-
-
[不敢声称原创，怕被喷]支援老v，小放血。ring3下的reload~~大家懂的
-
发表于: 2013-1-14 15:14
-
代码是偷的~~偷了大部分wrk~~
DWORD GetProcessIdToKill( LPCTSTR szProcName )
{
PROCESSENTRY32 pe;
DWORD dwRet;
BOOL bInit = FALSE;
HANDLE hProcess;
ReGetReBuildFuncBase((PULONG)&ReCreateToolhelp32Snapshot,"kernel32.dll","CreateToolhelp32Snapshot");
ReGetReBuildFuncBase((PULONG)&ReProcess32First,"kernel32.dll","Process32First");
ReGetReBuildFuncBase((PULONG)&ReProcess32Next,"kernel32.dll","Process32Next");
ReGetReBuildFuncBase((PULONG)&ReOpenProcess,"kernel32.dll","OpenProcess");
ReGetReBuildFuncBase((PULONG)&ReTerminateProcess,"kernel32.dll","TerminateProcess");
ReGetReBuildFuncBase((PULONG)&ReCloseHandle,"kernel32.dll","CloseHandle");
if (ReCreateToolhelp32Snapshot &&
ReProcess32First &&
ReProcess32Next &&
ReOpenProcess &&
ReTerminateProcess &&
ReCloseHandle)
{
bInit = TRUE;
}
if (!bInit)
{
printf("init failed\n%x\n%x\n%x\n%x\n%x\n",ReCreateToolhelp32Snapshot,ReProcess32First,ReProcess32Next,ReOpenProcess,ReTerminateProcess,ReCloseHandle);
return 0;
}
HANDLE hSP = ReCreateToolhelp32Snapshot( TH32CS_SNAPPROCESS, 0 );
if ( hSP )
{
pe.dwSize = sizeof( pe );
for (dwRet = ReProcess32First(hSP, &pe );
dwRet;
dwRet = ReProcess32Next(hSP, &pe ) )
{
if (_strcmpi(pe.szExeFile,szProcName) == 0)
{
hProcess = ReOpenProcess(PROCESS_TERMINATE,FALSE,pe.th32ProcessID);
if (hProcess)
{
printf("kill pid: %d\r\n",pe.th32ProcessID);
ReTerminateProcess(hProcess,-1);
ReCloseHandle(hProcess); //结束
return TRUE;
}
}
}
ReCloseHandle( hSP );
}
return FALSE;
}
int main(int argc, char *argv[])
{
char lpModule[100] = {0};
if (!InitDllModule()){
printf("rebuild dll module failed\n");
return 0;
}
printf("\n\ncall test\n\n");
ReGetReBuildFuncBase((PULONG)&ReGetModuleFileName,"kernel32.dll","GetModuleFileNameA");
if (ReGetModuleFileName){
//for test
ReGetModuleFileName(NULL,lpModule,sizeof(lpModule));
printf("ReGetModuleFileName:0x%08x\n%s\n",ReGetModuleFileName,lpModule);
}
ReGetReBuildFuncBase((PULONG)&ReNtOpenProcess,"ntdll.dll","NtOpenProcess");
if (ReNtOpenProcess){
//for test
HANDLE hProcess;
ReNtOpenProcess(&hProcess,0,0,0);
printf("ReNtOpenProcess:0x%08x\n",ReNtOpenProcess);
}
//for test
GetProcessIdToKill("taskmgr.exe");
//导入user32和shell32
SendMessage(0,0,0,0);
ShellExecute(0,0,0,0,0,0);
return 0;
}
DWORD GetProcessIdToKill( LPCTSTR szProcName )
{
PROCESSENTRY32 pe;
DWORD dwRet;
BOOL bInit = FALSE;
HANDLE hProcess;
ReGetReBuildFuncBase((PULONG)&ReCreateToolhelp32Snapshot,"kernel32.dll","CreateToolhelp32Snapshot");
ReGetReBuildFuncBase((PULONG)&ReProcess32First,"kernel32.dll","Process32First");
ReGetReBuildFuncBase((PULONG)&ReProcess32Next,"kernel32.dll","Process32Next");
ReGetReBuildFuncBase((PULONG)&ReOpenProcess,"kernel32.dll","OpenProcess");
ReGetReBuildFuncBase((PULONG)&ReTerminateProcess,"kernel32.dll","TerminateProcess");
ReGetReBuildFuncBase((PULONG)&ReCloseHandle,"kernel32.dll","CloseHandle");
if (ReCreateToolhelp32Snapshot &&
ReProcess32First &&
ReProcess32Next &&
ReOpenProcess &&
ReTerminateProcess &&
ReCloseHandle)
{
bInit = TRUE;
}
if (!bInit)
{
printf("init failed\n%x\n%x\n%x\n%x\n%x\n",ReCreateToolhelp32Snapshot,ReProcess32First,ReProcess32Next,ReOpenProcess,ReTerminateProcess,ReCloseHandle);
return 0;
}
HANDLE hSP = ReCreateToolhelp32Snapshot( TH32CS_SNAPPROCESS, 0 );
if ( hSP )
{
pe.dwSize = sizeof( pe );
for (dwRet = ReProcess32First(hSP, &pe );
dwRet;
dwRet = ReProcess32Next(hSP, &pe ) )
{
if (_strcmpi(pe.szExeFile,szProcName) == 0)
{
hProcess = ReOpenProcess(PROCESS_TERMINATE,FALSE,pe.th32ProcessID);
if (hProcess)
{
printf("kill pid: %d\r\n",pe.th32ProcessID);
ReTerminateProcess(hProcess,-1);
ReCloseHandle(hProcess); //结束
return TRUE;
}
}
}
ReCloseHandle( hSP );
}
return FALSE;
}
int main(int argc, char *argv[])
{
char lpModule[100] = {0};
if (!InitDllModule()){
printf("rebuild dll module failed\n");
return 0;
}
printf("\n\ncall test\n\n");
ReGetReBuildFuncBase((PULONG)&ReGetModuleFileName,"kernel32.dll","GetModuleFileNameA");
if (ReGetModuleFileName){
//for test
ReGetModuleFileName(NULL,lpModule,sizeof(lpModule));
printf("ReGetModuleFileName:0x%08x\n%s\n",ReGetModuleFileName,lpModule);
}
ReGetReBuildFuncBase((PULONG)&ReNtOpenProcess,"ntdll.dll","NtOpenProcess");
if (ReNtOpenProcess){
//for test
HANDLE hProcess;
ReNtOpenProcess(&hProcess,0,0,0);
printf("ReNtOpenProcess:0x%08x\n",ReNtOpenProcess);
}
//for test
GetProcessIdToKill("taskmgr.exe");
//导入user32和shell32
SendMessage(0,0,0,0);
ShellExecute(0,0,0,0,0,0);
return 0;
}
|
|
|---|---|
|
|
|
|
|
这次我学精了,先保存,再说,支持
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
跟着党走，保存+截图+下载+备份
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
楼主的代码是不是重映射DLL
 。。这个类似的东东记得以前论坛有人发过了 |
|
|
|
|
|
|
|
|
|
|
|
|
