本人不保证此办法现在还生效！蓝屏死机于本人无关！

完美保护里面有个反调试比较BT，不过多开更bt。（梦幻诛仙为例）

第一，先说一些ssdt hook和inline hook的解决办法，也就是hook Kifastcallentry 来搞。
第二，附加卡死情况的解决。完美驱动会获取FastMutex而不释放，导致卡死情况。
发一小段代码

ULONG ExReleaseFastMutex_addr,ReExReleaseFastMutex_addr; 
char g_ExReleaseFastMutex[8]; 
 
VOID GetExReleaseFastMutexAddr() 
{ 
    ULONG  Address=0; 
    ULONG temp_addr; 
    char* temp_cr=0; 
    Address = (ULONG)_KeServiceDescriptorTable->NotUse1.ServiceTableBase + 269 * 4;         
 
    temp_addr = *(ULONG*)Address; 
    temp_addr=temp_addr+0x19A; 
    temp_cr=(char*)temp_addr; 
    ExReleaseFastMutex_addr=*((ULONG*)&temp_cr[2]); 
    ExReleaseFastMutex_addr=*(ULONG*)ExReleaseFastMutex_addr; 
 
 
} 
VOID __declspec(naked)MyExReleaseFastMutex() 
{ 
    __asm 
    { 
        cmp        ecx,DbgkpProcessDebugPortMutexaddr 
        jnz        ONMYFAST 
        mov        ecx,pMyDbgkpProcessDebugPortMutex 
ONMYFAST: 
        xor     eax, eax 
        mov     al, [ecx + 0x1c] 
        jmp        [ReExReleaseFastMutex_addr] 
 
    } 
 
} 
 
 
VOID Patch_ExReleaseFastMutex() 
{ 
    KIRQL oldIrql; 
    unsigned char newcode[] = { 0xE9, 0x44, 0x33, 0x22, 0x11}; 
 
    GetExReleaseFastMutexAddr(); 
 
    ReExReleaseFastMutex_addr=ExReleaseFastMutex_addr+5; 
 
    *( (ULONG *)(&newcode[1]) ) =(ULONG)MyExReleaseFastMutex-ExReleaseFastMutex_addr-5; 
 
 
    WPOFF(); 
    oldIrql = KeRaiseIrqlToDpcLevel(); 
 
    memcpy(g_ExReleaseFastMutex,(VOID*)ExReleaseFastMutex_addr,5); 
    memcpy((VOID*)ExReleaseFastMutex_addr,newcode,5); 
 
    KeLowerIrql(oldIrql); 
    WPON(); 
 
 
} 
 
VOID UnPatch_ExReleaseFastMutex() 
{ 
    KIRQL oldIrql; 
     
    WPOFF(); 
    oldIrql = KeRaiseIrqlToDpcLevel(); 
 
    memcpy((VOID*)ExReleaseFastMutex_addr,g_ExReleaseFastMutex,5); 
 
    KeLowerIrql(oldIrql); 
    WPON(); 
 
 
} 

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课