自动线程恢复 c++

Auto Thread resume c++

本文关键字：c++ 恢复 线程      更新时间：2023-10-16

我为游戏构建了简单的反作弊模块，我需要保护线程免受挂起(就像进程黑客的挂起线程一样(。

如果挂起，有什么方法可以自动恢复线程吗？

这是我的模块代码：

#include "stdafx.h"
#include "Start.h"
void Msg_Sf_Br(){
MessageBoxA(NULL,"SpeedHack - Detect", load.Nome_das_Janelas, MB_SERVICE_NOTIFICATION | MB_ICONWARNING);
ExitProcess(0);
} 
void Msg_Sf_En(){
MessageBoxA(NULL,"SpeedHack - Detect", load.Nome_das_Janelas, MB_SERVICE_NOTIFICATION | MB_ICONWARNING);
ExitProcess(0);
}
void Speed_perf()
{
if( *(unsigned long*)QueryPerformanceCounter != 2337669003 ){
if (load.Log_Txt_Hack == 1){
}
if (load.Message_Warning_En == 1){
ExitProcess(0); 
}
if (load.Message_Warning_En == 2){
CreateThread(NULL,NULL,LPTHREAD_START_ROUTINE(Msg_Sf_Br),NULL,0,0);
Sleep(3000); 
ExitProcess(0);  
}
if (load.Message_Warning_En == 0){
ExitProcess(0);
}
else
ExitProcess(0);
}
}

void performance(){
if (load.Anti_Kill_Scans == 1)
{
again:
Speed_perf();
Sleep(load.Detecta_Speed_PerformanceT);
goto again;
}
else
{
again2:
Speed_perf();
Sleep(load.Detecta_Speed_PerformanceT);
goto again2;
}
}
void SPerformance(){
CreateThread(NULL,NULL,LPTHREAD_START_ROUTINE(performance),NULL,0,0);
}

知道吗？

通过一个小技巧，你可以隐藏你的线程，不让任何调试器或工具(如进程黑客(看到。

void func() 
{
}
int main()
{
int(__stdcall* ZwCreateThreadEx)(HANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, HANDLE, PVOID, PVOID, ULONG, ULONG_PTR, SIZE_T, SIZE_T, PVOID) = (decltype(ZwCreateThreadEx))GetProcAddress(GetModuleHandle("ntdll.dll"),"ZwCreateThreadEx");
HANDLE hThread=0;
ZwCreateThreadEx(&hThread,0x1FFFFF,0,GetCurrentProcess(), 
(LPTHREAD_START_ROUTINE)func,0, 0x4/*hide flag*/,0,0x1000,0x10000,0);
return 0;
}

你可以这样做：

  • 使用CreateToolhelp32Snapshot获取进程线程 ID 的列表
  • 使用方法转到第一个线程：Thread32First。
  • 对于每个找到的线程(您应该检查是否属于给定进程(：
  • 然后使用OpenThread的方式打开线程，从线程 ID 中检索线程的句柄，
  • 当您拥有句柄时，您可以使用SuspendThread的方式挂起线程以检索以前的挂起计数，
  • 然后，您可以恢复线程，直到其挂起计数为 0。您必须至少恢复一次 WAY 才能取消上一步的挂起。
  • 如果不允许挂起线程，则可以仅使用ResumeThread来获取挂起计数，即使它未挂起。
  • 使用CloseHandle关闭螺纹手柄
  • 迭代到下一个线程使用Thread32Next。

为了能够完成整个事情，您必须以管理员身份运行。

下面是一个示例：

void TraverseProcessThreads(DWORD pid)
{
HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0); //get list of all system thread
if( hSnapshot == INVALID_HANDLE_VALUE)
{ 
//print error and return;
return;
}
THREADENTRY32 threadEntry;
if( Thread32First( hSnapshot, &threadEntry) ) 
{
size_t threadsCounter = 0, suspendedThreadsCounter=0;
do{
if(te.th32OwnerProcessID == pid) //we get all threads in system, should filter the relevant pid.
{
threadsCounter ++; //found thread
HANDLE hThread = OpenThread(THREAD_ALL_ACCESS,FALSE,te.th32ThreadID); //get  handle to thread from its thread id
if(hThread == NULL) //
{
//print error and break. (will be permission error if not administrator)
break; 
}
int suspensionCount = SuspendThread( hThread ) ;//will return previous suspension count. you can also use ResumeThread if there's no way it can be suspended.
if(suspensionCount > 0) 
{
//thread was suspended 
suspendedThreadsCounter ++;   
}
//cancel our suspension... 
suspensionCount = ResumeThread(hThread );
/*to resume suspended thread use ResumeThread until it return 1.
do{
suspensionCount = ResumeThread(hThread );
}while (suspensionCount > 1); //similar to Suspend Resume return previous Suspention count. 
*/   
}  
CloseHandle(hThread);      
}while(Thread32Next( hSnapshot, &threadEntry) );
//print results:
cout<<"process id"<<pid<<endl<<" has "<<threadsCounter <<" threads " <<endl
<<suspendedThreadsCounter <<" threads was suspended"<<endl;
}
else{
//print some error...
} 
CloseHandle(hSnapshot);
}
相关文章：