Question

我为游戏构建Simple Anticheat模块，我需要保护Thread不受Suspend（如Processhacker的Suspend Thread）。

如果被暂停，有没有办法自动恢复线程？

这是我的模块代码：

#include "stdafx.h"
#include "Start.h"

void Msg_Sf_Br(){
    MessageBoxA(NULL,"SpeedHack - Detect", load.Nome_das_Janelas, MB_SERVICE_NOTIFICATION | MB_ICONWARNING);
ExitProcess(0);
} 

void Msg_Sf_En(){
    MessageBoxA(NULL,"SpeedHack - Detect", load.Nome_das_Janelas, MB_SERVICE_NOTIFICATION | MB_ICONWARNING);
ExitProcess(0);
}

void Speed_perf()
{
if( *(unsigned long*)QueryPerformanceCounter != 2337669003 ){
if (load.Log_Txt_Hack == 1){
}

    if (load.Message_Warning_En == 1){
    ExitProcess(0); 
}
    if (load.Message_Warning_En == 2){
    CreateThread(NULL,NULL,LPTHREAD_START_ROUTINE(Msg_Sf_Br),NULL,0,0);
    Sleep(3000); 
    ExitProcess(0);  
}

    if (load.Message_Warning_En == 0){
    ExitProcess(0);
    }
    else
    ExitProcess(0);
}
}


void performance(){
    if (load.Anti_Kill_Scans == 1)
    {
again:
    Speed_perf();
    Sleep(load.Detecta_Speed_PerformanceT);
    goto again;
}
    else
    {
again2:
    Speed_perf();
    Sleep(load.Detecta_Speed_PerformanceT);
    goto again2;
}
}

void SPerformance(){
    CreateThread(NULL,NULL,LPTHREAD_START_ROUTINE(performance),NULL,0,0);
    }

有什么想法吗？

Answer 1

您可以这样做：

使用CreateToolhelp32Snapshot
使用方法Thread32First进入第一个线程。
对于找到的每个线程（您应检查是否属于给定的进程）：
然后使用OpenThread打开线程，以从该线程的线程ID中检索该线程的句柄
拥有句柄后，可以使用SuspendThread暂停线程，以获取先前的暂停计数，
然后您可以恢复线程，直到其暂停计数为0。您必须至少恢复一次以取消上一步的暂停。
如果不允许暂停线程，则可以使用ResumeThread来获取暂停计数，即使该线程没有被暂停也是如此。
使用CloseHandle
使用下一个线程Thread32Next。

要想完成全部工作，您必须以管理员身份运行。

这里是一个例子：

void TraverseProcessThreads(DWORD pid)
{
  HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0); //get list of all system thread
  if( hSnapshot == INVALID_HANDLE_VALUE)
  { 
     //print error and return;
     return;
  }
  THREADENTRY32 threadEntry;
  if( Thread32First( hSnapshot, &threadEntry) ) 
  {
     size_t threadsCounter = 0, suspendedThreadsCounter=0;
     do{
       if(te.th32OwnerProcessID == pid) //we get all threads in system, should filter the relevant pid.
       {
         threadsCounter ++; //found thread
         HANDLE hThread = OpenThread(THREAD_ALL_ACCESS,FALSE,te.th32ThreadID); //get  handle to thread from its thread id
         if(hThread == NULL) //
         {
           //print error and break. (will be permission error if not administrator)
           break; 
         }
         int suspensionCount = SuspendThread( hThread ) ;//will return previous suspension count. you can also use ResumeThread if there's no way it can be suspended.
         if(suspensionCount > 0) 
         {
            //thread was suspended 
            suspendedThreadsCounter ++;   
         }
         //cancel our suspension... 
         suspensionCount = ResumeThread(hThread );

         /*to resume suspended thread use ResumeThread until it return 1.
         do{
           suspensionCount = ResumeThread(hThread );
         }while (suspensionCount > 1); //similar to Suspend Resume return previous Suspention count. 
         */   
       }  
       CloseHandle(hThread);      
     }while(Thread32Next( hSnapshot, &threadEntry) );
     //print results:
     cout<<"process id"<<pid<<endl<<" has "<<threadsCounter <<" threads " <<endl
       <<suspendedThreadsCounter <<" threads was suspended"<<endl;
  }
  else{
    //print some error...
  } 
  CloseHandle(hSnapshot);
}

Answer 2

通过一些技巧，您可以对任何调试器或进程黑客等工具隐藏线程。

void func() 
{
}

int main()
{
    int(__stdcall* ZwCreateThreadEx)(HANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, HANDLE, PVOID, PVOID, ULONG, ULONG_PTR, SIZE_T, SIZE_T, PVOID) = (decltype(ZwCreateThreadEx))GetProcAddress(GetModuleHandle("ntdll.dll"),"ZwCreateThreadEx");
    HANDLE hThread=0;
    ZwCreateThreadEx(&hThread,0x1FFFFF,0,GetCurrentProcess(), 
            (LPTHREAD_START_ROUTINE)func,0, 0x4/*hide flag*/,0,0x1000,0x10000,0);
    return 0;
}

自动线程恢复c ++

2 个答案:

要想完成全部工作，您必须以管理员身份运行。

这里是一个例子：