ULONG funAddr;
                PEPROCESS pEProc;
                ULONG pTempThread;
                ULONG pid=*(PULONG)pInputBuffer;
                *(PULONG)pOutputBuffer=0;
                ULONG pNextEntry, pListHead, pThNextEntry,pThListHead; 
                if (NT_SUCCESS(PsLookupProcessByProcessId((HANDLE)pid,&pEProc)))
                {
                    funAddr=(ULONG)GetKillFunAddr(FindPspTerminateThreadByPointer);
                    if (funAddr)
                    {
                        MPspTerminateThreadByPointer=(PSPTERMINATETHREADBYPOINTER)funAddr;
                        pThListHead=(ULONG)pEProc+GetOffset(ThreadListHead_OFFSET);
                        pThNextEntry=*(PULONG)pThListHead;
                        while(pThNextEntry!=pThListHead){
                            pTempThread=pThNextEntry-GetOffset(ThreadListEntry_OFFSET);
                            if (!(*(PDWORD)(pTempThread+GetOffset(Terminated_OFFSET))&1))
                            {
                                MPspTerminateThreadByPointer((PETHREAD)pTempThread,0);
                            }
                            pThNextEntry = *(PULONG)pThNextEntry;
                        }
                        *(PULONG)pOutputBuffer=1;
                    }
                }
                sizeofWrite = OutputBuffLength;
                break;

[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！