Реверс античита Валорант. VanGuard

[Ravin]

Список функций которые использует антчит.
Будет полезно для некоторых реверсоров, которые хотят использовать определенные функции или просто хотят узнать что использует античит для блокировки попыток обойти его.
Это дамп функции из vgk.sys от 15 мая.

User mode wrapper;

    ntoskrnl.MmCopyVirtualMemory
    ntoskrnl.MmMapIoSpace
    ntoskrnl.MmMapIoSpaceEx
    ntoskrnl.MmUserProbeAddress
    ntoskrnl.MmProbeAndLockPages
    ntoskrnl.MmMapMemoryDumpMdl

Physical memory scan

    ntoskrnl.ZwCreateSection
    ntoskrnl.ZwOpenSection
    ntoskrnl.ZwMapViewOfSection
    ntoskrnl.ZwUnmapViewOfSection
    ntoskrnl.MmSectionObjectType
    ntoskrnl.MmGetPhysicalMemoryRanges
    ntoskrnl.MmGetPhysicalAddress
    ntoskrnl.IoAllocateMdl
    ntoskrnl.IoFreeMdl
    ntoskrnl.MmMapLockedPagesSpecifyCache
    ntoskrnl.MmProtectMdlSystemAddress
    ntoskrnl.MmUnlockPages
    ntoskrnl.MmUnmapLockedPages
    ntoskrnl.MmFreeContiguousMemorySpecifyCache
    ntoskrnl.MmAllocateContiguousMemorySpecifyCache
    ntoskrnl.ZwMakeTemporaryObject

NT API management;

    ntoskrnl.MmGetSystemRoutineAddress
    ntoskrnl.RtlFindExportedRoutineByName

Debugger detection;

    ntoskrnl.KdDebuggerNotPresent
    ntoskrnl.KdDebuggerEnabled
    ntoskrnl.KdEnteredDebugger
    ntoskrnl.PsGetProcessDebugPort
    ntoskrnl.KdChangeOption

Process/thread callbacks;

    ntoskrnl.PsProcessType
    ntoskrnl.PsThreadType
    ntoskrnl.PsSetCreateProcessNotifyRoutine
    ntoskrnl.PsSetCreateProcessNotifyRoutineEx
    ntoskrnl.PsSetLoadImageNotifyRoutine
    ntoskrnl.PsRemoveLoadImageNotifyRoutine
    ntoskrnl.PsIsProtectedProcess
    ntoskrnl.ObRegisterCallbacks
    ntoskrnl.ObUnRegisterCallbacks

Hardware detection;

    ntoskrnl.ExCreateCallback
    ntoskrnl.ExRegisterCallback
    ntoskrnl.ExUnregisterCallback

Process/Thread scan;

    ntoskrnl.KeStackAttachProcess
    ntoskrnl.KeUnstackDetachProcess
    ntoskrnl.PsLookupThreadByThreadId
    ntoskrnl.PsLookupProcessByProcessId
    ntoskrnl.PsGetThreadId
    ntoskrnl.PsGetThreadProcessId
    ntoskrnl.PsGetProcessPeb
    ntoskrnl.PsIsProtectedProcessLight
    ntoskrnl.PsGetProcessImageFileName
    ntoskrnl.PsGetProcessSessionId
    ntoskrnl.PsGetProcessWow64Process
    ntoskrnl.ZwQueryInformationProcess
    ntoskrnl.PsGetProcessId
    ntoskrnl.PsGetProcessSectionBaseAddress
    ntoskrnl.ZwTerminateProcess
    ntoskrnl.SeLocateProcessImageName

Drive/file scan;

    ntoskrnl.ZwLoadDriver
    ntoskrnl.ZwQueryVirtualMemory
    ntoskrnl.ZwCreateFile
    ntoskrnl.ZwReadFile
    ntoskrnl.ZwQueryInformationFile
    ntoskrnl.ZwDeviceIoControlFile

Registry scan;

    ntoskrnl.CmRegisterCallbackEx
    ntoskrnl.CmUnRegisterCallback
    ntoskrnl.ZwOpenKey
    ntoskrnl.ZwQueryValueKey
    ntoskrnl.ZwSetValueKey
    ntoskrnl.ZwDeleteValueKey
    ntoskrnl.RtlStringFromGUID

Timer / thread;

    ntoskrnl.KeReadStateTimer
    ntoskrnl.KeInitializeTimer
    ntoskrnl.KeSetTimer
    ntoskrnl.KeCancelTimer
    ntoskrnl.PsCreateSystemThread
    ntoskrnl.PsTerminateSystemThread
    ntoskrnl.KeDelayExecutionThread

Handle table stuffs;

    ntoskrnl.ExEnumHandleTable
    ntoskrnl.ZwQuerySystemInformation

Synchronization;

    ntoskrnl.ExAcquireFastMutex
    ntoskrnl.KeReleaseGuardedMutex
    ntoskrnl.ExWaitForRundownProtectionRelease
    ntoskrnl.ExAcquireRundownProtection
    ntoskrnl.ExReleaseRundownProtection
    ntoskrnl.ExAcquireSpinLockExclusive
    ntoskrnl.ExAcquireSpinLockShared
    ntoskrnl.ExReleaseSpinLockExclusive
    ntoskrnl.ExReleaseSpinLockShared
    ntoskrnl.ExTryConvertSharedSpinLockExclusive
    ntoskrnl.InitializeSListHead
    ntoskrnl.FirstEntrySList
    ntoskrnl.ExpInterlockedPopEntrySList
    ntoskrnl.ExpInterlockedPushEntrySList
    ntoskrnl.KeInitializeEvent
    ntoskrnl.KeSetEvent
    ntoskrnl.ExInitializePushLock
    ntoskrnl.ExfUnblockPushLock
    ntoskrnl.KeWaitForMutexObject

Digital signature validation;

    cng.BCryptOpenAlgorithmProvider
    cng.BCryptGetProperty
    cng.BCryptCreateHash
    cng.BCryptHashData
    cng.BCryptFinishHash
    CI.CiFreePolicyInfo
    CI.CiCheckSignedFile
    CI.CiVerifyHashInCatalog

APC monitoring;

    ntoskrnl.KeAreAllApcsDisabled
    ntoskrnl.KeInitializeApc
    ntoskrnl.KeInsertQueueApc
    ntoskrnl.KeTestAlertThread

HAL integrity check

    ntoskrnl.HalPrivateDispatchTable

Hook for other drivers(here);

    ntoskrnl.IoGetInitialStack
    ntoskrnl.PsLookupThreadByThreadId
    ntoskrnl.IoGetDeviceObjectPointer
    ntoskrnl.IoBuildDeviceIoControlRequest
    ntoskrnl.IofCallDriver
    ntoskrnl.IofCompleteRequest

Shutdown stuffs

    ntoskrnl.IoRegisterShutdownNotification
    ntoskrnl.IoUnregisterShutdownNotification
    ntoskrnl.PsGetProcessExitProcessCalled
    ntoskrnl.PsReleaseProcessExitSynchronization

Self stuffs;

    ntoskrnl.IoCreateDevice
    ntoskrnl.IoDeleteDevice
    ntoskrnl.IoCreateSymbolicLink
    ntoskrnl.IoDeleteSymbolicLink
    ntoskrnl.KeIpiGenericCall

Common;

    ntoskrnl.ObOpenObjectByPointer
    ntoskrnl.ObfReferenceObject
    ntoskrnl.ObReferenceObjectByHandle
    ntoskrnl.ObfDereferenceObject
    ntoskrnl.ObQueryNameString
    ntoskrnl.ObGetObjectType
    ntoskrnl.swprintf_s
    ntoskrnl.RtlInitAnsiString
    ntoskrnl.RtlAnsiStringToUnicodeString
    ntoskrnl.RtlEqualUnicodeString
    ntoskrnl.RtlDuplicateUnicodeString
    ntoskrnl.RtlInitUnicodeString
    ntoskrnl.RtlFreeUnicodeString
    ntoskrnl.RtlGetVersion
    ntoskrnl.RtlRandomEx
    ntoskrnl.ZwProtectVirtualMemory
    ntoskrnl.ZwClose
    ntoskrnl.IoGetCurrentProcess
    ntoskrnl.ZwQueryObject
    ntoskrnl.ZwWaitForSingleObject
    ntoskrnl.MmIsAddressValid

Unknown;

    ntoskrnl.PsInitialSystemProcess
    ntoskrnl.ObDuplicateObject+5F0
    ntoskrnl.ZwWriteFile

 

[Amaterasu-]

GJ