#include <stdio.h>
#include <windows.h>
typedef long (__stdcall *ZWGETNEXTPROCESS)(HANDLE, long, long, long, PHANDLE);
typedef long (__stdcall *ZWUNMAPVIEWOFSECTION)(HANDLE, PVOID);
typedef ULONG (__stdcall *GETPROCESSID)(HANDLE Process);
HANDLE MiniFxOpenProcess(ULONG dwDesiredAccess, ULONG bInheritHandle, ULONG dwProcessId) {
ZWGETNEXTPROCESS ZwGetNextProcess=(ZWGETNEXTPROCESS)GetProcAddress(GetModuleHandle("ntdll.dll"), "ZwGetNextProcess");
GETPROCESSID GetProcessId=(GETPROCESSID)GetProcAddress(GetModuleHandle("kernel32.dll"), "GetProcessId");
HANDLE hCurrent=0, hNext=0;
ULONG dwPid=0;
long Status=0;
if((PVOID)ZwGetNextProcess==NULL||(PVOID)GetProcessId==NULL)
return (HANDLE)0;
Status = ZwGetNextProcess(0, dwDesiredAccess, 0, 0, &hNext);
if (Status >= 0) {
do {
hCurrent = hNext;
dwPid = GetProcessId(hCurrent);
if (dwPid==dwProcessId)
return hCurrent;
Status = ZwGetNextProcess(hCurrent, dwDesiredAccess, 0, 0, &hNext);
CloseHandle(hCurrent);
} while(hCurrent != 0);
}
return (HANDLE)0;
}
void Unistall(ULONG ulProcessId) {
HANDLE hProc=0;
hProc=MiniFxOpenProcess(PROCESS_ALL_ACCESS, 0, ulProcessId);
HMODULE hModule=GetModuleHandle("ntdll.dll");
ZWUNMAPVIEWOFSECTION ZwUnmapViewOfSection=(ZWUNMAPVIEWOFSECTION)GetProcAddress(hModule, "ZwUnmapViewOfSection");
if(hProc!=0) {
ZwUnmapViewOfSection(hProc, (PVOID)GetModuleHandle("ntdll.dll"));
ZwUnmapViewOfSection(hProc, (PVOID)GetModuleHandle("kernel32.dll"));
ZwUnmapViewOfSection(hProc, (PVOID)GetModuleHandle("kernelbase.dll"));
}
CloseHandle(hProc);
}
int main() {
ULONG pid=0;
HANDLE hProc=0;
printf("Input PID: ");
scanf("%ld", &pid);
Unistall(pid);
return 0;
}
//dev c++编译通过
//适用于windows
喜欢就点赞吧!