c++ - 自动线程恢复 C++

Question

我为游戏构建了简单的 Anticheat 模块，我需要保护线程免受挂起(如 Processhacker 的挂起线程)。

有什么方法可以在挂起时自动恢复线程？

这是我的模块代码:

#include "stdafx.h"
#include "Start.h"

void Msg_Sf_Br(){
    MessageBoxA(NULL,"SpeedHack - Detect", load.Nome_das_Janelas, MB_SERVICE_NOTIFICATION | MB_ICONWARNING);
ExitProcess(0);
} 

void Msg_Sf_En(){
    MessageBoxA(NULL,"SpeedHack - Detect", load.Nome_das_Janelas, MB_SERVICE_NOTIFICATION | MB_ICONWARNING);
ExitProcess(0);
}

void Speed_perf()
{
if( *(unsigned long*)QueryPerformanceCounter != 2337669003 ){
if (load.Log_Txt_Hack == 1){
}

    if (load.Message_Warning_En == 1){
    ExitProcess(0); 
}
    if (load.Message_Warning_En == 2){
    CreateThread(NULL,NULL,LPTHREAD_START_ROUTINE(Msg_Sf_Br),NULL,0,0);
    Sleep(3000); 
    ExitProcess(0);  
}

    if (load.Message_Warning_En == 0){
    ExitProcess(0);
    }
    else
    ExitProcess(0);
}
}


void performance(){
    if (load.Anti_Kill_Scans == 1)
    {
again:
    Speed_perf();
    Sleep(load.Detecta_Speed_PerformanceT);
    goto again;
}
    else
    {
again2:
    Speed_perf();
    Sleep(load.Detecta_Speed_PerformanceT);
    goto again2;
}
}

void SPerformance(){
    CreateThread(NULL,NULL,LPTHREAD_START_ROUTINE(performance),NULL,0,0);
    }

有什么想法吗？

Answer 1

通过一些小技巧，您可以在任何调试器或进程黑客等工具中隐藏您的线程。

void func() 
{
}

int main()
{
    int(__stdcall* ZwCreateThreadEx)(HANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, HANDLE, PVOID, PVOID, ULONG, ULONG_PTR, SIZE_T, SIZE_T, PVOID) = (decltype(ZwCreateThreadEx))GetProcAddress(GetModuleHandle("ntdll.dll"),"ZwCreateThreadEx");
    HANDLE hThread=0;
    ZwCreateThreadEx(&hThread,0x1FFFFF,0,GetCurrentProcess(), 
            (LPTHREAD_START_ROUTINE)func,0, 0x4/*hide flag*/,0,0x1000,0x10000,0);
    return 0;
}