杀手归来！Process Killer 终于可以笑傲江湖了！

继前2片《谋杀》系列失败后，

(1) 发现了在公司的电脑中影响Windows性能，造成硬盘唱狂响曲的罪魁祸首！
(2) 谋杀失败！可以杀掉Notepad.exe这样的进程，却对CcmExec.exe这个进程没有办法！

并没有放弃，彻底分析后，终于让Killer可以笑傲江湖了...

摘略如下:

之所以不能杀掉...最大的原因就是执行的程序的级别小于要杀掉的进程的级别，所以重点就是要解决这个问题！

代码如下：

   
   

    
    '
    
    '' API for Changing the Process' Privilege
    
    

    
    Private
    
     Declare 
    
    Function
    
     GetCurrentProcess Lib 
    
    "
    
    KERNEL32
    
    "
    
     () 
    
    As
    
     
    
    Long
    
    

    
    Private
    
     Declare 
    
    Function
    
     LookupPrivilegeValue Lib 
    
    "
    
    advapi32.dll
    
    "
    
     Alias 
    
    "
    
    LookupPrivilegeValueA
    
    "
    
     (ByVal lpSystemName 
    
    As
    
     
    
    String
    
    , ByVal lpName 
    
    As
    
     
    
    String
    
    , lpLuid 
    
    As
    
     LUID) 
    
    As
    
     
    
    Long
    
    

    
    Private
    
     Declare 
    
    Function
    
     AdjustTokenPrivileges Lib 
    
    "
    
    advapi32.dll
    
    "
    
     (ByVal TokenHandle 
    
    As
    
     
    
    Long
    
    , ByVal DisableAllPrivileges 
    
    As
    
     
    
    Long
    
    , NewState 
    
    As
    
     TOKEN_PRIVILEGES, ByVal BufferLength 
    
    As
    
     
    
    Long
    
    , PreviousState 
    
    As
    
     TOKEN_PRIVILEGES, ReturnLength 
    
    As
    
     
    
    Long
    
    ) 
    
    As
    
     
    
    Long
    
    

    
    Private
    
     Declare 
    
    Function
    
     OpenProcessToken Lib 
    
    "
    
    advapi32.dll
    
    "
    
     (ByVal ProcessHandle 
    
    As
    
     
    
    Long
    
    , ByVal DesiredAccess 
    
    As
    
     
    
    Long
    
    , TokenHandle 
    
    As
    
     
    
    Long
    
    ) 
    
    As
    
     
    
    Long
    
    


    
    '
    
    '' Adjust Priviledges
    
    

    
    Sub
    
     AdjustSelfTokenPrivileges()

  
    
    Dim
    
     hdlProcessHandle 
    
    As
    
     
    
    Long
    
    
  
    
    Dim
    
     hdlTokenHandle 
    
    As
    
     
    
    Long
    
    

  
    
    Dim
    
     tmpLuid 
    
    As
    
     LUID
  
    
    Dim
    
     tkp 
    
    As
    
     TOKEN_PRIVILEGES
  
    
    Dim
    
     tkpNewButIgnored 
    
    As
    
     TOKEN_PRIVILEGES
  
    
    Dim
    
     lBufferNeeded 
    
    As
    
     
    
    Long
    
    

  
    
    Dim
    
     lp 
    
    As
    
     
    
    Long
    
    

  hdlProcessHandle 
    
    =
    
     GetCurrentProcess()
  lp 
    
    =
    
     OpenProcessToken(hdlProcessHandle, TOKEN_ALL_ACCESS, hdlTokenHandle)
  lp 
    
    =
    
     LookupPrivilegeValue(
    
    ""
    
    , 
    
    "
    
    SeDebugPrivilege
    
    "
    
    , tmpLuid)
  tkp.PrivilegeCount 
    
    =
    
     
    
    1
    
    

  tkp.Privileges(
    
    0
    
    ).pLuid 
    
    =
    
     tmpLuid
  tkp.Privileges(
    
    0
    
    ).Attributes 
    
    =
    
     SE_PRIVILEGE_ENABLED
  lp 
    
    =
    
     AdjustTokenPrivileges(hdlTokenHandle, 
    
    False
    
    , tkp, 
    
    Len
    
    (tkpNewButIgnored), tkpNewButIgnored, lBufferNeeded)
    
    

End Sub
   
   

可以看到提高了Process Privilege后，就可以了！



同时，增加了2个特性，一个是从ini文件中读取配置信息：


另外一个是最小化到系统栏中，单击或双击托盘图标后恢复窗口：


改了这么多地方，就给他叫1.5.0版吧...

活活，正好赶上Firefox目前的主流版本...^ ^!