驱动关闭进程

#include <ntifs.h>
NTSTATUS ZwQuerySystemInformation(
	ULONG SystemClass,
	PVOID SystemInformation,
	ULONG SystemInformationLength,
	PULONG RetLength
	);

typedef struct _SYSTEM_THREADS
{
	LARGE_INTEGER  KernelTime;
	LARGE_INTEGER  UserTime;
	LARGE_INTEGER  CreateTime;
	ULONG    WaitTime;
	PVOID    StartAddress;
	CLIENT_ID   ClientID;
	KPRIORITY   Priority;
	KPRIORITY   BasePriority;
	ULONG    ContextSwitchCount;
	ULONG    ThreadState;
	KWAIT_REASON  WaitReason;
	ULONG    Reserved; //Add
}SYSTEM_THREADS, *PSYSTEM_THREADS;

typedef struct _SYSTEM_PROCESS_INFORMATION {
	ULONG                   NextEntryOffset;
	ULONG                   NumberOfThreads;
	LARGE_INTEGER           Reserved[3];
	LARGE_INTEGER           CreateTime;
	LARGE_INTEGER           UserTime;
	LARGE_INTEGER           KernelTime;
	UNICODE_STRING          ImageName;
	KPRIORITY               BasePriority;
	HANDLE                  ProcessId;
	HANDLE                  InheritedFromProcessId;
	ULONG                   HandleCount;
	ULONG                   Reserved2[2];
	ULONG                   PrivatePageCount;
	VM_COUNTERS             VirtualMemoryCounters;
	IO_COUNTERS             IoCounters;
	SYSTEM_THREADS           Threads[0];
} SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;
CHAR*  PsGetProcessImageFileName(PEPROCESS Process);
NTSTATUS PsSuspendProcess(PEPROCESS Process);//挂起
NTSTATUS PsResumeProcess(PEPROCESS Process);//回复
void driveunload(PDRIVER_OBJECT pDriveObject)
{


	KdPrint(("卸载结束！\n"));

}
//使用接口 来结束进程！
void MyTerminateProcess(ULONG Pid)
{
	NTSTATUS status;
	OBJECT_ATTRIBUTES objAttr = { 0 };
	CLIENT_ID  Client = { 0 };
	HANDLE hProcess=NULL;
	status = ZwOpenProcess(hProcess, PROCESS_ALL_ACCESS, &objAttr, &Client);
	if (NT_SUCCESS(status))
	{
		KdPrint(("成功进入函数！\n"));
		ZwTerminateProcess(hProcess, 0);
		ZwClose(hProcess);
	}


}
//暴力清0
void MyTerminateProcess2(ULONG Pid)
{
	NTSTATUS status;
	PEPROCESS Process;
	ULONG64  Address;
	status = PsLookupProcessByProcessId(Pid, &Process);
	if (NT_SUCCESS(status))
	{
		KeAttachProcess(Process);
		for (Address = 0; Address <= 0x80000000; Address += PAGE_SIZE)
		{
			_try
			{
				memset(Address, 0, PAGE_SIZE);

			}_except(0)
			{
				;
			   
			}

		}

		ObDereferenceObject(Process);

	}

}
void EumProcessByQueyInformation()
{
	NTSTATUS status;
	ULONG Retlength;
	PVOID Buffer = NULL;
	PSYSTEM_PROCESS_INFORMATION SystemProcess = NULL;
	status = ZwQuerySystemInformation(5, NULL,0,&Retlength);
	if (status == STATUS_INFO_LENGTH_MISMATCH)
	{
		KdPrint(("开始运行！\n"));
		Buffer = ExAllocatePool(PagedPool, Retlength);
		if (Buffer)
		{
		 RtlZeroMemory(Buffer, Retlength);
         status = ZwQuerySystemInformation(5, Buffer, Retlength, &Retlength);
		 if (NT_SUCCESS(status))
		 {
			 SystemProcess = Buffer;
			 do{
				 KdPrint(("%wZ\n", SystemProcess->ImageName));
				 SystemProcess = ((ULONG64)SystemProcess) + SystemProcess->NextEntryOffset;
			 } while (SystemProcess->NextEntryOffset);
				 

		  }
		   ExFreePool(Buffer);
		}
		


	}

}   
void EumProcessByLookUpProcessId()
{
	ULONG Pid;
	NTSTATUS status;
	PEPROCESS Process;
	for (Pid = 0; Pid <= 240000; Pid += 4)
	{ 
		status = PsLookupProcessByProcessId(Pid, &Process);
		if (NT_SUCCESS(status))
		{
			KdPrint(("%s\n", PsGetProcessImageFileName(Process)));
			if (strstr(PsGetProcessImageFileName(Process),"notepad"))
			{
			  //	PsSuspendProcess(Process);//挂起
				MyTerminateProcess(Pid);
			}
			ObDereferenceObject(Process);
		}
	}
}
NTSTATUS  DriverEntry(PDRIVER_OBJECT DriveObject,PUNICODE_STRING RegisterPath)
{
	//EumProcessByQueyInformation();
	EumProcessByLookUpProcessId();
	DriveObject->DriverUnload = driveunload;

	 return STATUS_SUCCESS;
}