c语言编程杀死指定进程,发一个以前写的强杀进程的程序

该楼层疑似违规已被系统折叠 隐藏此楼查看此楼

要乱用。。。。。。。经常会蓝屏的。。。。。。。是驱动别拿去干坏事。。。。这个版本不稳定，ring0代码多了就这幅鸟样

#include "Driver.h" //这个就懒得贴了。。。。。

#pragma PAGECODE

extern "C" VOID DriverUnload(PDRIVER_OBJECT pDriverObj)

{

DbgPrint("Driver Unloaded\n");

} #pragma INITCODE

extern "C" NTSTATUS DriverEntry (IN PDRIVER_OBJECT pDriverObject,IN PUNICODE_STRING pRegistryPath)

{

KdPrint(("Enter DriverEntry\n"));

//later will do the recover code

TerminateThread((PETHREAD)0x86f74718); //test

pDriverObject->DriverUnload = DriverUnload;

return STATUS_SUCCESS;

} //PspTerminateThreadByPointer stamp code:0x50 0xe8

extern "C" ULONG GetPspTerminateThreadByPointer()

{

UNICODE_STRING funcName;

RtlInitUnicodeString(&funcName, L"PsTerminateSystemThread");

ULONG m_index=0;

ULONG m_ki_fun=0;

ULONG m_ke_address=(ULONG)MmGetSystemRoutineAddress(&funcName);//Address of KeInsertQueueApc

for (m_index=m_ke_address;m_index

{

//searching for 0x50,0xe8

if (((*(PUCHAR)(UCHAR*)(m_index-1))==0x50)&&((*(PUCHAR)(UCHAR*)(m_index))==0xe8))

{

ULONG m_offset=*(PULONG)(m_index+1);

m_ki_fun=m_index+5+m_offset;

break;

}

}

return m_ki_fun;

} //PspExitThread stamp code:0x0c 0xe8

extern "C" ULONG GetPspExitThread(ULONG PspTerminateThreadByPointer)

{

ULONG m_index=0;

ULONG m_ki_fun=0;

ULONG m_ke_address=PspTerminateThreadByPointer;

for (m_index=m_ke_address;m_index

{

//searching for 0x0c,0xe8

if (((*(PUCHAR)(UCHAR*)(m_index-1))==0x0c)&&((*(PUCHAR)(UCHAR*)(m_index))==0xe8))

{

ULONG m_offset=*(PULONG)(m_index+1);

m_ki_fun=m_index+5+m_offset;

break;

}

}

return m_ki_fun;

} //KiInsertQueueApc:0x28 0xe8

extern "C" ULONG GetKiInsertQueueApc()

{

UNICODE_STRING funcName;

RtlInitUnicodeString(&funcName, L"KeInsertQueueApc");

ULONG m_index=0;

ULONG m_ki_fun=0;

ULONG m_ke_address=(ULONG)MmGetSystemRoutineAddress(&funcName);//Address of KeInsertQueueApc

for (m_index=m_ke_address;m_index

{

//searching for 0x28,0xe8

if (((*(PUCHAR)(UCHAR*)(m_index-1))==0x28)&&((*(PUCHAR)(UCHAR*)(m_index))==0xe8))

{

//80829059-(8082944d+5)=fffffc07

ULONG m_offset=*(PULONG)(m_index+1);

m_ki_fun=m_index+5+m_offset;

break;

}

}

return m_ki_fun;

} extern "C" ULONG GetThreadFlagsOffset()

{

UCHAR *cPtr, *pOpcode;

ULONG Length;

USHORT Offset;

for (cPtr = (PUCHAR)PsTerminateSystemThread;

cPtr < (PUCHAR)PsTerminateSystemThread + 0x100;

cPtr += Length)

{

Length = SizeOfCode(cPtr, &pOpcode);

if (!Length) break;

if (*(USHORT *)pOpcode == 0x80F6) //f6804802000010 test byte ptr [eax+248h],10h

{

Offset=*(USHORT *)((ULONG)pOpcode+2);

return Offset;

//break;

}

}

return 0;

}

extern "C" VOID KernelTerminateThreadRoutine(

IN PKAPC Apc,

IN OUT PKNORMAL_ROUTINE *NormalRoutine,

IN OUT PVOID *NormalContext,

IN OUT PVOID *SystemArgument1,

IN OUT PVOID *SystemArgument2

)

{

PspExitThread=(PSPEXITTHREAD)GetPspExitThread(GetPspTerminateThreadByPointer()); ULONG ThreadFlagsOffset=GetThreadFlagsOffset();

PULONG ThreadFlags;

DbgPrint("[TerminateThread] KernelTerminateThreadRoutine. ");

ExFreePool(Apc);

if (ThreadFlagsOffset)

{

ThreadFlags=(ULONG *)((ULONG)(PsGetCurrentThread())+ThreadFlagsOffset);

*ThreadFlags=(*ThreadFlags)|PS_CROSS_THREAD_FLAGS_SYSTEM;

//PsTerminateSystemThread(STATUS_SUCCESS); //Terminate

(*PspExitThread)(STATUS_SUCCESS);

}

else

{

//failed

}

return;

} extern "C" BOOLEAN TerminateThread(PETHREAD Thread)

{

KiInsertQueueApc=(KIINSERTQUEUEAPC)GetKiInsertQueueApc();

PKAPC Apc=NULL;

BOOLEAN blnSucceed=FALSE;

if (!MmIsAddressValid(Thread)) return FALSE; //error.

Apc=(PKAPC)ExAllocatePool(NonPagedPool,sizeof(KAPC));

KeInitializeApc(Apc,

Thread,

originalApcEnvironment,

KernelTerminateThreadRoutine,

NULL,

NULL,

KernelMode,

NULL); //special apc - whether alertable or not makes no difference..

/*blnSucceed=KeInsertQueueApc(Apc,

NULL,

NULL,

0);*/

(*KiInsertQueueApc)(Apc,(KPRIORITY)Apc);

blnSucceed=TRUE;

return blnSucceed;

}