src.cpp

struct CallbackSaveEntry {
        int      slot_index;
        int64_t  original_value;
    };

    CallbackSaveEntry g_SavedCallbacks[64] = {};
    int               g_SavedCallbackCount = 0;
    volatile long*    g_PspNotifyCountPtr = nullptr;

    bool DisablePspLoadImageNotifyRoutineCallbacks()
    {
        g_SavedCallbackCount = 0;

        PVOID ntoskrnl_base = Functions::GetNtoskrnl();
        if (!ntoskrnl_base) return false;

        volatile int64_t* CallbackArray =
            (volatile int64_t*)((uintptr_t)ntoskrnl_base + Offsets::PspLoadImageNotifyRoutine);

        g_PspNotifyCountPtr =
            (volatile long*)((uintptr_t)ntoskrnl_base + Offsets::PspLoadImageNotifyRoutineCount);

        PVOID PsLoadedModuleList = (PVOID)((uintptr_t)ntoskrnl_base + Offsets::PsLoadedModuleList);
        PLIST_ENTRY moduleList = (PLIST_ENTRY)PsLoadedModuleList;

        Utils::ModuleInfo battl_eye = Utils::GetModuleRange(moduleList, kcw(L"BEDaisy.sys"));
        DbgPrint("[callback] BEDaisy range: %p - %p\n", (void*)battl_eye.base, (void*)battl_eye.end);
        if (!battl_eye.base) return false;

        struct EX_CALLBACK_ROUTINE_BLOCK
        {
            uint64_t  RundownProtect;  // +0x00
            uintptr_t Function;        // +0x08
            uintptr_t Context;         // +0x10
        };

        for (int i = 0; i < 64; i++)
        {
            int64_t raw = CallbackArray[i];

            uintptr_t blockPtr = (uintptr_t)(raw & ~0xFLL);
            if (!blockPtr) continue;

            if (!Imports::MmIsAddressValid((PVOID)blockPtr)) continue;
            if (!Imports::MmIsAddressValid((PVOID)(blockPtr + sizeof(uintptr_t)))) continue;

            auto* block = reinterpret_cast<EX_CALLBACK_ROUTINE_BLOCK*>(blockPtr);
            if (!block->Function) continue;

            DbgPrint("[callback] slot[%d] func=%p\n", i, (void*)block->Function);

            if (Utils::IsAddressInModule(block->Function, battl_eye))
            {
                int64_t prev = _InterlockedCompareExchange64(&CallbackArray[i], 0, raw);
                if (prev == raw)
                {
                    DbgPrint("[callback] SUPPRESSED slot[%d]\n", i);
                    g_SavedCallbacks[g_SavedCallbackCount].slot_index = i;
                    g_SavedCallbacks[g_SavedCallbackCount].original_value = raw;
                    g_SavedCallbackCount++;

                    _InterlockedDecrement(g_PspNotifyCountPtr);
                }
            }
        }

        DbgPrint("[callback] suppressed %d BEDaisy callbacks, count now=%d\n",
            g_SavedCallbackCount, *g_PspNotifyCountPtr);
        return g_SavedCallbackCount > 0;
    }

    void RestorePspLoadImageNotifyRoutineCallbacks()
    {
        if (!g_PspNotifyCountPtr) return;

        PVOID ntoskrnl_base = Functions::GetNtoskrnl();
        if (!ntoskrnl_base) return;

        volatile int64_t* CallbackArray =
            (volatile int64_t*)((uintptr_t)ntoskrnl_base + Offsets::PspLoadImageNotifyRoutine);

        for (int i = 0; i < g_SavedCallbackCount; i++)
        {
            int idx = g_SavedCallbacks[i].slot_index;
            int64_t orig = g_SavedCallbacks[i].original_value;

            _InterlockedCompareExchange64(&CallbackArray[idx], orig, 0);
            _InterlockedIncrement(g_PspNotifyCountPtr);
        }

        g_SavedCallbackCount = 0;
    }

    struct MinifilterSaveEntry {
        uintptr_t  opRegAddr;
        uintptr_t  originalPreOp;
        uintptr_t  originalPostOp;
    };

    MinifilterSaveEntry g_SavedMinifilterOps[16] = {};
    int                 g_SavedMinifilterCount = 0;

    NTSTATUS __fastcall FltPreOpNoop(
        PVOID Data, PVOID FltObjects, PVOID* CompletionContext)
    {
        UNREFERENCED_PARAMETER(Data);
        UNREFERENCED_PARAMETER(FltObjects);
        UNREFERENCED_PARAMETER(CompletionContext);
        return 0x00000000;
    }

    bool DisableMinifilterPreCreate()
    {
        g_SavedMinifilterCount = 0;

        PVOID fltmgrBase = Utils::GetModuleBase<PVOID>(kca("FLTMGR.SYS"));
        if (!fltmgrBase) return false;

        PVOID ntoskrnl_base = Functions::GetNtoskrnl();
        if (!ntoskrnl_base) return false;

        PVOID PsLoadedModuleList = (PVOID)((uintptr_t)ntoskrnl_base + Offsets::PsLoadedModuleList);
        PLIST_ENTRY moduleList = (PLIST_ENTRY)PsLoadedModuleList;
        Utils::ModuleInfo battl_eye = Utils::GetModuleRange(moduleList, kcw(L"BEDaisy.sys")); //  BEDaisy
        if (!battl_eye.base) return false;

        uintptr_t frameListHead = (uintptr_t)fltmgrBase + Offsets::fltmgr::FltGlobalsFrameListHead;
        PLIST_ENTRY frameHead = (PLIST_ENTRY)frameListHead;

        if (!Imports::MmIsAddressValid(frameHead)) return false;
        if (!Imports::MmIsAddressValid(frameHead->Flink)) return false;

        PLIST_ENTRY frameEntry = frameHead->Flink;

        while (frameEntry != frameHead)
        {
            if (!Imports::MmIsAddressValid(frameEntry)) break;

            uintptr_t frame = (uintptr_t)frameEntry;
            uintptr_t filterListHead = frame + Offsets::fltmgr::FrameFilterListOffset;
            PLIST_ENTRY filterHead = (PLIST_ENTRY)filterListHead;

            if (!Imports::MmIsAddressValid(filterHead) ||
                !Imports::MmIsAddressValid(filterHead->Flink))
            {
                frameEntry = frameEntry->Flink;
                continue;
            }

            PLIST_ENTRY filterEntry = filterHead->Flink;

            while (filterEntry != filterHead)
            {
                if (!Imports::MmIsAddressValid(filterEntry)) break;

                uintptr_t filter = (uintptr_t)filterEntry - Offsets::fltmgr::FilterLinkOffset;

                if (!Imports::MmIsAddressValid((PVOID)(filter + Offsets::fltmgr::FilterOperationsOffset + 8)))
                {
                    filterEntry = filterEntry->Flink;
                    continue;
                }

                uintptr_t* pOpTable = (uintptr_t*)(filter + Offsets::fltmgr::FilterOperationsOffset);
                uintptr_t opTable = *pOpTable;

                if (!opTable || !Imports::MmIsAddressValid((PVOID)opTable))
                {
                    filterEntry = filterEntry->Flink;
                    continue;
                }

                for (int i = 0; i < 50; i++)
                {
                    uintptr_t entryAddr = opTable + (i * Offsets::fltmgr::OpRegSize);
                    if (!Imports::MmIsAddressValid((PVOID)entryAddr)) break;

                    UCHAR majorFunc = *(UCHAR*)entryAddr;
                    if (majorFunc == Offsets::fltmgr::OpRegMajorFunctionEnd) break;

                    if (majorFunc != Offsets::fltmgr::IRP_MJ_CREATE_VAL &&
                        majorFunc != Offsets::fltmgr::IRP_MJ_ACQUIRE_SECTION_VAL)
                        continue;

                    uintptr_t preOpAddr  = entryAddr + 0x08;
                    uintptr_t postOpAddr = entryAddr + 0x10;

                    if (!Imports::MmIsAddressValid((PVOID)preOpAddr)) continue;

                    uintptr_t preOp  = *(uintptr_t*)preOpAddr;
                    uintptr_t postOp = *(uintptr_t*)postOpAddr;

                    bool preInBE  = preOp  && Utils::IsAddressInModule(preOp, battl_eye);
                    bool postInBE = postOp && Utils::IsAddressInModule(postOp, battl_eye);

                    if (!preInBE && !postInBE) continue;

                    if (g_SavedMinifilterCount >= 16) break;

                    DbgPrint("[minifilter] found BEDaisy op: major=0x%X pre=%p post=%p\n",
                        majorFunc, (void*)preOp, (void*)postOp);

                    g_SavedMinifilterOps[g_SavedMinifilterCount].opRegAddr = entryAddr;
                    g_SavedMinifilterOps[g_SavedMinifilterCount].originalPreOp = preOp;
                    g_SavedMinifilterOps[g_SavedMinifilterCount].originalPostOp = postOp;
                    g_SavedMinifilterCount++;

                    PMDL mdl = Imports::_IoAllocateMdl((PVOID)preOpAddr, 0x10, FALSE, FALSE, NULL);
                    if (!mdl) continue;

                    __try {
                        Imports::_MmProbeAndLockPages(mdl, KernelMode, IoReadAccess);
                    } __except (EXCEPTION_EXECUTE_HANDLER) {
                        Imports::_IoFreeMdl(mdl);
                        continue;
                    }

                    PVOID mapped = Imports::_MmMapLockedPagesSpecifyCache(
                        mdl, KernelMode, MmCached, NULL, FALSE, NormalPagePriority);
                    if (!mapped) {
                        Imports::_MmUnlockPages(mdl);
                        Imports::_IoFreeMdl(mdl);
                        continue;
                    }

                    uintptr_t* mappedPre  = (uintptr_t*)mapped;
                    uintptr_t* mappedPost = (uintptr_t*)((uintptr_t)mapped + 0x08);

                    if (preInBE)
                        *mappedPre = (uintptr_t)&FltPreOpNoop;
                    if (postInBE)
                        *mappedPost = 0;

                    DbgPrint("[minifilter] PATCHED major=0x%X\n", majorFunc);

                    Imports::_MmUnmapLockedPages(mapped, mdl);
                    Imports::_MmUnlockPages(mdl);
                    Imports::_IoFreeMdl(mdl);
                }

                filterEntry = filterEntry->Flink;
            }

            frameEntry = frameEntry->Flink;
        }

        DbgPrint("[minifilter] patched %d BEDaisy operations\n", g_SavedMinifilterCount);
        return g_SavedMinifilterCount > 0;
    }

    void RestoreMinifilterPreCreate()
    {
        for (int i = 0; i < g_SavedMinifilterCount; i++)
        {
            uintptr_t entryAddr = g_SavedMinifilterOps[i].opRegAddr;
            uintptr_t preOpAddr = entryAddr + 0x08;

            if (!Imports::MmIsAddressValid((PVOID)preOpAddr)) continue;

            PMDL mdl = Imports::_IoAllocateMdl((PVOID)preOpAddr, 0x10, FALSE, FALSE, NULL);
            if (!mdl) continue;

            __try {
                Imports::_MmProbeAndLockPages(mdl, KernelMode, IoReadAccess);
            } __except (EXCEPTION_EXECUTE_HANDLER) {
                Imports::_IoFreeMdl(mdl);
                continue;
            }

            PVOID mapped = Imports::_MmMapLockedPagesSpecifyCache(
                mdl, KernelMode, MmCached, NULL, FALSE, NormalPagePriority);
            if (!mapped) {
                Imports::_MmUnlockPages(mdl);
                Imports::_IoFreeMdl(mdl);
                continue;
            }

            uintptr_t* mappedPre  = (uintptr_t*)mapped;
            uintptr_t* mappedPost = (uintptr_t*)((uintptr_t)mapped + 0x08);

            *mappedPre  = g_SavedMinifilterOps[i].originalPreOp;
            *mappedPost = g_SavedMinifilterOps[i].originalPostOp;

            Imports::_MmUnmapLockedPages(mapped, mdl);
            Imports::_MmUnlockPages(mdl);
            Imports::_IoFreeMdl(mdl);
        }

        g_SavedMinifilterCount = 0;
    }