进程断链。

最新推荐文章于 2024-04-21 00:22:55 发布

ADADQDQQ

最新推荐文章于 2024-04-21 00:22:55 发布

阅读量491

点赞数

分类专栏：系统调用

本文链接：https://blog.csdn.net/ADADQDQQ/article/details/119133327

版权

Win7可用 Win10会PG 大概随机几个小时左右就会蓝屏
可应付普通的通过系统API搜索的检测

#include <ntddk.h>

PsGetProcessImageFileName(
__in PEPROCESS Process
);

NTSTATUS
PsLookupProcessByProcessId(
__in HANDLE ProcessId,
__deref_out PEPROCESS* Process
);

PEPROCESS FindProcessByName(char* Name)
{
PEPROCESS findProcess = NULL;
for (int i = 4; i < 0x1000000; i += 4)
{
PEPROCESS Process = NULL;
NTSTATUS status = PsLookupProcessByProcessId((HANDLE)i, &Process);
if (!NT_SUCCESS(status))
{
continue;
}

	PUCHAR processname = PsGetProcessImageFileName(Process);
	if (processname && _stricmp(processname, Name) == 0)
	{
		findProcess = Process;
		break;
	}

	ObDereferenceObject(Process);
}
return findProcess;

}

VOID DriverUnload(PDRIVER_OBJECT pDriverObject)
{