ObRegisterCallbacks process freezes

NTDEV
1

Hey, I really need help with my driver. I tried to protect my process with driver from cheaters.
When I start my driver before the game and after that I start game from steam then steam just freezes, and the process itself does not start.
Any idea how to solve it?
Thanks everyone for help.

2

Validate data on server.
Users have full access to their PC. Hackers will find a way to disable your protection.

Client-side anti-cheat(especially kernel-level one) will just make people hate you.
Haven’t you heard about recent Denuvo anti-cheat for Doom debacle ?

3

@Sergey_Pisarev said:
Validate data on server.
Hackers will find a way to disable your protection.
Yes, I know they can bypass, but will be a little more difficult than just injection with a conventional injector.
I still need help to figure out what the problem

4

I can use my driver after launch game and this is works good, but when you start game some one can use FindWindows for injection and then he can inject .dll inside game, after 1 second maybe less process will be protected

5

Read about protected processes in Windows.
I think code can’t be injected in such processes.

6

Any idea how to solve it?

Your message is essentially saying “My driver doesn’t work. How do I fix it?” We don’t have any idea what your driver does. You’ll have to hook up a debugger and see what is blocking the process’ threads. Of course, some games check for the presence of a debugger and won’t launch.

7

@Tim_Roberts said:

Any idea how to solve it?

Your message is essentially saying “My driver doesn’t work. How do I fix it?” We don’t have any idea what your driver does. You’ll have to hook up a debugger and see what is blocking the process’ threads. Of course, some games check for the presence of a debugger and won’t launch.

Thank you for answer, I’ll try to look inside Windbg

8

@Sergey_Pisarev said:
Read about protected processes in Windows.
I think code can’t be injected in such processes.

I got it, thank you for answer

9

Okay, I figured out.
I just looked at process and and he was suspended.
Thank you everyone who helped me.