自动线程恢复 C++答案

【问题标题】：Auto Thread resume c++自动线程恢复 C++
【发布时间】：2018-06-13 07:53:30
【问题描述】：

我为游戏构建了简单的 Anticheat 模块，我需要保护线程免受挂起（如来自 Processhacker 的挂起线程）。

如果线程被挂起，有什么方法可以自动恢复线程？

这是我的模块代码：

#include "stdafx.h"
#include "Start.h"

void Msg_Sf_Br(){
    MessageBoxA(NULL,"SpeedHack - Detect", load.Nome_das_Janelas, MB_SERVICE_NOTIFICATION | MB_ICONWARNING);
ExitProcess(0);
} 

void Msg_Sf_En(){
    MessageBoxA(NULL,"SpeedHack - Detect", load.Nome_das_Janelas, MB_SERVICE_NOTIFICATION | MB_ICONWARNING);
ExitProcess(0);
}

void Speed_perf()
{
if( *(unsigned long*)QueryPerformanceCounter != 2337669003 ){
if (load.Log_Txt_Hack == 1){
}

    if (load.Message_Warning_En == 1){
    ExitProcess(0); 
}
    if (load.Message_Warning_En == 2){
    CreateThread(NULL,NULL,LPTHREAD_START_ROUTINE(Msg_Sf_Br),NULL,0,0);
    Sleep(3000); 
    ExitProcess(0);  
}

    if (load.Message_Warning_En == 0){
    ExitProcess(0);
    }
    else
    ExitProcess(0);
}
}


void performance(){
    if (load.Anti_Kill_Scans == 1)
    {
again:
    Speed_perf();
    Sleep(load.Detecta_Speed_PerformanceT);
    goto again;
}
    else
    {
again2:
    Speed_perf();
    Sleep(load.Detecta_Speed_PerformanceT);
    goto again2;
}
}

void SPerformance(){
    CreateThread(NULL,NULL,LPTHREAD_START_ROUTINE(performance),NULL,0,0);
    }

有什么想法吗？

【问题讨论】：

一种懒惰的解决方案是轮询调用某个已知函数之间的时间，如果该时间不正常，退出程序或删除用户的个人数据。
将用户模式异步过程调用排队或放入线程池。

标签： c++ windows multithreading

【解决方案1】：

通过一个小技巧，您可以对任何调试器或进程黑客等工具隐藏您的线程。

void func() 
{
}

int main()
{
    int(__stdcall* ZwCreateThreadEx)(HANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, HANDLE, PVOID, PVOID, ULONG, ULONG_PTR, SIZE_T, SIZE_T, PVOID) = (decltype(ZwCreateThreadEx))GetProcAddress(GetModuleHandle("ntdll.dll"),"ZwCreateThreadEx");
    HANDLE hThread=0;
    ZwCreateThreadEx(&hThread,0x1FFFFF,0,GetCurrentProcess(), 
            (LPTHREAD_START_ROUTINE)func,0, 0x4/*hide flag*/,0,0x1000,0x10000,0);
    return 0;
}

【讨论】：

【解决方案2】：

你可以这样做：

获取进程线程ID列表，使用CreateToolhelp32Snapshot
使用方法转到第一个线程：Thread32First。
对于每个找到的线程（您应该检查是否属于给定进程）：
然后使用OpenThread打开线程，从它的线程id中检索线程句柄，
当您拥有句柄时，您可以使用SuspendThread 方式挂起线程以检索先前的挂起计数，
然后您可以恢复线程，直到其暂停计数为 0。您必须至少恢复一次以取消上一步的暂停。
如果线程不允许被挂起，你可以使用ResumeThread来获取挂起计数，即使它没有被挂起。
使用CloseHandle关闭线程句柄
迭代到下一个线程使用Thread32Next。

为了能够完成所有操作，您必须以管理员身份运行。

这是一个例子：

void TraverseProcessThreads(DWORD pid)
{
  HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0); //get list of all system thread
  if( hSnapshot == INVALID_HANDLE_VALUE)
  { 
     //print error and return;
     return;
  }
  THREADENTRY32 threadEntry;
  if( Thread32First( hSnapshot, &threadEntry) ) 
  {
     size_t threadsCounter = 0, suspendedThreadsCounter=0;
     do{
       if(te.th32OwnerProcessID == pid) //we get all threads in system, should filter the relevant pid.
       {
         threadsCounter ++; //found thread
         HANDLE hThread = OpenThread(THREAD_ALL_ACCESS,FALSE,te.th32ThreadID); //get  handle to thread from its thread id
         if(hThread == NULL) //
         {
           //print error and break. (will be permission error if not administrator)
           break; 
         }
         int suspensionCount = SuspendThread( hThread ) ;//will return previous suspension count. you can also use ResumeThread if there's no way it can be suspended.
         if(suspensionCount > 0) 
         {
            //thread was suspended 
            suspendedThreadsCounter ++;   
         }
         //cancel our suspension... 
         suspensionCount = ResumeThread(hThread );

         /*to resume suspended thread use ResumeThread until it return 1.
         do{
           suspensionCount = ResumeThread(hThread );
         }while (suspensionCount > 1); //similar to Suspend Resume return previous Suspention count. 
         */   
       }  
       CloseHandle(hThread);      
     }while(Thread32Next( hSnapshot, &threadEntry) );
     //print results:
     cout<<"process id"<<pid<<endl<<" has "<<threadsCounter <<" threads " <<endl
       <<suspendedThreadsCounter <<" threads was suspended"<<endl;
  }
  else{
    //print some error...
  } 
  CloseHandle(hSnapshot);
}

【讨论】：