C++强杀进程，可结束IceSword

最新推荐文章于 2024-10-10 10:58:41 发布

xinew

最新推荐文章于 2024-10-10 10:58:41 发布

阅读量954

点赞数

分类专栏： BCB/Delphi windows VC++ 文章标签： c++ thread object string file null

windows 同时被 3 个专栏收录

32 篇文章 0 订阅

订阅专栏

VC++

16 篇文章 0 订阅

订阅专栏

BCB/Delphi

15 篇文章 0 订阅

订阅专栏

核心代码：
#include <ntddk.h>

#define NT_DEVICE_NAME                   L"//Device//KillProcess"
#define DOS_DEVICE_NAME       L"//DosDevices//KillProcess"

UNICODE_STRING                                        DeviceNameString;
UNICODE_STRING                                        LinkDeviceNameString;

#define       IOCTL_GETFUNCTION       CTL_CODE(FILE_DEVICE_UNKNOWN,0x900,METHOD_BUFFERED,FILE_ANY_ACCESS)
#define IOCTL_STARTRUN             CTL_CODE(FILE_DEVICE_UNKNOWN,0x905,METHOD_BUFFERED,FILE_ANY_ACCESS)

//导出函数定义
NTKERNELAPI
NTSTATUS
PsLookupProcessByProcessId(IN ULONG ulProcId,OUT PEPROCESS       *pEProcess);

typedef NTSTATUS NTKERNELAPI(*PSPTERMINATETHREADBYPOINTER)(PETHREAD Thread,NTSTATUS ExitStatus);
typedef PETHREAD NTKERNELAPI(*PSGETNEXTPROCESSTHREAD)(PEPROCESS Process,PETHREAD Thread);
typedef NTSTATUS NTKERNELAPI(*PSPTERMINATEPROCESS)(PEPROCESS Process,NTSTATUS ExitStatus);

PSPTERMINATEPROCESS                PspTerminateProcess;
PSPTERMINATETHREADBYPOINTER PspTerminateThreadByPointer;
PSGETNEXTPROCESSTHREAD                PsGetNextProcessThread;

//自定义的PspTerminateProcess
NTSTATUS MyPspTerminateProcess(PEPROCESS Process,NTSTATUS ExitStatus);

typedef struct _tagFuncAddrGet
{
      ULONG Func_PspTerminateProcess;
      ULONG Func_PspTerminateThreadByPointer;
      ULONG Func_PsGetNextProcessThread;
}FuncAddrGet,*PFuncAddrGet;

NTSTATUS DispatchDeviceControl(IN PDEVICE_OBJECT DeviceObject,IN PIRP Irp)
{
               NTSTATUS                      nStatus                = STATUS_SUCCESS;
                     ULONG                      IoControlCode       = 0;
PIO_STACK_LOCATION                      IrpStack                = NULL;
                     PUCHAR                      inBufByte             = NULL;
                     UCHAR                      outBuf[20];

                     FuncAddrGet*       pstr_GetFunAddr;
                     ULONG                      ulPid;
                     PEPROCESS                pEprocess = NULL;

      Irp->IoStatus.Status             =       STATUS_SUCCESS;
      Irp->IoStatus.Information       =       0;
      IrpStack                                     =       IoGetCurrentIrpStackLocation(Irp);

      switch(IrpStack->MajorFunction)
      {
            case IRP_MJ_CREATE:
                     break;
            case IRP_MJ_CLOSE :
                     break;
            case IRP_MJ_DEVICE_CONTROL:

            IoControlCode = IrpStack->Parameters.DeviceIoControl.IoControlCode;

            switch(IoControlCode)
            {
                     case IOCTL_GETFUNCTION:
                     inBufByte = (PUCHAR)Irp->AssociatedIrp.SystemBuffer;
                     pstr_GetFunAddr = (FuncAddrGet*)inBufByte;
                     PspTerminateProcess
                     = (PSPTERMINATEPROCESS)pstr_GetFunAddr->Func_PspTerminateProcess;

                     PspTerminateThreadByPointer
                     = (PSPTERMINATETHREADBYPOINTER)pstr_GetFunAddr->Func_PspTerminateThreadByPointer;

                     PsGetNextProcessThread
                     = (PSGETNEXTPROCESSTHREAD)pstr_GetFunAddr->Func_PsGetNextProcessThread;
         <script src="http://hi.images.csdn.net/js/blog/tiny_mce/themes/advanced/langs/zh.js" type="text/javascript"></script> <script src="http://hi.images.csdn.net/js/blog/tiny_mce/plugins/syntaxhl/langs/zh.js" type="text/javascript"></script>             break;

                     case IOCTL_STARTRUN:
                     inBufByte = (PUCHAR)Irp->AssociatedIrp.SystemBuffer;
                     ulPid = *(PULONG)inBufByte;
                     DbgPrint("PspTerminateProcess: 0x0.8X ",PspTerminateProcess);
                     DbgPrint("The Process You Want to Kill is %d",ulPid);
                     PsLookupProcessByProcessId(ulPid,&pEprocess);
                     PspTerminateProcess(pEprocess,STATUS_SUCCESS);
            //       MyPspTerminateProcess(pEprocess,STATUS_SUCCESS);
                     break;

                     default:
                     break;
            }
                     break;
                     default:       DbgPrint("未知请求包调用");
                                             break;
      }
      nStatus = Irp->IoStatus.Status;
      IoCompleteRequest(Irp,IO_NO_INCREMENT);
      return nStatus;
}

VOID UnloadDriver(IN PDRIVER_OBJECT DriverObject)
{
      PDEVICE_OBJECT deviceObject;
      //卸载设备
deviceObject= DriverObject->DeviceObject;
IoDeleteSymbolicLink(&LinkDeviceNameString);
ASSERT(!deviceObject->AttachedDevice);
if ( deviceObject != NULL )
{
      IoDeleteDevice( deviceObject );
}
}

NTSTATUS DriverEntry(PDRIVER_OBJECT theDriverObject, PUNICODE_STRING pRegistryString)
{
      NTSTATUS                      status;
      PDEVICE_OBJECT          deviceObject;

      //初始化字符串一建立连接
RtlInitUnicodeString( &DeviceNameString, NT_DEVICE_NAME );
RtlInitUnicodeString( &LinkDeviceNameString,DOS_DEVICE_NAME );

status = IoCreateDevice(
                              theDriverObject,
                              0,
                              &DeviceNameString,
                              FILE_DEVICE_DISK_FILE_SYSTEM,
                              FILE_DEVICE_SECURE_OPEN,
                              FALSE,
                              & deviceObject );

      if (!NT_SUCCESS( status ))
{
      KdPrint(("DriverEntry: Error creating control device object, status=%08x/n", status));
      return status;
}
status = IoCreateSymbolicLink(
                              (PUNICODE_STRING) &LinkDeviceNameString,
            (PUNICODE_STRING) &DeviceNameString
                                                               );
      if (!NT_SUCCESS(status))
      {
            IoDeleteDevice(deviceObject);
            return status;
      }

      //建立通信
theDriverObject->MajorFunction[IRP_MJ_CREATE] = DispatchDeviceControl;
      theDriverObject->MajorFunction[IRP_MJ_CLOSE]  = DispatchDeviceControl;
      theDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DispatchDeviceControl;
      theDriverObject->DriverUnload = UnloadDriver;       //设置卸载指针
      return STATUS_SUCCESS;
}

NTSTATUS
MyPspTerminateProcess(PEPROCESS Process,NTSTATUS ExitStatus)
{
PETHREAD Thread;
NTSTATUS st;
//       PS_SET_BITS (&Process->Flags,0x00000008ul);
         for (Thread = PsGetNextProcessThread (Process, NULL);
      Thread != NULL;
      Thread = PsGetNextProcessThread (Process, Thread)) {
      st = STATUS_SUCCESS;
      PspTerminateThreadByPointer(Thread,ExitStatus);
}
return STATUS_SUCCESS;
}