MCPcopy Create free account
hub / github.com/FiYHer/driver_callback_bypass_1909

github.com/FiYHer/driver_callback_bypass_1909 @main

Chat with this repo
repository ↗ · DeepWiki ↗ · + Follow
94 symbols 137 edges 12 files 7 documented · 7% ● updated 3y ago★ 179

Browse by type

⨍ Functions 56◇ Types & classes 38
What it actually does AI analysis from the code graph — generated when you open this
loading…
README

driver_callback_bypass_1909

研究和移除各种内核回调,在anti anti cheat的路上越走越远

测试系统

全部代码运行在1909系统下(Microsoft Windows [版本 10.0.18363.592])

更新

主要回调都绕过,分析出来自会上传,完毕后写一个专门的小工具

最新想法

使用shellcode在微软官方驱动里起一个CmRegisterCallback回调,在回调中跳转到我们的处理函数

待测试

修改PspNotifyEnableMask为00000009,创建和退出进程时就不会触发回调

修改PspNotifyEnableMask为00000007,创建和退出线程时就不会触发回调

修改PspNotifyEnableMask为0000000e,就不会触发模块回调

Core symbols most depended-on inside this repo

Shape

Function 56
Class 36
Enum 2

Languages

C++100%

Modules by API surface

ObRegisterCallbacks_bypass.cpp13 symbols
callback_remove/callback_remove_kernel/ob.hpp12 symbols
callback_remove/callback_remove/main.cpp12 symbols
CmRegisterCallback_bypass.cpp9 symbols
dse_disable.cpp8 symbols
PsSetLoadImageNotifyRoutine_bypass.cpp8 symbols
PsSetCreateThreadNotifyRoutine_bypass.cpp8 symbols
PsSetCreateProcessNotifyRoutine_bypass.cpp8 symbols
callback_remove/callback_remove/loader.hpp6 symbols
overrider_sig.cpp5 symbols
callback_remove/callback_remove_kernel/main.cpp4 symbols
callback_remove/callback_remove_kernel/struct.hpp1 symbols

For agents

$ claude mcp add driver_callback_bypass_1909 \
  -- python -m otcore.mcp_server <graph>

⬇ download graph artifact

Ask about this repo answers extend the page