Protect a game from a kernel driver

[TheGodFather]

Hello guys.
I was trying to make a clone of anti-cheats with one feature wich block access to the game from any program or tool. like popular anti-cheat or like UGK-Anti Cheat does.

I dont know the idea of how to make it. its just about a kernel driver shit.

if anyone can help me or give me a hint.


Pictures :-

[MentaL_BOT]

[iostream]

CE is very hard to block. especially private CE.

[TheGodFather]

CE is very hard to block. especially private CE.

can i hook system calls to prevent CE ?

like hook zwOpenPorcess or NtOpen ...etc

[Ryusaki]

If you are in kernel mode, you could use ObRegisterCallback to intercept OpenProcess attempts from user mode.
Obs: I wouldn't recommend hooking syscalls.

[TheGodFather]

If you are in kernel mode, you could use ObRegisterCallback to intercept OpenProcess attempts from user mode.
Obs: I wouldn't recommend hooking syscalls.

Thank you so much,

I am noob to kernel driver stuff so can you give me a simple code or some github repo for an example

[k0d0k]

Thank you so much,

I am noob to kernel driver stuff so can you give me a simple code or some github repo for an example

https://github.com/microsoft/Windows...ral/obcallback

[Flipend0]

I personally would not recommend touching drivers if you have no idea how they work. Especially if it's going to be intended as an Anti Cheat service for your Clients. Unless you have the financial ability to add a CSC to the driver to whatever game you're working on. Otherwise you're going to have to inform all users to Disable Driver Signature Enforcement.

I just build my house made anti cheat in Usermode instead. I run integerty checks and hash the entire application after I implement my own modifications. This way, if any after modifications gets detected. I simply just close the entire client down.

[TheGodFather]

I personally would not recommend touching drivers if you have no idea how they work. Especially if it's going to be intended as an Anti Cheat service for your Clients. Unless you have the financial ability to add a CSC to the driver to whatever game you're working on. Otherwise you're going to have to inform all users to Disable Driver Signature Enforcement.

I just build my house made anti cheat in Usermode instead. I run integerty checks and hash the entire application after I implement my own modifications. This way, if any after modifications gets detected. I simply just close the entire client down.

I got a way to protect my game through some vuldriver.

i edit the code and got these result wich is so pretty :)




After edit code and hook some syscalls and run the game under SYSTEM