├── $KProtect.sln ├── $KProtect ├── $KProtect.vcxproj ├── $KProtect.vcxproj.filters ├── $KProtect.vcxproj.user ├── DriverEntry.c ├── Utils │ ├── Helper.c │ ├── Helper.h │ ├── NtDefine.h │ ├── NtFunction.h │ └── NtStruct.h └── runsdvui.cmd ├── $KProtectDemo ├── $KProtectDemo.cpp ├── $KProtectDemo.h ├── $KProtectDemo.vcxproj ├── $KProtectDemo.vcxproj.filters ├── $KProtectDemo.vcxproj.user ├── $KProtectDemoDlg.cpp ├── $KProtectDemoDlg.h ├── AntiDebug.cpp ├── AntiDebug.h ├── KProtectDemo.rc ├── res │ ├── $KProtectDemo.ico │ └── KProtectDemo.rc2 ├── resource.h ├── stdafx.cpp ├── stdafx.h └── targetver.h └── README.MD /$KProtect.sln: -------------------------------------------------------------------------------- 1 |  2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio 15 4 | VisualStudioVersion = 15.0.28307.168 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "$KProtect", "$KProtect\$KProtect.vcxproj", "{C305ECD4-5B2A-4AE2-9A89-974D96349852}" 7 | EndProject 8 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "$KProtectDemo", "$KProtectDemo\$KProtectDemo.vcxproj", "{C6ACAB17-D753-4789-9805-B99F029247A7}" 9 | EndProject 10 | Global 11 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 12 | Debug|ARM = Debug|ARM 13 | Debug|ARM64 = Debug|ARM64 14 | Debug|x64 = Debug|x64 15 | Debug|x86 = Debug|x86 16 | Release|ARM = Release|ARM 17 | Release|ARM64 = Release|ARM64 18 | Release|x64 = Release|x64 19 | Release|x86 = Release|x86 20 | EndGlobalSection 21 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 22 | {C305ECD4-5B2A-4AE2-9A89-974D96349852}.Debug|ARM.ActiveCfg = Debug|ARM 23 | {C305ECD4-5B2A-4AE2-9A89-974D96349852}.Debug|ARM.Build.0 = Debug|ARM 24 | {C305ECD4-5B2A-4AE2-9A89-974D96349852}.Debug|ARM.Deploy.0 = Debug|ARM 25 | {C305ECD4-5B2A-4AE2-9A89-974D96349852}.Debug|ARM64.ActiveCfg = Debug|ARM64 26 | {C305ECD4-5B2A-4AE2-9A89-974D96349852}.Debug|ARM64.Build.0 = Debug|ARM64 27 | {C305ECD4-5B2A-4AE2-9A89-974D96349852}.Debug|ARM64.Deploy.0 = Debug|ARM64 28 | {C305ECD4-5B2A-4AE2-9A89-974D96349852}.Debug|x64.ActiveCfg = Debug|x64 29 | {C305ECD4-5B2A-4AE2-9A89-974D96349852}.Debug|x64.Build.0 = Debug|x64 30 | {C305ECD4-5B2A-4AE2-9A89-974D96349852}.Debug|x64.Deploy.0 = Debug|x64 31 | {C305ECD4-5B2A-4AE2-9A89-974D96349852}.Debug|x86.ActiveCfg = Debug|Win32 32 | {C305ECD4-5B2A-4AE2-9A89-974D96349852}.Debug|x86.Build.0 = Debug|Win32 33 | {C305ECD4-5B2A-4AE2-9A89-974D96349852}.Debug|x86.Deploy.0 = Debug|Win32 34 | {C305ECD4-5B2A-4AE2-9A89-974D96349852}.Release|ARM.ActiveCfg = Release|ARM 35 | {C305ECD4-5B2A-4AE2-9A89-974D96349852}.Release|ARM.Build.0 = Release|ARM 36 | {C305ECD4-5B2A-4AE2-9A89-974D96349852}.Release|ARM.Deploy.0 = Release|ARM 37 | {C305ECD4-5B2A-4AE2-9A89-974D96349852}.Release|ARM64.ActiveCfg = Release|ARM64 38 | {C305ECD4-5B2A-4AE2-9A89-974D96349852}.Release|ARM64.Build.0 = Release|ARM64 39 | {C305ECD4-5B2A-4AE2-9A89-974D96349852}.Release|ARM64.Deploy.0 = Release|ARM64 40 | {C305ECD4-5B2A-4AE2-9A89-974D96349852}.Release|x64.ActiveCfg = Release|x64 41 | {C305ECD4-5B2A-4AE2-9A89-974D96349852}.Release|x64.Build.0 = Release|x64 42 | {C305ECD4-5B2A-4AE2-9A89-974D96349852}.Release|x64.Deploy.0 = Release|x64 43 | {C305ECD4-5B2A-4AE2-9A89-974D96349852}.Release|x86.ActiveCfg = Release|Win32 44 | {C305ECD4-5B2A-4AE2-9A89-974D96349852}.Release|x86.Build.0 = Release|Win32 45 | {C305ECD4-5B2A-4AE2-9A89-974D96349852}.Release|x86.Deploy.0 = Release|Win32 46 | {C6ACAB17-D753-4789-9805-B99F029247A7}.Debug|ARM.ActiveCfg = Debug|Win32 47 | {C6ACAB17-D753-4789-9805-B99F029247A7}.Debug|ARM64.ActiveCfg = Debug|Win32 48 | {C6ACAB17-D753-4789-9805-B99F029247A7}.Debug|x64.ActiveCfg = Debug|x64 49 | {C6ACAB17-D753-4789-9805-B99F029247A7}.Debug|x64.Build.0 = Debug|x64 50 | {C6ACAB17-D753-4789-9805-B99F029247A7}.Debug|x86.ActiveCfg = Debug|Win32 51 | {C6ACAB17-D753-4789-9805-B99F029247A7}.Debug|x86.Build.0 = Debug|Win32 52 | {C6ACAB17-D753-4789-9805-B99F029247A7}.Release|ARM.ActiveCfg = Release|Win32 53 | {C6ACAB17-D753-4789-9805-B99F029247A7}.Release|ARM64.ActiveCfg = Release|Win32 54 | {C6ACAB17-D753-4789-9805-B99F029247A7}.Release|x64.ActiveCfg = Release|x64 55 | {C6ACAB17-D753-4789-9805-B99F029247A7}.Release|x64.Build.0 = Release|x64 56 | {C6ACAB17-D753-4789-9805-B99F029247A7}.Release|x86.ActiveCfg = Release|Win32 57 | {C6ACAB17-D753-4789-9805-B99F029247A7}.Release|x86.Build.0 = Release|Win32 58 | EndGlobalSection 59 | GlobalSection(SolutionProperties) = preSolution 60 | HideSolutionNode = FALSE 61 | EndGlobalSection 62 | GlobalSection(ExtensibilityGlobals) = postSolution 63 | SolutionGuid = {AF3A2022-6821-4C26-A342-28BFC5F2E0F5} 64 | EndGlobalSection 65 | EndGlobal 66 | -------------------------------------------------------------------------------- /$KProtect/$KProtect.vcxproj: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | Release 10 | Win32 11 | 12 | 13 | Debug 14 | x64 15 | 16 | 17 | Release 18 | x64 19 | 20 | 21 | Debug 22 | ARM 23 | 24 | 25 | Release 26 | ARM 27 | 28 | 29 | Debug 30 | ARM64 31 | 32 | 33 | Release 34 | ARM64 35 | 36 | 37 | 38 | {C305ECD4-5B2A-4AE2-9A89-974D96349852} 39 | {dd38f7fc-d7bd-488b-9242-7d8754cde80d} 40 | v4.5 41 | 12.0 42 | Debug 43 | Win32 44 | __KProtect 45 | 10.0.16299.0 46 | 47 | 48 | 49 | Windows10 50 | true 51 | WindowsKernelModeDriver10.0 52 | Driver 53 | WDM 54 | 55 | 56 | Windows10 57 | false 58 | WindowsKernelModeDriver10.0 59 | Driver 60 | WDM 61 | 62 | 63 | Windows7 64 | true 65 | WindowsKernelModeDriver10.0 66 | Driver 67 | WDM 68 | 69 | 70 | Windows10 71 | false 72 | WindowsKernelModeDriver10.0 73 | Driver 74 | WDM 75 | 76 | 77 | Windows10 78 | true 79 | WindowsKernelModeDriver10.0 80 | Driver 81 | WDM 82 | 83 | 84 | Windows10 85 | false 86 | WindowsKernelModeDriver10.0 87 | Driver 88 | WDM 89 | 90 | 91 | Windows10 92 | true 93 | WindowsKernelModeDriver10.0 94 | Driver 95 | WDM 96 | 97 | 98 | Windows10 99 | false 100 | WindowsKernelModeDriver10.0 101 | Driver 102 | WDM 103 | 104 | 105 | 106 | 107 | 108 | 109 | 110 | 111 | 112 | 113 | DbgengKernelDebugger 114 | .\Utils;$(IncludePath) 115 | 116 | 117 | DbgengKernelDebugger 118 | 119 | 120 | DbgengKernelDebugger 121 | false 122 | .\Utils;$(IncludePath) 123 | 124 | 125 | DbgengKernelDebugger 126 | 127 | 128 | DbgengKernelDebugger 129 | 130 | 131 | DbgengKernelDebugger 132 | 133 | 134 | DbgengKernelDebugger 135 | 136 | 137 | DbgengKernelDebugger 138 | 139 | 140 | 141 | Level3 142 | 143 | 144 | 145 | 146 | false 147 | 148 | 149 | 150 | 151 | false 152 | 153 | 154 | 155 | 156 | 157 | 158 | 159 | 160 | 161 | 162 | 163 | 164 | 165 | 166 | 167 | 168 | 169 | 170 | -------------------------------------------------------------------------------- /$KProtect/$KProtect.vcxproj.filters: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hpp;hxx;hm;inl;inc;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | {8E41214B-6785-4CFE-B992-037D68949A14} 18 | inf;inv;inx;mof;mc; 19 | 20 | 21 | {102d93fb-34e3-4dc8-897d-15c89bf00886} 22 | 23 | 24 | 25 | 26 | Utils 27 | 28 | 29 | Source Files 30 | 31 | 32 | 33 | 34 | Utils 35 | 36 | 37 | Utils 38 | 39 | 40 | Utils 41 | 42 | 43 | Utils 44 | 45 | 46 | -------------------------------------------------------------------------------- /$KProtect/$KProtect.vcxproj.user: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | Off 5 | 6 | 7 | Win7Ent 8 | 9 | -------------------------------------------------------------------------------- /$KProtect/DriverEntry.c: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wanttobeno/KProtect/daae9569cf405200a837f894140b281daa3f6097/$KProtect/DriverEntry.c -------------------------------------------------------------------------------- /$KProtect/Utils/Helper.c: -------------------------------------------------------------------------------- 1 | #include "Helper.h" 2 | 3 | unsigned char* FindPattern(const unsigned char* haystack, size_t hlen, 4 | const unsigned char* needle, const char* mask) 5 | { 6 | size_t scan, nlen = strlen(mask); 7 | size_t bad_char_skip[256]; 8 | 9 | for (scan = 0; scan < 256; scan++) 10 | bad_char_skip[scan] = nlen; 11 | 12 | size_t last = nlen - 1; 13 | 14 | for (scan = 0; scan < last; scan++) 15 | if (mask[scan] != '?') 16 | bad_char_skip[needle[scan]] = last - scan; 17 | 18 | while (hlen >= nlen) 19 | { 20 | for (scan = last; mask[scan] == '?' || haystack[scan] == needle[scan]; scan--) 21 | if (scan == 0) 22 | return (unsigned char*)haystack; 23 | 24 | hlen -= bad_char_skip[haystack[last]]; 25 | haystack += bad_char_skip[haystack[last]]; 26 | } 27 | 28 | return 0; 29 | } 30 | 31 | 32 | 33 | -------------------------------------------------------------------------------- /$KProtect/Utils/Helper.h: -------------------------------------------------------------------------------- 1 | #ifndef Helper_h__ 2 | #define Helper_h__ 3 | 4 | #include 5 | 6 | // http://www.d3scene.com/forum/development/79766-c-c-faster-findpattern-function-tutorial.html 7 | unsigned char* FindPattern(const unsigned char* haystack, size_t hlen, 8 | const unsigned char* needle, const char* mask); 9 | 10 | 11 | 12 | #endif // Helper_h__ -------------------------------------------------------------------------------- /$KProtect/Utils/NtDefine.h: -------------------------------------------------------------------------------- 1 | #ifndef NTDEFINE_H__ 2 | #define NTDEFINE_H__ 1 3 | 4 | typedef long LONG; 5 | typedef unsigned char BOOL, *PBOOL; 6 | typedef unsigned char BYTE, *PBYTE; 7 | typedef unsigned long DWORD, *PDWORD; 8 | typedef unsigned short WORD, *PWORD; 9 | 10 | //typedef void *HMODULE; 11 | typedef long NTSTATUS, *PNTSTATUS; 12 | typedef unsigned long DWORD; 13 | typedef DWORD * PDWORD; 14 | typedef unsigned long ULONG; 15 | //typedef unsigned long ULONG_PTR; 16 | typedef ULONG *PULONG; 17 | typedef unsigned short WORD; 18 | typedef unsigned char BYTE; 19 | typedef unsigned char UCHAR; 20 | typedef unsigned short USHORT; 21 | typedef void *PVOID; 22 | typedef BYTE BOOLEAN; 23 | 24 | 25 | 26 | #endif //NTDEFINE_H__ -------------------------------------------------------------------------------- /$KProtect/Utils/NtFunction.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wanttobeno/KProtect/daae9569cf405200a837f894140b281daa3f6097/$KProtect/Utils/NtFunction.h -------------------------------------------------------------------------------- /$KProtect/Utils/NtStruct.h: -------------------------------------------------------------------------------- 1 | #ifndef NTSTRUCT_H__ 2 | #define NTSTRUCT_H__ 1 3 | #include 4 | #include 5 | 6 | NTSTATUS ZwQuerySystemInformation( 7 | ULONG SystemClass, 8 | PVOID SystemInformation, 9 | ULONG SystemInformationLength, 10 | PULONG RetLength 11 | ); 12 | 13 | typedef struct _SYSTEM_THREADS 14 | { 15 | LARGE_INTEGER KernelTime; 16 | LARGE_INTEGER UserTime; 17 | LARGE_INTEGER CreateTime; 18 | ULONG WaitTime; 19 | PVOID StartAddress; 20 | CLIENT_ID ClientID; 21 | KPRIORITY Priority; 22 | KPRIORITY BasePriority; 23 | ULONG ContextSwitchCount; 24 | ULONG ThreadState; 25 | KWAIT_REASON WaitReason; 26 | ULONG Reserved; //Add 27 | }SYSTEM_THREADS, *PSYSTEM_THREADS; 28 | 29 | typedef struct _SYSTEM_PROCESS_INFORMATION { 30 | ULONG NextEntryOffset; 31 | ULONG NumberOfThreads; 32 | LARGE_INTEGER Reserved[3]; 33 | LARGE_INTEGER CreateTime; 34 | LARGE_INTEGER UserTime; 35 | LARGE_INTEGER KernelTime; 36 | UNICODE_STRING ImageName; 37 | KPRIORITY BasePriority; 38 | HANDLE ProcessId; 39 | HANDLE InheritedFromProcessId; 40 | ULONG HandleCount; 41 | ULONG Reserved2[2]; 42 | ULONG PrivatePageCount; 43 | VM_COUNTERS VirtualMemoryCounters; 44 | IO_COUNTERS IoCounters; 45 | SYSTEM_THREADS Threads[0]; 46 | } SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION; 47 | 48 | typedef struct _OBJECT_TYPE_INITIALIZER { 49 | USHORT Length; 50 | BOOLEAN UseDefaultObject; 51 | BOOLEAN CaseInsensitive; 52 | ULONG InvalidAttributes; 53 | GENERIC_MAPPING GenericMapping; 54 | ULONG ValidAccessMask; 55 | BOOLEAN SecurityRequired; 56 | BOOLEAN MaintainHandleCount; 57 | BOOLEAN MaintainTypeList; 58 | POOL_TYPE PoolType; 59 | ULONG DefaultPagedPoolCharge; 60 | ULONG DefaultNonPagedPoolCharge; 61 | PVOID DumpProcedure; 62 | PVOID OpenProcedure; 63 | PVOID CloseProcedure; 64 | PVOID DeleteProcedure; 65 | PVOID ParseProcedure; 66 | PVOID SecurityProcedure; 67 | PVOID QueryNameProcedure; 68 | PVOID OkayToCloseProcedure; 69 | } OBJECT_TYPE_INITIALIZER, *POBJECT_TYPE_INITIALIZER; 70 | 71 | 72 | typedef struct _OBJECT_TYPE { 73 | ERESOURCE Mutex; 74 | LIST_ENTRY TypeList; 75 | UNICODE_STRING Name; // Copy from object header for convenience 76 | PVOID DefaultObject; 77 | ULONG Index; 78 | ULONG TotalNumberOfObjects; 79 | ULONG TotalNumberOfHandles; 80 | ULONG HighWaterNumberOfObjects; 81 | ULONG HighWaterNumberOfHandles; 82 | OBJECT_TYPE_INITIALIZER TypeInfo; 83 | ULONG Key; 84 | ERESOURCE ObjectLocks[4]; 85 | } OBJECT_TYPE, *POBJECT_TYPE; 86 | 87 | struct _ACTIVATION_CONTEXT; 88 | 89 | typedef struct _LDR_DATA_TABLE_ENTRY 90 | { 91 | LIST_ENTRY InLoadOrderLinks; 92 | LIST_ENTRY InMemoryOrderLinks; 93 | LIST_ENTRY InInitializationOrderLinks; 94 | PVOID DllBase; 95 | PVOID EntryPoint; 96 | ULONG SizeOfImage; 97 | UNICODE_STRING FullDllName; 98 | UNICODE_STRING BaseDllName; 99 | ULONG Flags; 100 | WORD LoadCount; 101 | WORD TlsIndex; 102 | union 103 | { 104 | LIST_ENTRY HashLinks; 105 | struct 106 | { 107 | PVOID SectionPointer; 108 | ULONG CheckSum; 109 | }; 110 | }; 111 | union 112 | { 113 | ULONG TimeDateStamp; 114 | PVOID LoadedImports; 115 | }; 116 | struct _ACTIVATION_CONTEXT * EntryPointActivationContext; 117 | PVOID PatchInformation; 118 | LIST_ENTRY ForwarderLinks; 119 | LIST_ENTRY ServiceTagLinks; 120 | LIST_ENTRY StaticLinks; 121 | } LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY; 122 | 123 | 124 | #endif // NTSTRUCT_H__ -------------------------------------------------------------------------------- /$KProtect/runsdvui.cmd: -------------------------------------------------------------------------------- 1 | cd /d "D:\搜狗高速下载\$KProtect\$KProtect" &msbuild "$KProtect.vcxproj" /t:sdvViewer /p:configuration="Debug" /p:platform=Win32 2 | exit %errorlevel% -------------------------------------------------------------------------------- /$KProtectDemo/$KProtectDemo.cpp: -------------------------------------------------------------------------------- 1 |  2 | // $KProtectDemo.cpp: 定义应用程序的类行为。 3 | // 4 | 5 | #include "stdafx.h" 6 | #include "$KProtectDemo.h" 7 | #include "$KProtectDemoDlg.h" 8 | 9 | #ifdef _DEBUG 10 | #define new DEBUG_NEW 11 | #endif 12 | 13 | 14 | // CKProtectDemoApp 15 | 16 | BEGIN_MESSAGE_MAP(CKProtectDemoApp, CWinApp) 17 | ON_COMMAND(ID_HELP, &CWinApp::OnHelp) 18 | END_MESSAGE_MAP() 19 | 20 | 21 | // CKProtectDemoApp 构造 22 | 23 | CKProtectDemoApp::CKProtectDemoApp() 24 | { 25 | // 支持重新启动管理器 26 | m_dwRestartManagerSupportFlags = AFX_RESTART_MANAGER_SUPPORT_RESTART; 27 | 28 | // TODO: 在此处添加构造代码， 29 | // 将所有重要的初始化放置在 InitInstance 中 30 | } 31 | 32 | 33 | // 唯一的 CKProtectDemoApp 对象 34 | 35 | CKProtectDemoApp theApp; 36 | 37 | 38 | // CKProtectDemoApp 初始化 39 | 40 | BOOL CKProtectDemoApp::InitInstance() 41 | { 42 | // 如果一个运行在 Windows XP 上的应用程序清单指定要 43 | // 使用 ComCtl32.dll 版本 6 或更高版本来启用可视化方式， 44 | //则需要 InitCommonControlsEx()。 否则，将无法创建窗口。 45 | INITCOMMONCONTROLSEX InitCtrls; 46 | InitCtrls.dwSize = sizeof(InitCtrls); 47 | // 将它设置为包括所有要在应用程序中使用的 48 | // 公共控件类。 49 | InitCtrls.dwICC = ICC_WIN95_CLASSES; 50 | InitCommonControlsEx(&InitCtrls); 51 | 52 | CWinApp::InitInstance(); 53 | 54 | 55 | AfxEnableControlContainer(); 56 | 57 | // 创建 shell 管理器，以防对话框包含 58 | // 任何 shell 树视图控件或 shell 列表视图控件。 59 | CShellManager *pShellManager = new CShellManager; 60 | 61 | // 激活“Windows Native”视觉管理器，以便在 MFC 控件中启用主题 62 | CMFCVisualManager::SetDefaultManager(RUNTIME_CLASS(CMFCVisualManagerWindows)); 63 | 64 | // 标准初始化 65 | // 如果未使用这些功能并希望减小 66 | // 最终可执行文件的大小，则应移除下列 67 | // 不需要的特定初始化例程 68 | // 更改用于存储设置的注册表项 69 | // TODO: 应适当修改该字符串， 70 | // 例如修改为公司或组织名 71 | SetRegistryKey(_T("应用程序向导生成的本地应用程序")); 72 | 73 | CKProtectDemoDlg dlg; 74 | m_pMainWnd = &dlg; 75 | INT_PTR nResponse = dlg.DoModal(); 76 | if (nResponse == IDOK) 77 | { 78 | // TODO: 在此放置处理何时用 79 | // “确定”来关闭对话框的代码 80 | } 81 | else if (nResponse == IDCANCEL) 82 | { 83 | // TODO: 在此放置处理何时用 84 | // “取消”来关闭对话框的代码 85 | } 86 | else if (nResponse == -1) 87 | { 88 | TRACE(traceAppMsg, 0, "警告: 对话框创建失败，应用程序将意外终止。\n"); 89 | TRACE(traceAppMsg, 0, "警告: 如果您在对话框上使用 MFC 控件，则无法 #define _AFX_NO_MFC_CONTROLS_IN_DIALOGS。\n"); 90 | } 91 | 92 | // 删除上面创建的 shell 管理器。 93 | if (pShellManager != nullptr) 94 | { 95 | delete pShellManager; 96 | } 97 | 98 | #if !defined(_AFXDLL) && !defined(_AFX_NO_MFC_CONTROLS_IN_DIALOGS) 99 | ControlBarCleanUp(); 100 | #endif 101 | 102 | // 由于对话框已关闭，所以将返回 FALSE 以便退出应用程序， 103 | // 而不是启动应用程序的消息泵。 104 | return FALSE; 105 | } 106 | 107 | -------------------------------------------------------------------------------- /$KProtectDemo/$KProtectDemo.h: -------------------------------------------------------------------------------- 1 |  2 | // $KProtectDemo.h: PROJECT_NAME 应用程序的主头文件 3 | // 4 | 5 | #pragma once 6 | 7 | #ifndef __AFXWIN_H__ 8 | #error "在包含此文件之前包含“stdafx.h”以生成 PCH 文件" 9 | #endif 10 | 11 | #include "resource.h" // 主符号 12 | 13 | 14 | // CKProtectDemoApp: 15 | // 有关此类的实现，请参阅 $KProtectDemo.cpp 16 | // 17 | 18 | class CKProtectDemoApp : public CWinApp 19 | { 20 | public: 21 | CKProtectDemoApp(); 22 | 23 | // 重写 24 | public: 25 | virtual BOOL InitInstance(); 26 | 27 | // 实现 28 | 29 | DECLARE_MESSAGE_MAP() 30 | }; 31 | 32 | extern CKProtectDemoApp theApp; 33 | -------------------------------------------------------------------------------- /$KProtectDemo/$KProtectDemo.vcxproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | Release 10 | Win32 11 | 12 | 13 | Debug 14 | x64 15 | 16 | 17 | Release 18 | x64 19 | 20 | 21 | 22 | 15.0 23 | {C6ACAB17-D753-4789-9805-B99F029247A7} 24 | MFCProj 25 | KProtectDemo 26 | 10.0.17763.0 27 | 28 | 29 | 30 | Application 31 | true 32 | v141 33 | Unicode 34 | Static 35 | 36 | 37 | Application 38 | false 39 | v141 40 | true 41 | Unicode 42 | Static 43 | 44 | 45 | Application 46 | true 47 | v141 48 | Unicode 49 | Static 50 | 51 | 52 | Application 53 | false 54 | v141 55 | true 56 | Unicode 57 | Static 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | 75 | 76 | 77 | 78 | true 79 | $KDemo 80 | 81 | 82 | true 83 | 84 | 85 | false 86 | 87 | 88 | false 89 | 90 | 91 | 92 | Use 93 | Level3 94 | Disabled 95 | true 96 | _WINDOWS;_DEBUG;%(PreprocessorDefinitions) 97 | 98 | 99 | Windows 100 | 101 | 102 | false 103 | true 104 | _DEBUG;%(PreprocessorDefinitions) 105 | 106 | 107 | 0x0804 108 | _DEBUG;%(PreprocessorDefinitions) 109 | $(IntDir);%(AdditionalIncludeDirectories) 110 | 111 | 112 | 113 | 114 | Use 115 | Level3 116 | Disabled 117 | true 118 | WIN32;_WINDOWS;_DEBUG;%(PreprocessorDefinitions) 119 | 120 | 121 | Windows 122 | 123 | 124 | false 125 | true 126 | _DEBUG;%(PreprocessorDefinitions) 127 | 128 | 129 | 0x0804 130 | _DEBUG;%(PreprocessorDefinitions) 131 | $(IntDir);%(AdditionalIncludeDirectories) 132 | 133 | 134 | 135 | 136 | Use 137 | Level3 138 | MaxSpeed 139 | true 140 | true 141 | true 142 | WIN32;_WINDOWS;NDEBUG;%(PreprocessorDefinitions) 143 | 144 | 145 | Windows 146 | true 147 | true 148 | 149 | 150 | false 151 | true 152 | NDEBUG;%(PreprocessorDefinitions) 153 | 154 | 155 | 0x0804 156 | NDEBUG;%(PreprocessorDefinitions) 157 | $(IntDir);%(AdditionalIncludeDirectories) 158 | 159 | 160 | 161 | 162 | Use 163 | Level3 164 | MaxSpeed 165 | true 166 | true 167 | true 168 | _WINDOWS;NDEBUG;%(PreprocessorDefinitions) 169 | 170 | 171 | Windows 172 | true 173 | true 174 | 175 | 176 | false 177 | true 178 | NDEBUG;%(PreprocessorDefinitions) 179 | 180 | 181 | 0x0804 182 | NDEBUG;%(PreprocessorDefinitions) 183 | $(IntDir);%(AdditionalIncludeDirectories) 184 | 185 | 186 | 187 | 188 | 189 | 190 | 191 | 192 | 193 | 194 | 195 | 196 | 197 | 198 | 199 | Create 200 | Create 201 | Create 202 | Create 203 | 204 | 205 | 206 | 207 | 208 | 209 | 210 | 211 | 212 | 213 | 214 | 215 | 216 | 217 | -------------------------------------------------------------------------------- /$KProtectDemo/$KProtectDemo.vcxproj.filters: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hh;hpp;hxx;hm;inl;inc;ipp;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | 18 | 19 | 头文件 20 | 21 | 22 | 头文件 23 | 24 | 25 | 头文件 26 | 27 | 28 | 头文件 29 | 30 | 31 | 头文件 32 | 33 | 34 | 头文件 35 | 36 | 37 | 38 | 39 | 源文件 40 | 41 | 42 | 源文件 43 | 44 | 45 | 源文件 46 | 47 | 48 | 源文件 49 | 50 | 51 | 52 | 53 | 资源文件 54 | 55 | 56 | 57 | 58 | 资源文件 59 | 60 | 61 | 62 | 63 | 资源文件 64 | 65 | 66 | -------------------------------------------------------------------------------- /$KProtectDemo/$KProtectDemo.vcxproj.user: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | KProtectDemo.rc 5 | 6 | -------------------------------------------------------------------------------- /$KProtectDemo/$KProtectDemoDlg.cpp: -------------------------------------------------------------------------------- 1 |  2 | // $KProtectDemoDlg.cpp: 实现文件 3 | // 4 | 5 | #include "stdafx.h" 6 | #include "$KProtectDemo.h" 7 | #include "$KProtectDemoDlg.h" 8 | #include "afxdialogex.h" 9 | 10 | #ifdef _DEBUG 11 | #define new DEBUG_NEW 12 | #endif 13 | 14 | #include "AntiDebug.h" 15 | 16 | DWORD WINAPI LoopThread(LPVOID lpParameter) 17 | { 18 | while (true) 19 | { 20 | Sleep(1000); 21 | GetKernelDebugger(lpParameter); 22 | } 23 | } 24 | 25 | 26 | // CKProtectDemoDlg 对话框 27 | 28 | 29 | 30 | CKProtectDemoDlg::CKProtectDemoDlg(CWnd* pParent /*=nullptr*/) 31 | : CDialogEx(IDD_KPROTECTDEMO_DIALOG, pParent) 32 | { 33 | m_hIcon = AfxGetApp()->LoadIcon(IDR_MAINFRAME); 34 | } 35 | 36 | void CKProtectDemoDlg::DoDataExchange(CDataExchange* pDX) 37 | { 38 | CDialogEx::DoDataExchange(pDX); 39 | } 40 | 41 | BEGIN_MESSAGE_MAP(CKProtectDemoDlg, CDialogEx) 42 | ON_WM_PAINT() 43 | ON_WM_QUERYDRAGICON() 44 | ON_BN_CLICKED(IDC_BUTTON1, &CKProtectDemoDlg::OnBnClickedButton1) 45 | END_MESSAGE_MAP() 46 | 47 | 48 | // CKProtectDemoDlg 消息处理程序 49 | 50 | BOOL CKProtectDemoDlg::OnInitDialog() 51 | { 52 | CDialogEx::OnInitDialog(); 53 | 54 | // 设置此对话框的图标。 当应用程序主窗口不是对话框时，框架将自动 55 | // 执行此操作 56 | SetIcon(m_hIcon, TRUE); // 设置大图标 57 | SetIcon(m_hIcon, FALSE); // 设置小图标 58 | 59 | CreateThread(NULL, 0, LoopThread, GetCurrentThread(), 0, NULL); 60 | return TRUE; // 除非将焦点设置到控件，否则返回 TRUE 61 | } 62 | 63 | // 如果向对话框添加最小化按钮，则需要下面的代码 64 | // 来绘制该图标。 对于使用文档/视图模型的 MFC 应用程序， 65 | // 这将由框架自动完成。 66 | 67 | void CKProtectDemoDlg::OnPaint() 68 | { 69 | if (IsIconic()) 70 | { 71 | CPaintDC dc(this); // 用于绘制的设备上下文 72 | 73 | SendMessage(WM_ICONERASEBKGND, reinterpret_cast(dc.GetSafeHdc()), 0); 74 | 75 | // 使图标在工作区矩形中居中 76 | int cxIcon = GetSystemMetrics(SM_CXICON); 77 | int cyIcon = GetSystemMetrics(SM_CYICON); 78 | CRect rect; 79 | GetClientRect(&rect); 80 | int x = (rect.Width() - cxIcon + 1) / 2; 81 | int y = (rect.Height() - cyIcon + 1) / 2; 82 | 83 | // 绘制图标 84 | dc.DrawIcon(x, y, m_hIcon); 85 | } 86 | else 87 | { 88 | CDialogEx::OnPaint(); 89 | } 90 | } 91 | 92 | //当用户拖动最小化窗口时系统调用此函数取得光标 93 | //显示。 94 | HCURSOR CKProtectDemoDlg::OnQueryDragIcon() 95 | { 96 | return static_cast(m_hIcon); 97 | } 98 | 99 | 100 | 101 | 102 | void CKProtectDemoDlg::OnBnClickedButton1() 103 | { 104 | MessageBox(L"那怎么可能兑现呢 扯鸡巴蛋呢", L"某总：", MB_OK); 105 | } 106 | -------------------------------------------------------------------------------- /$KProtectDemo/$KProtectDemoDlg.h: -------------------------------------------------------------------------------- 1 |  2 | // $KProtectDemoDlg.h: 头文件 3 | // 4 | 5 | #pragma once 6 | 7 | 8 | // CKProtectDemoDlg 对话框 9 | class CKProtectDemoDlg : public CDialogEx 10 | { 11 | // 构造 12 | public: 13 | CKProtectDemoDlg(CWnd* pParent = nullptr); // 标准构造函数 14 | 15 | // 对话框数据 16 | #ifdef AFX_DESIGN_TIME 17 | enum { IDD = IDD_KPROTECTDEMO_DIALOG }; 18 | #endif 19 | 20 | protected: 21 | virtual void DoDataExchange(CDataExchange* pDX); // DDX/DDV 支持 22 | 23 | 24 | // 实现 25 | protected: 26 | HICON m_hIcon; 27 | 28 | // 生成的消息映射函数 29 | virtual BOOL OnInitDialog(); 30 | afx_msg void OnPaint(); 31 | afx_msg HCURSOR OnQueryDragIcon(); 32 | DECLARE_MESSAGE_MAP() 33 | public: 34 | afx_msg void OnBnClickedButton1(); 35 | }; 36 | -------------------------------------------------------------------------------- /$KProtectDemo/AntiDebug.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wanttobeno/KProtect/daae9569cf405200a837f894140b281daa3f6097/$KProtectDemo/AntiDebug.cpp -------------------------------------------------------------------------------- /$KProtectDemo/AntiDebug.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | 4 | void GetKernelDebugger(HANDLE hMainThread); -------------------------------------------------------------------------------- /$KProtectDemo/KProtectDemo.rc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wanttobeno/KProtect/daae9569cf405200a837f894140b281daa3f6097/$KProtectDemo/KProtectDemo.rc -------------------------------------------------------------------------------- /$KProtectDemo/res/$KProtectDemo.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wanttobeno/KProtect/daae9569cf405200a837f894140b281daa3f6097/$KProtectDemo/res/$KProtectDemo.ico -------------------------------------------------------------------------------- /$KProtectDemo/res/KProtectDemo.rc2: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wanttobeno/KProtect/daae9569cf405200a837f894140b281daa3f6097/$KProtectDemo/res/KProtectDemo.rc2 -------------------------------------------------------------------------------- /$KProtectDemo/resource.h: -------------------------------------------------------------------------------- 1 | //{{NO_DEPENDENCIES}} 2 | // Microsoft Visual C++ 生成的包含文件。 3 | // 供 KProtectDemo.rc 使用 4 | // 5 | #define IDD_KPROTECTDEMO_DIALOG 102 6 | #define IDR_MAINFRAME 128 7 | #define IDC_BUTTON1 1000 8 | 9 | // Next default values for new objects 10 | // 11 | #ifdef APSTUDIO_INVOKED 12 | #ifndef APSTUDIO_READONLY_SYMBOLS 13 | #define _APS_NEXT_RESOURCE_VALUE 130 14 | #define _APS_NEXT_COMMAND_VALUE 32771 15 | #define _APS_NEXT_CONTROL_VALUE 1001 16 | #define _APS_NEXT_SYMED_VALUE 101 17 | #endif 18 | #endif 19 | -------------------------------------------------------------------------------- /$KProtectDemo/stdafx.cpp: -------------------------------------------------------------------------------- 1 |  2 | // stdafx.cpp : 只包括标准包含文件的源文件 3 | // $KProtectDemo.pch 将作为预编译标头 4 | // stdafx.obj 将包含预编译类型信息 5 | 6 | #include "stdafx.h" 7 | 8 | 9 | -------------------------------------------------------------------------------- /$KProtectDemo/stdafx.h: -------------------------------------------------------------------------------- 1 |  2 | // stdafx.h : 标准系统包含文件的包含文件， 3 | // 或是经常使用但不常更改的 4 | // 特定于项目的包含文件 5 | 6 | #pragma once 7 | 8 | #ifndef VC_EXTRALEAN 9 | #define VC_EXTRALEAN // 从 Windows 头中排除极少使用的资料 10 | #endif 11 | 12 | #include "targetver.h" 13 | 14 | #define _ATL_CSTRING_EXPLICIT_CONSTRUCTORS // 某些 CString 构造函数将是显式的 15 | 16 | // 关闭 MFC 对某些常见但经常可放心忽略的警告消息的隐藏 17 | #define _AFX_ALL_WARNINGS 18 | 19 | #include // MFC 核心组件和标准组件 20 | #include // MFC 扩展 21 | 22 | 23 | #include // MFC 自动化类 24 | 25 | 26 | 27 | #ifndef _AFX_NO_OLE_SUPPORT 28 | #include // MFC 对 Internet Explorer 4 公共控件的支持 29 | #endif 30 | #ifndef _AFX_NO_AFXCMN_SUPPORT 31 | #include // MFC 对 Windows 公共控件的支持 32 | #endif // _AFX_NO_AFXCMN_SUPPORT 33 | 34 | #include // 功能区和控件条的 MFC 支持 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | 44 | #ifdef _UNICODE 45 | #if defined _M_IX86 46 | #pragma comment(linker,"/manifestdependency:\"type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='x86' publicKeyToken='6595b64144ccf1df' language='*'\"") 47 | #elif defined _M_X64 48 | #pragma comment(linker,"/manifestdependency:\"type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='amd64' publicKeyToken='6595b64144ccf1df' language='*'\"") 49 | #else 50 | #pragma comment(linker,"/manifestdependency:\"type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='*' publicKeyToken='6595b64144ccf1df' language='*'\"") 51 | #endif 52 | #endif 53 | 54 | 55 | -------------------------------------------------------------------------------- /$KProtectDemo/targetver.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | // 包括 SDKDDKVer.h 将定义可用的最高版本的 Windows 平台。 4 | 5 | // 如果要为以前的 Windows 平台生成应用程序，请包括 WinSDKVer.h，并将 6 | // 将 _WIN32_WINNT 宏设置为要支持的平台，然后再包括 SDKDDKVer.h。 7 | 8 | #include 9 | -------------------------------------------------------------------------------- /README.MD: -------------------------------------------------------------------------------- 1 | 2 | ##### 说明 3 | 4 | 补充的缺失的代码。丢在硬盘都遗忘了，上传备份下。 5 | 6 | 仅供学习，不保证效果。 7 | 8 | 9 | ##### 资源来源说明 10 | 11 | 来自 [某总$KProtect 价值3000元的公司级反调试产品 还原复现开源](https://bbs.pediy.com/thread-250468.htm) 12 | 13 | #### 驱动保护功能说明 14 | 15 | ##### 0x01 隐藏进程 16 | 原理没什么多说的，基本就是 @xiaofu 所分析的 17 | 将 EPROCESS->InheritedFromUniqueProcessId 置为 System 18 | 将 EPROCESS->UniqueProcessId 置为 winlogon.exe（其他系统进程皆可） 19 | 通过动态获取 InheritedFromUniqueProcessId 和 UniqueProcessId 偏移 提高兼容性 20 | 值得注意的是，此方法会在 低版本 Win7系统 任务管理器 出现 Bug 21 | 现象是 winlogon 的进程会疯狂增加 且增加的进程 Pid 为 -1 22 | （仅仅只是任务管理器表项增加 实际进程只有一个） 23 | 在高版本 Win7 和 Win10 没有此现象 24 | 25 | ##### 0x02 回调保护 26 | 通过 ObRegisterCallbacks 注册 Process 和 Thread 回调 27 | 28 | 当目标进程为被保护进程时，进行降权处理 29 | 30 | 在使用了隐藏进程后，回调貌似并没有什么作用 31 | 32 | 在 CheatEngine 通过进程名所找到的 Demo 实为 winlogon.exe 的进程 33 | 34 | 所访问的内存也是属于 winlogon.exe 进程 35 | 36 | 所以回调的作用也仅仅在隐藏进程被攻破后才有作用 37 | 38 | 39 | 40 | ##### 0x03 全局调试权限 调试端口 清零 41 | 通过 NtCreateDebugObject 函数地址 往后遍历特征码 计算得出 DbgkDebugObjectType 的指针 42 | 然后通过结构体 对 ValidAccessMask 标识置 0 43 | 如果要防止被还原，可在线程中循环对此标识置 0 或监控，再对线程做 crc 44 | 45 | 动态取出 DebugPort 的偏移 在用线程循环判断是否有值 46 | 47 | ##### 0x04 HOOK DBG API 48 | Hook DbgUiRemoteBreakin 49 | 50 | Hook DbgBreakPoint 51 | 这里学习某眼睛的操作，比某总多 Hook 了一个 DbgBreakPoint 52 | 53 | 将 DbgUiRemoteBreakin Jmp到 LdrShutdownProcess 实现调用此 Api 程序直接退出 54 | 55 | 而 DbgBreakPoint 则直接对其 int3 写 ret 即可 56 | 57 | 58 | 59 | ##### 0x05 检查标识位 60 | 调用 ZwQuerySystemInformation 61 | 检查 SystemKernelDebuggerInformation 中的 KernelDebuggerEnabled 是否为 true 62 | 检查 SystemKernelDebuggerInformation 中的 KernelDebuggerNotPresent 是否为 false 63 | 调用 ZwQueryInformationProcess 64 | 65 | 检查 ProcessDebugPort 是否有值 66 | 67 | 检查 ProcessDebugObjectHandle 是否有值 68 | 69 | 检查 ProcessDebugFlags 是否为 0 70 | 71 | 取得 PEB 指针 72 | 73 | 检查 BeingDebugged 是否为 1 74 | 75 | 扫描 Ldr 指向的内存是否填充 0xFEEEFEEE 76 | 77 | 检查 ProcessHeap->Flags 标识 78 | 79 | 检查 NtGlobalFlag 标识 80 | 81 | 附件项目里的只是通过 __readfsdword 取得的 Peb 指针 82 | 仅支持在 x86 编译环境下使用，x64 的自己想办法 83 | 标志位只是简单输出了一下 请自行写判断 84 | （算是留的 2 个小坑 防止伸手党） 85 | 86 | ##### 0x06 断下崩溃 87 | 调用 ZwSetInformationThread 对 ThreadHideFromDebugger 置 NULL 使线程对调试器隐藏 阻止调试事件发往调试器 88 | 参数一为线程句柄，由于附件中的 Demo 是直接创建的线程来循环操作的 89 | 如果直接 GetCurrentThread() 调用一次，则在主线程内断下不会崩溃 90 | 所以通过线程参数，将主线程句柄也传递过来调用 2 次 91 | 92 | ##### 0x07 疯狂抛异常 93 | 异常肯定还有更好用的，不过try肯定是最简单的 94 | 95 | 96 | #### 其他 97 | 98 | [新版xxprotect保护调试以及其x64隐藏进程等原理](https://bbs.pediy.com/thread-250404.htm) 99 | 100 | 101 | [如何调试xxProtect](https://bbs.pediy.com/thread-248918.htm) 102 | 103 | 104 | 105 | 106 | --------------------------------------------------------------------------------