From 766f0e64852567aaef75e05f7ebd47005199c184 Mon Sep 17 00:00:00 2001
From: BeneficialCode <3123132899@qq.com>
Date: Sun, 27 Aug 2023 00:00:18 +0800
Subject: [PATCH] Update the hook function.

---
 Anti-Rootkit/AntiRootkit.h |  2 +-
 KernelLibrary/SysMon.cpp   | 34 ++++++++++++++++++++++++++--------
 WinArk/SystemConfigDlg.cpp |  2 +-
 3 files changed, 28 insertions(+), 10 deletions(-)

diff --git a/Anti-Rootkit/AntiRootkit.h b/Anti-Rootkit/AntiRootkit.h
index f958598..1bd8aec 100644
--- a/Anti-Rootkit/AntiRootkit.h
+++ b/Anti-Rootkit/AntiRootkit.h
@@ -45,7 +45,7 @@ Typical drivers just use FILE_ANY_ACCESS and deal with the actual request in the
 // 回调驱动 链接器 命令行 + -----> /integritycheck
 #define ANTI_ROOTKIT_DEVICE 0x8000
 
-#define DRIVER_CURRENT_VERSION 0xD6
+#define DRIVER_CURRENT_VERSION 0xD7
 
 
 // 用MDL锁定用户内存
diff --git a/KernelLibrary/SysMon.cpp b/KernelLibrary/SysMon.cpp
index 5031df6..04df301 100644
--- a/KernelLibrary/SysMon.cpp
+++ b/KernelLibrary/SysMon.cpp
@@ -12,6 +12,7 @@
 #include "Section.h"
 #include "SysMon.h"
 #include "detours.h"
+#include "kstring.h"
 
 #define LIMIT_INJECTION_TO_PROC L"notepad.exe"	// Process to limit injection to (only in Debugger builds)
 
@@ -1035,14 +1036,31 @@ using PI_MinCryptHashSearchCompare = int(NTAPI*) (
 PI_MinCryptHashSearchCompare g_pI_MinCryptHashSearchCompare = nullptr;
 
 int NTAPI HookI_MinCryptHashSearchCompare(size_t Size, PUCHAR Arg1, PUCHAR Arg2) {
-	for (int i = 0; i < Size; i++) {
-		DbgPrint("%02X", Arg1[i]);
-	}
-	LogInfo("\n");
-	for (int i = 0; i < Size; i++)
-		DbgPrint("%02X", Arg2[i]);
-	LogInfo("\n");
-
+	do
+	{
+		LogInfo("Pid: %d\n", PsGetCurrentProcessId());
+		PCHAR hash = (PCHAR)ExAllocatePool(PagedPool, Size * 2 + 1);
+		if (hash == nullptr) {
+			break;
+		}
+		hash[0] = '\0';
+		CHAR hex[3];
+		for (int i = 0; i < Size; i++) {
+			sprintf_s(hex, "%02X", Arg1[i]);
+			strcat(hash, hex);
+		}
+		LogInfo(hash);
+		hash[0] = '\0';
+		for (int i = 0; i < Size; i++) {
+			sprintf_s(hex, "%02X", Arg2[i]);
+			strcat(hash, hex);
+		}
+		LogInfo(hash);
+		if (hash != nullptr) {
+			ExFreePool(hash);
+		}
+	} while (FALSE);
+	
 	return memcmp(Arg1, Arg2, Size);
 }
 
diff --git a/WinArk/SystemConfigDlg.cpp b/WinArk/SystemConfigDlg.cpp
index 5f9047f..d30bc15 100644
--- a/WinArk/SystemConfigDlg.cpp
+++ b/WinArk/SystemConfigDlg.cpp
@@ -565,7 +565,7 @@ bool CSystemConfigDlg::InitCiSymbols(CiSymbols* pSym) {
 	if (pSym->MinCryptIsFileRevoked == nullptr)
 		return false;
 
-	pSym->I_MinCryptHashSearchCompare = (void*)SymbolHelper::GetCiSymbolAddressFromName("PI_MinCryptHashSearchCompare");
+	pSym->I_MinCryptHashSearchCompare = (void*)SymbolHelper::GetCiSymbolAddressFromName("I_MinCryptHashSearchCompare");
 	if (pSym->I_MinCryptHashSearchCompare == nullptr)
 		return false;