速度很快啊

killpy 没用过 这玩意和虚拟机啥区别

搜索一下,马上出来

NTSTATUS InjectCreateThread64(HANDLE ProcessId, PUNICODE_STRING pDllPath)
{
    ULONG ReturnLength;
    NTSTATUS status = STATUS_UNSUCCESSFUL;
    PEPROCESS Process = NULL;
    HANDLE ProcessHandle = NULL;
    PVOID pNtDllBase64;
    PVOID pfnLdrLoadDll64;

    status = PsLookupProcessByProcessId((HANDLE)ProcessId, &Process);
    if (NT_SUCCESS(status))
    {
        //Do not inject WOW64 process
        status = STATUS_UNSUCCESSFUL;
        if (PsGetProcessWow64Process(Process) == NULL)
        {
            status = ObOpenObjectByPointer(Process, OBJ_KERNEL_HANDLE, NULL, PROCESS_ALL_ACCESS, NULL, KernelMode, &ProcessHandle);
            if (NT_SUCCESS(status))
            {
                pNtDllBase64 = PsNtDllBase64;
                pfnLdrLoadDll64 = fnLdrLoadDll64;

                if (!pfnLdrLoadDll64)
                {
                    UNICODE_STRING NtdllName;
                    KAPC_STATE kApc;

                    KeStackAttachProcess(Process, &kApc);
                    RtlInitUnicodeString(&NtdllName, L"ntdll.dll");
                    pNtDllBase64 = BBGetUserModule(Process, &NtdllName, FALSE);
                    if (pNtDllBase64)
                    {
                        pfnLdrLoadDll64 = BBGetModuleExport(pNtDllBase64, "LdrLoadDll");
                    }
                    KeUnstackDetachProcess(&kApc);
                }

                if (pfnLdrLoadDll64)
                {
                    PINJECT_BUFFER pBuffer = GetThreadInjectCode64(ProcessHandle, pNtDllBase64, pfnLdrLoadDll64, pDllPath);
                    if (pBuffer)
                    {
                        HANDLE hThread = NULL;
                        OBJECT_ATTRIBUTES ob = { 0 };

                        InitializeObjectAttributes(&ob, NULL, OBJ_KERNEL_HANDLE, NULL, NULL);

                        status = ZwCreateThreadEx(
                            &hThread, THREAD_ALL_ACCESS, &ob,
                            ProcessHandle, pBuffer, NULL,
                            THREAD_CREATE_FLAGS_SKIP_THREAD_ATTACH | THREAD_CREATE_FLAGS_HIDE_FROM_DEBUGGER,
                            0, 0x1000, 0x100000, NULL);

                        if (hThread)
                            ZwClose(hThread);
                    }                    
                }
                ZwClose(ProcessHandle);
            }            
        }
        ObDereferenceObject(Process);
    }

    return status;
}

hzqst 开启之后内核的所有可执行内存必须经过数字签名验证，无法动态分配可执行内存。需要分配不可执行内存请用NonPagedPoolNx