├── demo.jpg ├── grant_access ├── grant_access │ ├── main.cpp │ ├── grant_access.vcxproj.user │ ├── grant_access.inf │ ├── grant_access.vcxproj.filters │ ├── main.h │ └── grant_access.vcxproj ├── grant_access_user │ ├── main.cpp │ ├── loader.hpp │ ├── grant_access_user.vcxproj.user │ ├── grant_access_user.vcxproj.filters │ └── grant_access_user.vcxproj └── grant_access.sln ├── README.md ├── .gitignore └── LICENSE /demo.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FiYHer/handle_grant_access/HEAD/demo.jpg -------------------------------------------------------------------------------- /grant_access/grant_access/main.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FiYHer/handle_grant_access/HEAD/grant_access/grant_access/main.cpp -------------------------------------------------------------------------------- /grant_access/grant_access_user/main.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FiYHer/handle_grant_access/HEAD/grant_access/grant_access_user/main.cpp -------------------------------------------------------------------------------- /grant_access/grant_access_user/loader.hpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/FiYHer/handle_grant_access/HEAD/grant_access/grant_access_user/loader.hpp -------------------------------------------------------------------------------- /grant_access/grant_access_user/grant_access_user.vcxproj.user: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | -------------------------------------------------------------------------------- /grant_access/grant_access/grant_access.vcxproj.user: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | Off 5 | 6 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # handle_grant_access 2 | 句柄提权 无视反作弊读写游戏内存 用于分析游戏结构工具 3 | 4 | # 测试图片(APEX) 5 |

6 | 7 |
8 |

9 | 10 | # 测试视频 11 | https://www.ixigua.com/7001756524129288712?utm_source=xiguastudio 12 | 13 | # 测试系统 14 | Microsoft Windows [版本 10.0.18363.592] 15 | 16 | # 原理 17 | 遍历进程句柄表,修改句柄权限为0x1fffff 18 | 19 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | # Prerequisites 2 | *.d 3 | 4 | # Compiled Object files 5 | *.slo 6 | *.lo 7 | *.o 8 | *.obj 9 | 10 | # Precompiled Headers 11 | *.gch 12 | *.pch 13 | 14 | # Compiled Dynamic libraries 15 | *.so 16 | *.dylib 17 | *.dll 18 | 19 | # Fortran module files 20 | *.mod 21 | *.smod 22 | 23 | # Compiled Static libraries 24 | *.lai 25 | *.la 26 | *.a 27 | *.lib 28 | 29 | # Executables 30 | *.exe 31 | *.out 32 | *.app 33 | -------------------------------------------------------------------------------- /grant_access/grant_access/grant_access.inf: -------------------------------------------------------------------------------- 1 | ; 2 | ; grant_access.inf 3 | ; 4 | 5 | [Version] 6 | Signature="$WINDOWS NT$" 7 | Class=System 8 | ClassGuid={4d36e97d-e325-11ce-bfc1-08002be10318} 9 | Provider=%ManufacturerName% 10 | DriverVer= 11 | CatalogFile=grant_access.cat 12 | PnpLockDown=1 13 | 14 | [DestinationDirs] 15 | DefaultDestDir = 12 16 | 17 | 18 | [SourceDisksNames] 19 | 1 = %DiskName%,,,"" 20 | 21 | [SourceDisksFiles] 22 | 23 | [Strings] 24 | ManufacturerName="" ;TODO: Replace with your manufacturer name 25 | ClassName="" 26 | DiskName="grant_access Source Disk" 27 | -------------------------------------------------------------------------------- /grant_access/grant_access_user/grant_access_user.vcxproj.filters: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | 18 | 19 | 源文件 20 | 21 | 22 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2021 fyh 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /grant_access/grant_access/grant_access.vcxproj.filters: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hpp;hxx;hm;inl;inc;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | {8E41214B-6785-4CFE-B992-037D68949A14} 18 | inf;inv;inx;mof;mc; 19 | 20 | 21 | 22 | 23 | Driver Files 24 | 25 | 26 | 27 | 28 | Source Files 29 | 30 | 31 | 32 | 33 | Header Files 34 | 35 | 36 | -------------------------------------------------------------------------------- /grant_access/grant_access/main.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | #include 3 | #include 4 | 5 | typedef union _EXHANDLE 6 | { 7 | struct 8 | { 9 | int TagBits : 2; 10 | int Index : 30; 11 | } u; 12 | void* GenericHandleOverlay; 13 | ULONG_PTR Value; 14 | } EXHANDLE, * PEXHANDLE; 15 | 16 | typedef struct _HANDLE_TABLE_ENTRY // Size=16 17 | { 18 | union 19 | { 20 | ULONG_PTR VolatileLowValue; // Size=8 Offset=0 21 | ULONG_PTR LowValue; // Size=8 Offset=0 22 | struct _HANDLE_TABLE_ENTRY_INFO* InfoTable; // Size=8 Offset=0 23 | struct 24 | { 25 | ULONG_PTR Unlocked : 1; // Size=8 Offset=0 BitOffset=0 BitCount=1 26 | ULONG_PTR RefCnt : 16; // Size=8 Offset=0 BitOffset=1 BitCount=16 27 | ULONG_PTR Attributes : 3; // Size=8 Offset=0 BitOffset=17 BitCount=3 28 | ULONG_PTR ObjectPointerBits : 44; // Size=8 Offset=0 BitOffset=20 BitCount=44 29 | }; 30 | }; 31 | union 32 | { 33 | ULONG_PTR HighValue; // Size=8 Offset=8 34 | struct _HANDLE_TABLE_ENTRY* NextFreeHandleEntry; // Size=8 Offset=8 35 | union _EXHANDLE LeafHandleValue; // Size=8 Offset=8 36 | struct 37 | { 38 | ULONG GrantedAccessBits : 25; // Size=4 Offset=8 BitOffset=0 BitCount=25 39 | ULONG NoRightsUpgrade : 1; // Size=4 Offset=8 BitOffset=25 BitCount=1 40 | ULONG Spare : 6; // Size=4 Offset=8 BitOffset=26 BitCount=6 41 | }; 42 | }; 43 | ULONG TypeInfo; // Size=4 Offset=12 44 | } HANDLE_TABLE_ENTRY, * PHANDLE_TABLE_ENTRY; 45 | 46 | typedef struct _HANDLE_TABLE 47 | { 48 | ULONG NextHandleNeedingPool; 49 | long ExtraInfoPages; 50 | LONG_PTR TableCode; 51 | PEPROCESS QuotaProcess; 52 | LIST_ENTRY HandleTableList; 53 | ULONG UniqueProcessId; 54 | ULONG Flags; 55 | EX_PUSH_LOCK HandleContentionEvent; 56 | EX_PUSH_LOCK HandleTableLock; 57 | // More fields here... 58 | } HANDLE_TABLE, * PHANDLE_TABLE; 59 | 60 | typedef BOOLEAN(*EX_ENUMERATE_HANDLE_ROUTINE)( 61 | IN PHANDLE_TABLE HandleTable, 62 | IN PHANDLE_TABLE_ENTRY HandleTableEntry, 63 | IN HANDLE Handle, 64 | IN PVOID EnumParameter 65 | ); 66 | 67 | #ifdef __cplusplus 68 | extern "C" 69 | { 70 | #endif 71 | 72 | BOOLEAN NTAPI ExEnumHandleTable( 73 | IN PHANDLE_TABLE HandleTable, 74 | IN EX_ENUMERATE_HANDLE_ROUTINE EnumHandleProcedure, 75 | IN PVOID EnumParameter, 76 | OUT PHANDLE Handle); 77 | 78 | VOID FASTCALL ExfUnblockPushLock( 79 | IN OUT PEX_PUSH_LOCK PushLock, 80 | IN OUT PVOID WaitBlock 81 | ); 82 | 83 | #ifdef __cplusplus 84 | } 85 | #endif 86 | 87 | typedef struct _handle_information 88 | { 89 | unsigned long process_id; 90 | unsigned long access; 91 | unsigned long long handle; 92 | }handle_information, * phandle_information; 93 | 94 | #define UPDATE_ACCESS CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_OUT_DIRECT, FILE_ANY_ACCESS) 95 | -------------------------------------------------------------------------------- /grant_access/grant_access.sln: -------------------------------------------------------------------------------- 1 | 2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio Version 16 4 | VisualStudioVersion = 16.0.31410.357 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "grant_access", "grant_access\grant_access.vcxproj", "{D3586BCC-28B8-453B-9F44-0CF4E6C87D05}" 7 | EndProject 8 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "grant_access_user", "grant_access_user\grant_access_user.vcxproj", "{D9DBC6F3-924A-402A-A311-91944B9B6F1F}" 9 | EndProject 10 | Global 11 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 12 | Debug|ARM = Debug|ARM 13 | Debug|ARM64 = Debug|ARM64 14 | Debug|x64 = Debug|x64 15 | Debug|x86 = Debug|x86 16 | Release|ARM = Release|ARM 17 | Release|ARM64 = Release|ARM64 18 | Release|x64 = Release|x64 19 | Release|x86 = Release|x86 20 | EndGlobalSection 21 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 22 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Debug|ARM.ActiveCfg = Debug|ARM 23 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Debug|ARM.Build.0 = Debug|ARM 24 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Debug|ARM.Deploy.0 = Debug|ARM 25 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Debug|ARM64.ActiveCfg = Debug|ARM64 26 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Debug|ARM64.Build.0 = Debug|ARM64 27 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Debug|ARM64.Deploy.0 = Debug|ARM64 28 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Debug|x64.ActiveCfg = Debug|x64 29 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Debug|x64.Build.0 = Debug|x64 30 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Debug|x64.Deploy.0 = Debug|x64 31 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Debug|x86.ActiveCfg = Debug|Win32 32 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Debug|x86.Build.0 = Debug|Win32 33 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Debug|x86.Deploy.0 = Debug|Win32 34 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Release|ARM.ActiveCfg = Release|ARM 35 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Release|ARM.Build.0 = Release|ARM 36 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Release|ARM.Deploy.0 = Release|ARM 37 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Release|ARM64.ActiveCfg = Release|ARM64 38 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Release|ARM64.Build.0 = Release|ARM64 39 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Release|ARM64.Deploy.0 = Release|ARM64 40 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Release|x64.ActiveCfg = Release|x64 41 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Release|x64.Build.0 = Release|x64 42 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Release|x64.Deploy.0 = Release|x64 43 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Release|x86.ActiveCfg = Release|Win32 44 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Release|x86.Build.0 = Release|Win32 45 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05}.Release|x86.Deploy.0 = Release|Win32 46 | {D9DBC6F3-924A-402A-A311-91944B9B6F1F}.Debug|ARM.ActiveCfg = Debug|Win32 47 | {D9DBC6F3-924A-402A-A311-91944B9B6F1F}.Debug|ARM64.ActiveCfg = Debug|Win32 48 | {D9DBC6F3-924A-402A-A311-91944B9B6F1F}.Debug|x64.ActiveCfg = Debug|x64 49 | {D9DBC6F3-924A-402A-A311-91944B9B6F1F}.Debug|x64.Build.0 = Debug|x64 50 | {D9DBC6F3-924A-402A-A311-91944B9B6F1F}.Debug|x86.ActiveCfg = Debug|Win32 51 | {D9DBC6F3-924A-402A-A311-91944B9B6F1F}.Debug|x86.Build.0 = Debug|Win32 52 | {D9DBC6F3-924A-402A-A311-91944B9B6F1F}.Release|ARM.ActiveCfg = Release|Win32 53 | {D9DBC6F3-924A-402A-A311-91944B9B6F1F}.Release|ARM64.ActiveCfg = Release|Win32 54 | {D9DBC6F3-924A-402A-A311-91944B9B6F1F}.Release|x64.ActiveCfg = Release|x64 55 | {D9DBC6F3-924A-402A-A311-91944B9B6F1F}.Release|x64.Build.0 = Release|x64 56 | {D9DBC6F3-924A-402A-A311-91944B9B6F1F}.Release|x86.ActiveCfg = Release|Win32 57 | {D9DBC6F3-924A-402A-A311-91944B9B6F1F}.Release|x86.Build.0 = Release|Win32 58 | EndGlobalSection 59 | GlobalSection(SolutionProperties) = preSolution 60 | HideSolutionNode = FALSE 61 | EndGlobalSection 62 | GlobalSection(ExtensibilityGlobals) = postSolution 63 | SolutionGuid = {FCF51F00-59C2-45F3-86F0-8924B8BB9E6E} 64 | EndGlobalSection 65 | EndGlobal 66 | -------------------------------------------------------------------------------- /grant_access/grant_access/grant_access.vcxproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | Release 10 | Win32 11 | 12 | 13 | Debug 14 | x64 15 | 16 | 17 | Release 18 | x64 19 | 20 | 21 | Debug 22 | ARM 23 | 24 | 25 | Release 26 | ARM 27 | 28 | 29 | Debug 30 | ARM64 31 | 32 | 33 | Release 34 | ARM64 35 | 36 | 37 | 38 | {D3586BCC-28B8-453B-9F44-0CF4E6C87D05} 39 | {dd38f7fc-d7bd-488b-9242-7d8754cde80d} 40 | v4.5 41 | 12.0 42 | Debug 43 | Win32 44 | grant_access 45 | 46 | 47 | 48 | Windows10 49 | true 50 | WindowsKernelModeDriver10.0 51 | Driver 52 | WDM 53 | 54 | 55 | Windows10 56 | false 57 | WindowsKernelModeDriver10.0 58 | Driver 59 | WDM 60 | 61 | 62 | Windows10 63 | true 64 | WindowsKernelModeDriver10.0 65 | Driver 66 | WDM 67 | 68 | 69 | Windows10 70 | false 71 | WindowsKernelModeDriver10.0 72 | Driver 73 | WDM 74 | false 75 | 76 | 77 | Windows10 78 | true 79 | WindowsKernelModeDriver10.0 80 | Driver 81 | WDM 82 | 83 | 84 | Windows10 85 | false 86 | WindowsKernelModeDriver10.0 87 | Driver 88 | WDM 89 | 90 | 91 | Windows10 92 | true 93 | WindowsKernelModeDriver10.0 94 | Driver 95 | WDM 96 | 97 | 98 | Windows10 99 | false 100 | WindowsKernelModeDriver10.0 101 | Driver 102 | WDM 103 | 104 | 105 | 106 | 107 | 108 | 109 | 110 | 111 | 112 | 113 | DbgengKernelDebugger 114 | 115 | 116 | DbgengKernelDebugger 117 | 118 | 119 | DbgengKernelDebugger 120 | 121 | 122 | DbgengKernelDebugger 123 | false 124 | 125 | 126 | DbgengKernelDebugger 127 | 128 | 129 | DbgengKernelDebugger 130 | 131 | 132 | DbgengKernelDebugger 133 | 134 | 135 | DbgengKernelDebugger 136 | 137 | 138 | 139 | TurnOffAllWarnings 140 | 141 | 142 | 143 | 144 | false 145 | false 146 | false 147 | 148 | 149 | false 150 | 151 | 152 | 153 | 154 | 155 | 156 | 157 | 158 | 159 | 160 | 161 | 162 | 163 | 164 | 165 | 166 | 167 | -------------------------------------------------------------------------------- /grant_access/grant_access_user/grant_access_user.vcxproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | Release 10 | Win32 11 | 12 | 13 | Debug 14 | x64 15 | 16 | 17 | Release 18 | x64 19 | 20 | 21 | 22 | 16.0 23 | Win32Proj 24 | {d9dbc6f3-924a-402a-a311-91944b9b6f1f} 25 | grantaccessuser 26 | 10.0 27 | 28 | 29 | 30 | Application 31 | true 32 | v142 33 | Unicode 34 | 35 | 36 | Application 37 | false 38 | v142 39 | true 40 | Unicode 41 | 42 | 43 | Application 44 | true 45 | v142 46 | Unicode 47 | 48 | 49 | DynamicLibrary 50 | false 51 | v142 52 | true 53 | Unicode 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | true 75 | 76 | 77 | false 78 | 79 | 80 | true 81 | 82 | 83 | false 84 | 85 | 86 | 87 | Level3 88 | true 89 | WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) 90 | true 91 | 92 | 93 | Console 94 | true 95 | 96 | 97 | 98 | 99 | Level3 100 | true 101 | true 102 | true 103 | WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) 104 | true 105 | 106 | 107 | Console 108 | true 109 | true 110 | true 111 | 112 | 113 | 114 | 115 | Level3 116 | true 117 | _DEBUG;_CONSOLE;%(PreprocessorDefinitions) 118 | true 119 | 120 | 121 | Console 122 | true 123 | 124 | 125 | 126 | 127 | TurnOffAllWarnings 128 | true 129 | true 130 | 131 | 132 | NDEBUG;_CONSOLE;%(PreprocessorDefinitions) 133 | true 134 | E:\VisualStudio\Detours-master\include;%(AdditionalIncludeDirectories) 135 | None 136 | false 137 | false 138 | 139 | 140 | NotSet 141 | true 142 | true 143 | true 144 | E:\VisualStudio\Detours-master\lib.X64;%(AdditionalLibraryDirectories) 145 | 146 | 147 | detours.lib;%(AdditionalDependencies) 148 | RequireAdministrator 149 | 150 | 151 | 152 | 153 | 154 | 155 | 156 | 157 | --------------------------------------------------------------------------------