From cabe76ca5433af770feaeb95f493d3ee2a99fb77 Mon Sep 17 00:00:00 2001
From: 87owo <85057800+87owo@users.noreply.github.com>
Date: Thu, 21 May 2026 00:26:14 +0800
Subject: [PATCH] Add files via upload

---
 Plugins/Filter/DriverEntry.cpp     | 29 +++++++++++++++++++----------
 Plugins/Filter/ProtectProcess.cpp  | 13 ++++++++++---
 Plugins/Filter/ProtectRegistry.cpp | 12 +++++++++---
 Plugins/Filter/ProtectRules.cpp    |  4 ++--
 4 files changed, 40 insertions(+), 18 deletions(-)

diff --git a/Plugins/Filter/DriverEntry.cpp b/Plugins/Filter/DriverEntry.cpp
index 8553629..11bd445 100644
--- a/Plugins/Filter/DriverEntry.cpp
+++ b/Plugins/Filter/DriverEntry.cpp
@@ -1,6 +1,7 @@
 #include "DriverCommon.h"
 
 DRIVER_DATA GlobalData;
+static BOOLEAN g_ImageNotifyRegistered = FALSE;
 
 static NTSTATUS InstanceSetup(PCFLT_RELATED_OBJECTS FltObjects, FLT_INSTANCE_SETUP_FLAGS Flags, DEVICE_TYPE VolumeDeviceType, FLT_FILESYSTEM_TYPE VolumeFilesystemType) {
     UNREFERENCED_PARAMETER(FltObjects);
@@ -39,7 +40,11 @@ static NTSTATUS DriverUnload(FLT_FILTER_UNLOAD_FLAGS Flags) {
         GlobalData.FilterHandle = NULL;
     }
 
-    PsRemoveLoadImageNotifyRoutine(ImageLoadNotify);
+    if (g_ImageNotifyRegistered) {
+        PsRemoveLoadImageNotifyRoutine(ImageLoadNotify);
+        g_ImageNotifyRegistered = FALSE;
+    }
+
     UninitializeRegistryProtection();
     UninitializeProcessProtection();
 
@@ -57,12 +62,9 @@ static NTSTATUS PortMessage(PVOID PortCookie, PVOID InputBuffer, ULONG InputBuff
     if (InputBuffer && InputBufferLength >= sizeof(PYAS_USER_MESSAGE)) {
         PPYAS_USER_MESSAGE msg = (PPYAS_USER_MESSAGE)InputBuffer;
         if (msg->Command == 1 || msg->Command == 2) {
-
             msg->Path[MAX_PATH_LEN - 1] = L'\0';
-
             UNICODE_STRING us;
             RtlInitUnicodeString(&us, msg->Path);
-
             if (us.Length > 0) {
                 if (msg->Command == 1) {
                     AddDynamicWhitelist(&us);
@@ -174,22 +176,29 @@ extern "C" NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING Reg
     }
 
     if (!NT_SUCCESS(status)) {
-        if (GlobalData.FilterHandle) {
-            FltUnregisterFilter(GlobalData.FilterHandle);
-            GlobalData.FilterHandle = NULL;
-        }
+        FltUnregisterFilter(GlobalData.FilterHandle);
+        GlobalData.FilterHandle = NULL;
         UnloadRules();
         UninitializeRulesEngine();
         return status;
     }
 
     InitializeProcessProtection();
+
     InitializeRegistryProtection(DriverObject);
-    PsSetLoadImageNotifyRoutine(ImageLoadNotify);
+
+    NTSTATUS imageNotifyStatus = PsSetLoadImageNotifyRoutine(ImageLoadNotify);
+    if (NT_SUCCESS(imageNotifyStatus)) {
+        g_ImageNotifyRegistered = TRUE;
+    }
 
     status = FltStartFiltering(GlobalData.FilterHandle);
     if (!NT_SUCCESS(status)) {
-        PsRemoveLoadImageNotifyRoutine(ImageLoadNotify);
+        if (g_ImageNotifyRegistered) {
+            PsRemoveLoadImageNotifyRoutine(ImageLoadNotify);
+            g_ImageNotifyRegistered = FALSE;
+        }
+
         UninitializeRegistryProtection();
         UninitializeProcessProtection();
 
diff --git a/Plugins/Filter/ProtectProcess.cpp b/Plugins/Filter/ProtectProcess.cpp
index dadfa83..4776efe 100644
--- a/Plugins/Filter/ProtectProcess.cpp
+++ b/Plugins/Filter/ProtectProcess.cpp
@@ -189,8 +189,7 @@ static OB_PREOP_CALLBACK_STATUS PreOpenThread(PVOID RegistrationContext, POB_PRE
 }
 
 NTSTATUS InitializeProcessProtection() {
-    static UNICODE_STRING Altitude = { 0 };
-    RtlInitUnicodeString(&Altitude, L"320000");
+    static UNICODE_STRING Altitude = RTL_CONSTANT_STRING(L"320000.PYAS.Ob");
 
     ObCallbacks[0].ObjectType = PsProcessType;
     ObCallbacks[0].Operations = OB_OPERATION_HANDLE_CREATE | OB_OPERATION_HANDLE_DUPLICATE;
@@ -208,7 +207,15 @@ NTSTATUS InitializeProcessProtection() {
     ObRegistration.RegistrationContext = NULL;
     ObRegistration.OperationRegistration = ObCallbacks;
 
-    return ObRegisterCallbacks(&ObRegistration, &ObRegistrationHandle);
+    NTSTATUS status = ObRegisterCallbacks(&ObRegistration, &ObRegistrationHandle);
+
+    if (!NT_SUCCESS(status) && (status == STATUS_FLT_INSTANCE_ALTITUDE_COLLISION || status == STATUS_OBJECT_NAME_COLLISION)) {
+        static UNICODE_STRING FallbackAltitude = RTL_CONSTANT_STRING(L"320000.PYAS.Ob.Fallback");
+        ObRegistration.Altitude = FallbackAltitude;
+        status = ObRegisterCallbacks(&ObRegistration, &ObRegistrationHandle);
+    }
+
+    return status;
 }
 
 VOID UninitializeProcessProtection() {
diff --git a/Plugins/Filter/ProtectRegistry.cpp b/Plugins/Filter/ProtectRegistry.cpp
index f081bcd..f780700 100644
--- a/Plugins/Filter/ProtectRegistry.cpp
+++ b/Plugins/Filter/ProtectRegistry.cpp
@@ -235,9 +235,15 @@ static NTSTATUS RegistryCallback(PVOID CallbackContext, PVOID Argument1, PVOID A
 }
 
 NTSTATUS InitializeRegistryProtection(PDRIVER_OBJECT DriverObject) {
-    UNICODE_STRING Altitude;
-    RtlInitUnicodeString(&Altitude, L"320000");
-    return CmRegisterCallbackEx(RegistryCallback, &Altitude, DriverObject, NULL, &Cookie, NULL);
+    static UNICODE_STRING Altitude = RTL_CONSTANT_STRING(L"320000.PYAS.Cm");
+    NTSTATUS status = CmRegisterCallbackEx(RegistryCallback, &Altitude, DriverObject, NULL, &Cookie, NULL);
+
+    if (!NT_SUCCESS(status)) {
+        static UNICODE_STRING FallbackAltitude = RTL_CONSTANT_STRING(L"320000.PYAS.Cm.Fallback");
+        status = CmRegisterCallbackEx(RegistryCallback, &FallbackAltitude, DriverObject, NULL, &Cookie, NULL);
+    }
+
+    return status;
 }
 
 VOID UninitializeRegistryProtection() {
diff --git a/Plugins/Filter/ProtectRules.cpp b/Plugins/Filter/ProtectRules.cpp
index d560854..0d54b0d 100644
--- a/Plugins/Filter/ProtectRules.cpp
+++ b/Plugins/Filter/ProtectRules.cpp
@@ -525,7 +525,7 @@ BOOLEAN IsProcessTrusted(HANDLE ProcessId) {
     if (g_CacheInitialized) {
         KIRQL OldIrql;
         KeAcquireSpinLock(&TrustCacheLock, &OldIrql);
-        ULONG Hash = ((ULONG)(ULONG_PTR)ProcessId) & (TRUST_CACHE_SIZE - 1);
+        ULONG Hash = (((ULONG)(ULONG_PTR)ProcessId) >> 2) & (TRUST_CACHE_SIZE - 1);
 
         if (TrustCache[Hash].Process == Process && TrustCache[Hash].ProcessCreateTime.QuadPart == createTime.QuadPart) {
             LARGE_INTEGER Now;
@@ -580,7 +580,7 @@ update_cache:
     if (g_CacheInitialized) {
         KIRQL OldIrql;
         KeAcquireSpinLock(&TrustCacheLock, &OldIrql);
-        ULONG Hash = ((ULONG)(ULONG_PTR)ProcessId) & (TRUST_CACHE_SIZE - 1);
+        ULONG Hash = (((ULONG)(ULONG_PTR)ProcessId) >> 2) & (TRUST_CACHE_SIZE - 1);
         TrustCache[Hash].Process = Process;
         TrustCache[Hash].ProcessCreateTime = createTime;
         TrustCache[Hash].IsTrusted = isTrusted;