#include <ntddk.h>
typedef NTSTATUS ( * PSPTERPROC) ( PEPROCESS Process , NTSTATUS ExitStatus );
PSPTERPROC MyPspTerminateProcess ;
NTSTATUS
PsLookupProcessByProcessId(
IN HANDLE ProcessId ,
OUT PEPROCESS * Process
);
void Unload( PDRIVER_OBJECT pDriverObj)
{
DbgPrint( "Driver Stop /n ");
}
NTSTATUS DriverEntry( PDRIVER_OBJECT pDriverObj , PUNICODE_STRING pRegistryString)
{
PEPROCESS hProcess;
MyPspTerminateProcess =( PSPTERPROC) 0x805c8642;
//比如冰刃的进程ID为1732
if( PsLookupProcessByProcessId( 1732 , & hProcess) == STATUS_SUCCESS)
{
MyPspTerminateProcess( hProcess , 0);
}
pDriverObj -> DriverUnload = Unload;
return STATUS_SUCCESS;
}
typedef NTSTATUS ( * PSPTERPROC) ( PEPROCESS Process , NTSTATUS ExitStatus );
PSPTERPROC MyPspTerminateProcess ;
NTSTATUS
PsLookupProcessByProcessId(
IN HANDLE ProcessId ,
OUT PEPROCESS * Process
);
void Unload( PDRIVER_OBJECT pDriverObj)
{
DbgPrint( "Driver Stop /n ");
}
NTSTATUS DriverEntry( PDRIVER_OBJECT pDriverObj , PUNICODE_STRING pRegistryString)
{
PEPROCESS hProcess;
MyPspTerminateProcess =( PSPTERPROC) 0x805c8642;
//比如冰刃的进程ID为1732
if( PsLookupProcessByProcessId( 1732 , & hProcess) == STATUS_SUCCESS)
{
MyPspTerminateProcess( hProcess , 0);
}
pDriverObj -> DriverUnload = Unload;
return STATUS_SUCCESS;
}
-----------------------------------------------------------------------------
以上代码使用了系统未导出函数PspTerminateProcess结束了冰刃,
函数的地址是我用WinDbg看到的,所以可能在不同的系统里地址不同。