发现在Object钩子下有PreOperation和PostOperation的钩子。这个就是我们驱动挂的钩子。那么XT是何如检测这个钩子的?

x64系统过TP大概分两步，首先要过双机调试，然后要过应用层调试。

一

1、过双机调试，这里也分两步

(1)首先要保证debug模式下启动游戏不蓝屏。

我也是第一次研究TP，对这之前的保护不了解，不过看网上所说这个启动蓝屏似乎是最近几个月新加的。

要过这个需要对内核调试引擎有一定的了解，不过还好我们是站在巨♂人♀的肩膀上，在网上找到了篇帖子，比较详细的分析了系统启动时内核调试引擎初始化的几个标志。

TP只是检测了其中一个(待定)，KdEnteredDebugger，它通过MDL映射来判断这个标志是不是True，如果是就蓝屏，解决方法我照抄了那篇帖子，直接在Hook一下IoAllocateMdl，

把判断的地址改到一个恒为False的地方这样就可以绕过了

https://bbs.pediy.com/thread-247940.htm

下面是我处理的方法

1.Hook KdpTrap过滤TASLogin.exe制造的r3异常，防止windbg一直弹 The context is partially valid. Only x86 user-mode context is available. 

2.SharedUserData->KdDebuggerEnabled = FALSE;  //防止安全组件加载失败

3.HideDriver("kdcom.dll");   // 断链隐藏 kdcom，防止kdcom内存被清空导致和windbg通讯不了

4.ba w1 KdDebuggerEnabled 找到某P清零 KdDebuggerEnabled的位置，让它清零其他地方去，防止windbg的break失效

二

1.进程隐藏

在任务管理器和调试器中看不到xxprotect.exe的进程名，但是直接遍历却可以遍历到

windbg跟踪一波,发现其驱动在初始化阶段会设置保护进程的eprocess.InheritedFromUniqueProcessId 和 eprocess.UniqueProcessId

把父进程PID设置为4，进程ID设置为winlongon的pid，即可“隐藏进程”。

Windows 反调试技术——OpenProcess 权限过滤

之移除 OpenProcess 权限过滤

kd>!list -x ".if (poi(@$extret+0x28) != 0) { .echo handler at; ?? @$extret+0x28; u poi(@$extret+0x28); }" (poi(nt!PsProcessType)+0xc8)

一旦发现了正确的属性地址，我们使用下面的命令将其置为 NULL，以此来禁止回调句柄：

eq 0xffffa002`d31bacf8 0

记住还有线程

我们已经知道 ObRegisterCallbacks 函数可以给 OpenProcess 加上钩子函数，还能做什么呢？再次查看官方文档发现，ObRegisterCallbacks 也可以给 OpenThread 加上钩子。

kd>!list -x ".if (poi(@$extret+0x28) != 0) { .echo handler at; ?? @$extret+0x28; u poi(@$extret+0x28); }" (poi(nt!PsThreadType)+0xc8)

eq 0xffffc581`89df32e8 0

///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////

1.分析DebugPort清零

kd> !process 0 0 dnf.exe;g

PROCESS ffffb282a86ad080

SessionId: 1 Cid: 0768 Peb: 0030e000 ParentCid: 0d2c

DirBase: 8a600000 ObjectTable: 00000000 HandleCount: 0.

Image: DxF.exe

PROCESS ffffb282a8cc4080

SessionId: 1 Cid: 19bc Peb: 002a8000 ParentCid: 1f50

DirBase: bc000000 ObjectTable: 00000000 HandleCount: 0.

Image: DxF.exe

PROCESS ffffb282a8c3e540

SessionId: 1 Cid: 149c Peb: 002bc000 ParentCid: 19bc

DirBase: b4e00000 ObjectTable: ffffd88be2684600 HandleCount: 2536.

Image: DxF.exe

kd> dt _EPROCESS ffffb282a8c3e540 +0x420

nt!_EPROCESS

+0x000 Pcb : _KPROCESS

+0x2d8 ProcessLock : _EX_PUSH_LOCK

+0x2e0 UniqueProcessId : 0x00000000`0000149c Void

+0x2e8 ActiveProcessLinks : _LIST_ENTRY [ 0xffffb282`a8565368 - 0xffffb282`ab02b7a8 ]

+0x2f8 RundownProtect : _EX_RUNDOWN_REF

+0x300 Flags2 : 0x200d014

+0x300 JobNotReallyActive : 0y0

+0x300 AccountingFolded : 0y0

+0x300 NewProcessReported : 0y1

+0x300 ExitProcessReported : 0y0

+0x300 ReportCommitChanges : 0y1

+0x300 LastReportMemory : 0y0

+0x300 ForceWakeCharge : 0y0

+0x300 CrossSessionCreate : 0y0

+0x300 NeedsHandleRundown : 0y0

+0x300 RefTraceEnabled : 0y0

+0x300 PicoCreated : 0y0

+0x300 EmptyJobEvaluated : 0y0

+0x300 DefaultPagePriority : 0y101

+0x300 PrimaryTokenFrozen : 0y1

+0x300 ProcessVerifierTarget : 0y0

+0x300 RestrictSetThreadContext : 0y0

+0x300 AffinityPermanent : 0y0

+0x300 AffinityUpdateEnable : 0y0

+0x300 PropagateNode : 0y0

+0x300 ExplicitAffinity : 0y0

+0x300 ProcessExecutionState : 0y00

+0x300 EnableReadVmLogging : 0y0

+0x300 EnableWriteVmLogging : 0y1

+0x300 FatalAccessTerminationRequested : 0y0

+0x300 DisableSystemAllowedCpuSet : 0y0

+0x300 ProcessStateChangeRequest : 0y00

+0x300 ProcessStateChangeInProgress : 0y0

+0x300 InPrivate : 0y0

+0x304 Flags : 0x944dde03

+0x304 CreateReported : 0y1

+0x304 NoDebugInherit : 0y1

+0x304 ProcessExiting : 0y0

+0x304 ProcessDelete : 0y0

+0x304 ManageExecutableMemoryWrites : 0y0

+0x304 VmDeleted : 0y0

+0x304 OutswapEnabled : 0y0

+0x304 Outswapped : 0y0

+0x304 FailFastOnCommitFail : 0y0

+0x304 Wow64VaSpace4Gb : 0y1

+0x304 AddressSpaceInitialized : 0y11

+0x304 SetTimerResolution : 0y1

+0x304 BreakOnTermination : 0y0

+0x304 DeprioritizeViews : 0y1

+0x304 WriteWatch : 0y1

+0x304 ProcessInSession : 0y1

+0x304 OverrideAddressSpace : 0y0

+0x304 HasAddressSpace : 0y1

+0x304 LaunchPrefetched : 0y1

+0x304 Background : 0y0

+0x304 VmTopDown : 0y0

+0x304 ImageNotifyDone : 0y1

+0x304 PdeUpdateNeeded : 0y0

+0x304 VdmAllowed : 0y0

+0x304 ProcessRundown : 0y0

+0x304 ProcessInserted : 0y1

+0x304 DefaultIoPriority : 0y010

+0x304 ProcessSelfDelete : 0y0

+0x304 SetTimerResolutionLink : 0y1

+0x308 CreateTime : _LARGE_INTEGER 0x01d542b7`6e3b4402

+0x310 ProcessQuotaUsage : [2] 0x553d8

+0x320 ProcessQuotaPeak : [2] 0x675a0

+0x330 PeakVirtualSize : 0x7c334000

+0x338 VirtualSize : 0x6fbc8000

+0x340 SessionProcessLinks : _LIST_ENTRY [ 0xffffb282`a85653c0 - 0xffffb282`ab02b800 ]

+0x350 ExceptionPortData : 0xffffb282`a19c7db0 Void

+0x350 ExceptionPortValue : 0xffffb282`a19c7db0

+0x350 ExceptionPortState : 0y000

+0x358 Token : _EX_FAST_REF

+0x360 MmReserved : 0

+0x368 AddressCreationLock : _EX_PUSH_LOCK

+0x370 PageTableCommitmentLock : _EX_PUSH_LOCK

+0x378 RotateInProgress : (null)

+0x380 ForkInProgress : (null)

+0x388 CommitChargeJob : 0xffffb282`a40eb060 _EJOB

+0x390 CloneRoot : _RTL_AVL_TREE

+0x398 NumberOfPrivatePages : 0x4a339

+0x3a0 NumberOfLockedPages : 0

+0x3a8 Win32Process : 0xfffff3a7`c76f2010 Void

+0x3b0 Job : 0xffffb282`a40eb060 _EJOB

+0x3b8 SectionObject : 0xffffd88b`e1ebe330 Void

+0x3c0 SectionBaseAddress : 0x00000000`00400000 Void

+0x3c8 Cookie : 0xe0568688

+0x3d0 WorkingSetWatch : (null)

+0x3d8 Win32WindowStation : 0x00000000`0000012c Void

+0x3e0 InheritedFromUniqueProcessId : 0x00000000`000019bc Void

+0x3e8 Spare0 : (null)

+0x3f0 OwnerProcessId : 0x19bc

+0x3f8 Peb : 0x00000000`002bc000 _PEB

+0x400 Session : 0xffffa101`bc101000 _MM_SESSION_SPACE

+0x408 Spare1 : (null)

+0x410 QuotaBlock : 0xffffb282`a4ebbac0 _EPROCESS_QUOTA_BLOCK

+0x418 ObjectTable : 0xffffd88b`e2684600 _HANDLE_TABLE

+0x420 DebugPort : (null)     /////没附加就是这个NULL附加就会填充不等于0的值，TP会清零

+0x428 WoW64Process : 0xffffb282`a44da1f0 _EWOW64PROCESS

+0x430 DeviceMap : 0xffffd88b`d86f4bd0 Void

+0x438 EtwDataSource : 0xffffb282`a8884bd0 Void

+0x440 PageDirectoryPte : 0

+0x448 ImageFilePointer : 0xffffb282`a9b0ab60 _FILE_OBJECT

+0x450 ImageFileName : [15] "dnf.exe"

+0x45f PriorityClass : 0x2 ''

+0x460 SecurityPort : (null)

+0x468 SeAuditProcessCreationInfo : _SE_AUDIT_PROCESS_CREATION_INFO

+0x470 JobLinks : _LIST_ENTRY [ 0xffffb282`a85654f0 - 0xffffb282`ab02b930 ]

+0x480 HighestUserAddress : 0x00000000`ffff0000 Void

+0x488 ThreadListHead : _LIST_ENTRY [ 0xffffb282`a8cbf728 - 0xffffb282`a86b7728 ]

+0x498 ActiveThreads : 0x75

+0x49c ImagePathHash : 0xaace0de5

+0x4a0 DefaultHardErrorProcessing : 0x8000

+0x4a4 LastThreadExitStatus : 0n0

+0x4a8 PrefetchTrace : _EX_FAST_REF

+0x4b0 LockedPagesList : (null)

+0x4b8 ReadOperationCount : _LARGE_INTEGER 0x30

+0x4c0 WriteOperationCount : _LARGE_INTEGER 0x19

+0x4c8 OtherOperationCount : _LARGE_INTEGER 0x210

+0x4d0 ReadTransferCount : _LARGE_INTEGER 0x1dac

+0x4d8 WriteTransferCount : _LARGE_INTEGER 0x6336

+0x4e0 OtherTransferCount : _LARGE_INTEGER 0x1e635

+0x4e8 CommitChargeLimit : 0

+0x4f0 CommitCharge : 0x54538

+0x4f8 CommitChargePeak : 0x606bb

+0x500 Vm : _MMSUPPORT_FULL

+0x610 MmProcessLinks : _LIST_ENTRY [ 0xffffb282`a8565690 - 0xffffb282`ab02bad0 ]

+0x620 ModifiedPageCount : 0x8c643

+0x624 ExitStatus : 0n259

+0x628 VadRoot : _RTL_AVL_TREE

+0x630 VadHint : 0xffffb282`a8907c20 Void

+0x638 VadCount : 0x7e3

+0x640 VadPhysicalPages : 0

+0x648 VadPhysicalPagesLimit : 0

+0x650 AlpcContext : _ALPC_PROCESS_CONTEXT

+0x670 TimerResolutionLink : _LIST_ENTRY [ 0xffffb282`a84cc6f0 - 0xffffb282`a42796f0 ]

+0x680 TimerResolutionStackRecord : 0xffffd88b`dd3fd950 _PO_DIAG_STACK_RECORD

+0x688 RequestedTimerResolution : 0x2710

+0x68c SmallestTimerResolution : 0x2710

+0x690 ExitTime : _LARGE_INTEGER 0x0

+0x698 InvertedFunctionTable : (null)

+0x6a0 InvertedFunctionTableLock : _EX_PUSH_LOCK

+0x6a8 ActiveThreadsHighWatermark : 0x7e

+0x6ac LargePrivateVadCount : 0

+0x6b0 ThreadListLock : _EX_PUSH_LOCK

+0x6b8 WnfContext : 0xffffd88b`e1ebf820 Void

+0x6c0 ServerSilo : (null)

+0x6c8 SignatureLevel : 0 ''

+0x6c9 SectionSignatureLevel : 0 ''

+0x6ca Protection : _PS_PROTECTION

+0x6cb HangCount : 0y000

+0x6cb GhostCount : 0y000

+0x6cb PrefilterException : 0y0

+0x6cc Flags3 : 0x40c008

+0x6cc Minimal : 0y0

+0x6cc ReplacingPageRoot : 0y0

+0x6cc Crashed : 0y0

+0x6cc JobVadsAreTracked : 0y1

+0x6cc VadTrackingDisabled : 0y0

+0x6cc AuxiliaryProcess : 0y0

+0x6cc SubsystemProcess : 0y0

+0x6cc IndirectCpuSets : 0y0

+0x6cc RelinquishedCommit : 0y0

+0x6cc HighGraphicsPriority : 0y0

+0x6cc CommitFailLogged : 0y0

+0x6cc ReserveFailLogged : 0y0

+0x6cc SystemProcess : 0y0

+0x6cc HideImageBaseAddresses : 0y0

+0x6cc AddressPolicyFrozen : 0y1

+0x6cc ProcessFirstResume : 0y1

+0x6cc ForegroundExternal : 0y0

+0x6cc ForegroundSystem : 0y0

+0x6cc HighMemoryPriority : 0y0

+0x6cc EnableProcessSuspendResumeLogging : 0y0

+0x6cc EnableThreadSuspendResumeLogging : 0y0

+0x6cc SecurityDomainChanged : 0y0

+0x6cc SecurityFreezeComplete : 0y1

+0x6cc VmProcessorHost : 0y0

+0x6d0 DeviceAsid : 0n0

+0x6d8 SvmData : (null)

+0x6e0 SvmProcessLock : _EX_PUSH_LOCK

+0x6e8 SvmLock : 0

+0x6f0 SvmProcessDeviceListHead : _LIST_ENTRY [ 0xffffb282`a8c3ec30 - 0xffffb282`a8c3ec30 ]

+0x700 LastFreezeInterruptTime : 0

+0x708 DiskCounters : 0xffffb282`a8c3ed90 _PROCESS_DISK_COUNTERS

+0x710 PicoContext : (null)

+0x718 EnclaveTable : (null)

+0x720 EnclaveNumber : 0

+0x728 EnclaveLock : _EX_PUSH_LOCK

+0x730 HighPriorityFaultsAllowed : 0

+0x738 EnergyContext : 0xffffb282`a8c3edb8 _PO_PROCESS_ENERGY_CONTEXT

+0x740 VmContext : (null)

+0x748 SequenceNumber : 0x18b

+0x750 CreateInterruptTime : 0x0000000f`26f1bd6d

+0x758 CreateUnbiasedInterruptTime : 0x0000000f`26f1bd6d

+0x760 TotalUnbiasedFrozenTime : 0

+0x768 LastAppStateUpdateTime : 0x0000000f`26f1bd6d

+0x770 LastAppStateUptime : 0y0000000000000000000000000000000000000000000000000000000000000 (0)

+0x770 LastAppState : 0y000

+0x778 SharedCommitCharge : 0x12a3

+0x780 SharedCommitLock : _EX_PUSH_LOCK

+0x788 SharedCommitLinks : _LIST_ENTRY [ 0xffffd88b`dd8a1058 - 0xffffd88b`dd8a2a98 ]

+0x798 AllowedCpuSets : 0

+0x7a0 DefaultCpuSets : 0

+0x798 AllowedCpuSetsIndirect : (null)

+0x7a0 DefaultCpuSetsIndirect : (null)

+0x7a8 DiskIoAttribution : (null)

+0x7b0 DxgProcess : 0xffffd88b`e1743c90 Void

+0x7b8 Win32KFilterSet : 0

+0x7c0 ProcessTimerDelay : _PS_INTERLOCKED_TIMER_DELAY_VALUES

+0x7c8 KTimerSets : 0

+0x7cc KTimer2Sets : 0

+0x7d0 ThreadTimerSets : 0x36a113

+0x7d8 VirtualTimerListLock : 0

+0x7e0 VirtualTimerListHead : _LIST_ENTRY [ 0xffffb282`a8c3ed20 - 0xffffb282`a8c3ed20 ]

+0x7f0 WakeChannel : _WNF_STATE_NAME

+0x7f0 WakeInfo : _PS_PROCESS_WAKE_INFORMATION

+0x820 MitigationFlags : 0x40

+0x820 MitigationFlagsValues : <unnamed-tag>

+0x824 MitigationFlags2 : 0

+0x824 MitigationFlags2Values : <unnamed-tag>

+0x828 PartitionObject : 0xffffb282`a0ca56c0 Void

+0x830 SecurityDomain : 0

+0x838 ParentSecurityDomain : 0

+0x840 CoverageSamplerContext : (null)

+0x848 MmHotPatchContext : (null)

kd>dt _OBJECT_TYPE_INITIALIZER ffffe082`180a6980+0x040;g

ntdll!_OBJECT_TYPE_INITIALIZER

+0x000 Length : 0x78

+0x002 ObjectTypeFlags : 8

+0x002 CaseInsensitive : 0y0

+0x002 UnnamedObjectsOnly : 0y0

+0x002 UseDefaultObject : 0y0

+0x002 SecurityRequired : 0y1

+0x002 MaintainHandleCount : 0y0

+0x002 MaintainTypeList : 0y0

+0x002 SupportsObjectCallbacks : 0y0

+0x002 CacheAligned : 0y0

+0x003 UseExtendedParameters : 0y0

+0x003 Reserved : 0y0000000 (0)

+0x004 ObjectTypeCode : 0

+0x008 InvalidAttributes : 0

+0x00c GenericMapping : _GENERIC_MAPPING

+0x01c ValidAccessMask : 0x1f000f

+0x020 RetainAccess : 0

+0x024 PoolType : 200 ( NonPagedPoolNx )

+0x028 DefaultPagedPoolCharge : 0

+0x02c DefaultNonPagedPoolCharge : 0x58

+0x030 DumpProcedure : (null)

+0x038 OpenProcedure : (null)

+0x040 CloseProcedure : 0xfffff800`62218e30 void nt!DbgkpCloseObject+0

+0x048 DeleteProcedure : 0xfffff800`620c5ea0 void nt!AlpcConnectionCleanupProcedure+0

+0x050 ParseProcedure : (null)

+0x050 ParseProcedureEx : (null)

+0x058 SecurityProcedure : 0xfffff800`620a5e60 long nt!SeDefaultObjectMethod+0

+0x060 QueryNameProcedure : (null)

+0x068 OkayToCloseProcedure : (null)

+0x070 WaitObjectFlagMask : 0

+0x074 WaitObjectFlagOffset : 0

+0x076 WaitObjectPointerOffset : 0

DbgUiRemoteBreak劫持

调试器附加到xxprotect后，程序退出。

9.r3的反调试

xxprotect有个定时器定时抛异常，然后调用ZwQueryInformationProcess检测程序ProcessDebugPort是否处于调试

挂钩R3的ZwQueryInformationProcess，

然后处理掉r3的等调试标记位即可

https://bbs.pediy.com/thread-248703.htm

https://bbs.pediy.com/thread-252156.htm

https://bbs.pediy.com/thread-251412.htm

https://zhuanlan.zhihu.com/p/35555259

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课