20 |
21 |
22 |
--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
1 | MIT License
2 |
3 | Copyright (c) 2021 fyh
4 |
5 | Permission is hereby granted, free of charge, to any person obtaining a copy
6 | of this software and associated documentation files (the "Software"), to deal
7 | in the Software without restriction, including without limitation the rights
8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9 | copies of the Software, and to permit persons to whom the Software is
10 | furnished to do so, subject to the following conditions:
11 |
12 | The above copyright notice and this permission notice shall be included in all
13 | copies or substantial portions of the Software.
14 |
15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21 | SOFTWARE.
22 |
--------------------------------------------------------------------------------
/grant_access/grant_access/grant_access.vcxproj.filters:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF}
6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx
7 |
8 |
9 | {93995380-89BD-4b04-88EB-625FBE52EBFB}
10 | h;hpp;hxx;hm;inl;inc;xsd
11 |
12 |
13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01}
14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms
15 |
16 |
17 | {8E41214B-6785-4CFE-B992-037D68949A14}
18 | inf;inv;inx;mof;mc;
19 |
20 |
21 |
22 |
23 | Driver Files
24 |
25 |
26 |
27 |
28 | Source Files
29 |
30 |
31 |
32 |
33 | Header Files
34 |
35 |
36 |
--------------------------------------------------------------------------------
/grant_access/grant_access/main.h:
--------------------------------------------------------------------------------
1 | #pragma once
2 | #include
3 | #include
4 |
5 | typedef union _EXHANDLE
6 | {
7 | struct
8 | {
9 | int TagBits : 2;
10 | int Index : 30;
11 | } u;
12 | void* GenericHandleOverlay;
13 | ULONG_PTR Value;
14 | } EXHANDLE, * PEXHANDLE;
15 |
16 | typedef struct _HANDLE_TABLE_ENTRY // Size=16
17 | {
18 | union
19 | {
20 | ULONG_PTR VolatileLowValue; // Size=8 Offset=0
21 | ULONG_PTR LowValue; // Size=8 Offset=0
22 | struct _HANDLE_TABLE_ENTRY_INFO* InfoTable; // Size=8 Offset=0
23 | struct
24 | {
25 | ULONG_PTR Unlocked : 1; // Size=8 Offset=0 BitOffset=0 BitCount=1
26 | ULONG_PTR RefCnt : 16; // Size=8 Offset=0 BitOffset=1 BitCount=16
27 | ULONG_PTR Attributes : 3; // Size=8 Offset=0 BitOffset=17 BitCount=3
28 | ULONG_PTR ObjectPointerBits : 44; // Size=8 Offset=0 BitOffset=20 BitCount=44
29 | };
30 | };
31 | union
32 | {
33 | ULONG_PTR HighValue; // Size=8 Offset=8
34 | struct _HANDLE_TABLE_ENTRY* NextFreeHandleEntry; // Size=8 Offset=8
35 | union _EXHANDLE LeafHandleValue; // Size=8 Offset=8
36 | struct
37 | {
38 | ULONG GrantedAccessBits : 25; // Size=4 Offset=8 BitOffset=0 BitCount=25
39 | ULONG NoRightsUpgrade : 1; // Size=4 Offset=8 BitOffset=25 BitCount=1
40 | ULONG Spare : 6; // Size=4 Offset=8 BitOffset=26 BitCount=6
41 | };
42 | };
43 | ULONG TypeInfo; // Size=4 Offset=12
44 | } HANDLE_TABLE_ENTRY, * PHANDLE_TABLE_ENTRY;
45 |
46 | typedef struct _HANDLE_TABLE
47 | {
48 | ULONG NextHandleNeedingPool;
49 | long ExtraInfoPages;
50 | LONG_PTR TableCode;
51 | PEPROCESS QuotaProcess;
52 | LIST_ENTRY HandleTableList;
53 | ULONG UniqueProcessId;
54 | ULONG Flags;
55 | EX_PUSH_LOCK HandleContentionEvent;
56 | EX_PUSH_LOCK HandleTableLock;
57 | // More fields here...
58 | } HANDLE_TABLE, * PHANDLE_TABLE;
59 |
60 | typedef BOOLEAN(*EX_ENUMERATE_HANDLE_ROUTINE)(
61 | IN PHANDLE_TABLE HandleTable,
62 | IN PHANDLE_TABLE_ENTRY HandleTableEntry,
63 | IN HANDLE Handle,
64 | IN PVOID EnumParameter
65 | );
66 |
67 | #ifdef __cplusplus
68 | extern "C"
69 | {
70 | #endif
71 |
72 | BOOLEAN NTAPI ExEnumHandleTable(
73 | IN PHANDLE_TABLE HandleTable,
74 | IN EX_ENUMERATE_HANDLE_ROUTINE EnumHandleProcedure,
75 | IN PVOID EnumParameter,
76 | OUT PHANDLE Handle);
77 |
78 | VOID FASTCALL ExfUnblockPushLock(
79 | IN OUT PEX_PUSH_LOCK PushLock,
80 | IN OUT PVOID WaitBlock
81 | );
82 |
83 | #ifdef __cplusplus
84 | }
85 | #endif
86 |
87 | typedef struct _handle_information
88 | {
89 | unsigned long process_id;
90 | unsigned long access;
91 | unsigned long long handle;
92 | }handle_information, * phandle_information;
93 |
94 | #define UPDATE_ACCESS CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_OUT_DIRECT, FILE_ANY_ACCESS)
95 |
--------------------------------------------------------------------------------
/grant_access/grant_access.sln:
--------------------------------------------------------------------------------
1 |
2 | Microsoft Visual Studio Solution File, Format Version 12.00
3 | # Visual Studio Version 16
4 | VisualStudioVersion = 16.0.31410.357
5 | MinimumVisualStudioVersion = 10.0.40219.1
6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "grant_access", "grant_access\grant_access.vcxproj", "{D3586BCC-28B8-453B-9F44-0CF4E6C87D05}"
7 | EndProject
8 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "grant_access_user", "grant_access_user\grant_access_user.vcxproj", "{D9DBC6F3-924A-402A-A311-91944B9B6F1F}"
9 | EndProject
10 | Global
11 | GlobalSection(SolutionConfigurationPlatforms) = preSolution
12 | Debug|ARM = Debug|ARM
13 | Debug|ARM64 = Debug|ARM64
14 | Debug|x64 = Debug|x64
15 | Debug|x86 = Debug|x86
16 | Release|ARM = Release|ARM
17 | Release|ARM64 = Release|ARM64
18 | Release|x64 = Release|x64
19 | Release|x86 = Release|x86
20 | EndGlobalSection
21 | GlobalSection(ProjectConfigurationPlatforms) = postSolution
22 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Debug|ARM.ActiveCfg = Debug|ARM
23 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Debug|ARM.Build.0 = Debug|ARM
24 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Debug|ARM.Deploy.0 = Debug|ARM
25 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Debug|ARM64.ActiveCfg = Debug|ARM64
26 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Debug|ARM64.Build.0 = Debug|ARM64
27 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Debug|ARM64.Deploy.0 = Debug|ARM64
28 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Debug|x64.ActiveCfg = Debug|x64
29 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Debug|x64.Build.0 = Debug|x64
30 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Debug|x64.Deploy.0 = Debug|x64
31 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Debug|x86.ActiveCfg = Debug|Win32
32 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Debug|x86.Build.0 = Debug|Win32
33 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Debug|x86.Deploy.0 = Debug|Win32
34 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Release|ARM.ActiveCfg = Release|ARM
35 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Release|ARM.Build.0 = Release|ARM
36 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Release|ARM.Deploy.0 = Release|ARM
37 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Release|ARM64.ActiveCfg = Release|ARM64
38 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Release|ARM64.Build.0 = Release|ARM64
39 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Release|ARM64.Deploy.0 = Release|ARM64
40 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Release|x64.ActiveCfg = Release|x64
41 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Release|x64.Build.0 = Release|x64
42 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Release|x64.Deploy.0 = Release|x64
43 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Release|x86.ActiveCfg = Release|Win32
44 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Release|x86.Build.0 = Release|Win32
45 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Release|x86.Deploy.0 = Release|Win32
46 | {D9DBC6F3-924A-402A-A311-91944B9B6F1F}.Debug|ARM.ActiveCfg = Debug|Win32
47 | {D9DBC6F3-924A-402A-A311-91944B9B6F1F}.Debug|ARM64.ActiveCfg = Debug|Win32
48 | {D9DBC6F3-924A-402A-A311-91944B9B6F1F}.Debug|x64.ActiveCfg = Debug|x64
49 | {D9DBC6F3-924A-402A-A311-91944B9B6F1F}.Debug|x64.Build.0 = Debug|x64
50 | {D9DBC6F3-924A-402A-A311-91944B9B6F1F}.Debug|x86.ActiveCfg = Debug|Win32
51 | {D9DBC6F3-924A-402A-A311-91944B9B6F1F}.Debug|x86.Build.0 = Debug|Win32
52 | {D9DBC6F3-924A-402A-A311-91944B9B6F1F}.Release|ARM.ActiveCfg = Release|Win32
53 | {D9DBC6F3-924A-402A-A311-91944B9B6F1F}.Release|ARM64.ActiveCfg = Release|Win32
54 | {D9DBC6F3-924A-402A-A311-91944B9B6F1F}.Release|x64.ActiveCfg = Release|x64
55 | {D9DBC6F3-924A-402A-A311-91944B9B6F1F}.Release|x64.Build.0 = Release|x64
56 | {D9DBC6F3-924A-402A-A311-91944B9B6F1F}.Release|x86.ActiveCfg = Release|Win32
57 | {D9DBC6F3-924A-402A-A311-91944B9B6F1F}.Release|x86.Build.0 = Release|Win32
58 | EndGlobalSection
59 | GlobalSection(SolutionProperties) = preSolution
60 | HideSolutionNode = FALSE
61 | EndGlobalSection
62 | GlobalSection(ExtensibilityGlobals) = postSolution
63 | SolutionGuid = {FCF51F00-59C2-45F3-86F0-8924B8BB9E6E}
64 | EndGlobalSection
65 | EndGlobal
66 |
--------------------------------------------------------------------------------
/grant_access/grant_access/grant_access.vcxproj:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | Debug
6 | Win32
7 |
8 |
9 | Release
10 | Win32
11 |
12 |
13 | Debug
14 | x64
15 |
16 |
17 | Release
18 | x64
19 |
20 |
21 | Debug
22 | ARM
23 |
24 |
25 | Release
26 | ARM
27 |
28 |
29 | Debug
30 | ARM64
31 |
32 |
33 | Release
34 | ARM64
35 |
36 |
37 |
38 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}
39 | {dd38f7fc-d7bd-488b-9242-7d8754cde80d}
40 | v4.5
41 | 12.0
42 | Debug
43 | Win32
44 | grant_access
45 |
46 |
47 |
48 | Windows10
49 | true
50 | WindowsKernelModeDriver10.0
51 | Driver
52 | WDM
53 |
54 |
55 | Windows10
56 | false
57 | WindowsKernelModeDriver10.0
58 | Driver
59 | WDM
60 |
61 |
62 | Windows10
63 | true
64 | WindowsKernelModeDriver10.0
65 | Driver
66 | WDM
67 |
68 |
69 | Windows10
70 | false
71 | WindowsKernelModeDriver10.0
72 | Driver
73 | WDM
74 | false
75 |
76 |
77 | Windows10
78 | true
79 | WindowsKernelModeDriver10.0
80 | Driver
81 | WDM
82 |
83 |
84 | Windows10
85 | false
86 | WindowsKernelModeDriver10.0
87 | Driver
88 | WDM
89 |
90 |
91 | Windows10
92 | true
93 | WindowsKernelModeDriver10.0
94 | Driver
95 | WDM
96 |
97 |
98 | Windows10
99 | false
100 | WindowsKernelModeDriver10.0
101 | Driver
102 | WDM
103 |
104 |
105 |
106 |
107 |
108 |
109 |
110 |
111 |
112 |
113 | DbgengKernelDebugger
114 |
115 |
116 | DbgengKernelDebugger
117 |
118 |
119 | DbgengKernelDebugger
120 |
121 |
122 | DbgengKernelDebugger
123 | false
124 |
125 |
126 | DbgengKernelDebugger
127 |
128 |
129 | DbgengKernelDebugger
130 |
131 |
132 | DbgengKernelDebugger
133 |
134 |
135 | DbgengKernelDebugger
136 |
137 |
138 |
139 | TurnOffAllWarnings
140 |
141 |
142 |
143 |
144 | false
145 | false
146 | false
147 |
148 |
149 | false
150 |
151 |
152 |
153 |
154 |
155 |
156 |
157 |
158 |
159 |
160 |
161 |
162 |
163 |
164 |
165 |
166 |
167 |
--------------------------------------------------------------------------------
/grant_access/grant_access_user/grant_access_user.vcxproj:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | Debug
6 | Win32
7 |
8 |
9 | Release
10 | Win32
11 |
12 |
13 | Debug
14 | x64
15 |
16 |
17 | Release
18 | x64
19 |
20 |
21 |
22 | 16.0
23 | Win32Proj
24 | {d9dbc6f3-924a-402a-a311-91944b9b6f1f}
25 | grantaccessuser
26 | 10.0
27 |
28 |
29 |
30 | Application
31 | true
32 | v142
33 | Unicode
34 |
35 |
36 | Application
37 | false
38 | v142
39 | true
40 | Unicode
41 |
42 |
43 | Application
44 | true
45 | v142
46 | Unicode
47 |
48 |
49 | DynamicLibrary
50 | false
51 | v142
52 | true
53 | Unicode
54 |
55 |
56 |
57 |
58 |
59 |
60 |
61 |
62 |
63 |
64 |
65 |
66 |
67 |
68 |
69 |
70 |
71 |
72 |
73 |
74 | true
75 |
76 |
77 | false
78 |
79 |
80 | true
81 |
82 |
83 | false
84 |
85 |
86 |
87 | Level3
88 | true
89 | WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)
90 | true
91 |
92 |
93 | Console
94 | true
95 |
96 |
97 |
98 |
99 | Level3
100 | true
101 | true
102 | true
103 | WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)
104 | true
105 |
106 |
107 | Console
108 | true
109 | true
110 | true
111 |
112 |
113 |
114 |
115 | Level3
116 | true
117 | _DEBUG;_CONSOLE;%(PreprocessorDefinitions)
118 | true
119 |
120 |
121 | Console
122 | true
123 |
124 |
125 |
126 |
127 | TurnOffAllWarnings
128 | true
129 | true
130 |
131 |
132 | NDEBUG;_CONSOLE;%(PreprocessorDefinitions)
133 | true
134 | E:\VisualStudio\Detours-master\include;%(AdditionalIncludeDirectories)
135 | None
136 | false
137 | false
138 |
139 |
140 | NotSet
141 | true
142 | true
143 | true
144 | E:\VisualStudio\Detours-master\lib.X64;%(AdditionalLibraryDirectories)
145 |
146 |
147 | detours.lib;%(AdditionalDependencies)
148 | RequireAdministrator
149 |
150 |
151 |
152 |
153 |
154 |
155 |
156 |
157 |
--------------------------------------------------------------------------------