楼上正解。发一段ring3下的zwo和zwt。
#include <windows.h>
#include <tlhelp32.h>
#include <string.h>
#include <stdio.h>
#include <stdlib.h>
typedef LONG NTSTATUS;
typedef struct _UNICODE_STRING {
USHORT Length;
USHORT MaximumLength;
PVOID Buffer;
} UNICODE_STRING, *PUNICODE_STRING;
typedef struct _CLIENT_ID {
HANDLE UniqueProcess;
HANDLE UniqueThread;
} CLIENT_ID;
typedef CLIENT_ID *PCLIENT_ID;
typedef struct _OBJECT_ATTRIBUTES {
ULONG Length;
HANDLE RootDirectory;
PUNICODE_STRING ObjectName;
ULONG Attributes;
PVOID SecurityDescriptor; // Points to type SECURITY_DESCRIPTOR
PVOID SecurityQualityOfService; // Points to type SECURITY_QUALITY_OF_SERVICE
} OBJECT_ATTRIBUTES;
typedef OBJECT_ATTRIBUTES *POBJECT_ATTRIBUTES;
typedef NTSTATUS (CALLBACK *ZwOpenProcess)(
PHANDLE ProcessHandle,
ACCESS_MASK DesiredAccess,
POBJECT_ATTRIBUTES ObjectAttributes,
PCLIENT_ID ClientId
);
typedef NTSTATUS (CALLBACK *ZwTerminateProcess)(
HANDLE ProcessHandle,
NTSTATUS ExitStatus
);
DWORD GetPID(char* exe) {
DWORD pid = -1;
// Get the process list snapshot.
HANDLE hProcessSnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPALL, 0 );
// Initialize the process entry structure.
PROCESSENTRY32 ProcessEntry = { 0 };
ProcessEntry.dwSize = sizeof( ProcessEntry );
// Get the first process info.
BOOL Return = FALSE;
Return = Process32First( hProcessSnapShot, &ProcessEntry );
// Getting process info failed.
if( !Return ) {
return pid;
}
do {
if( strcmp(exe, (char*)ProcessEntry.szExeFile) == 0 ) {
pid = ProcessEntry.th32ProcessID;
break;
}
} while( Process32Next( hProcessSnapShot, &ProcessEntry ));
// Close the handle
CloseHandle( hProcessSnapShot );
return pid;
}
int main(int argc, char* argv[])
{
DWORD pid = GetPID("QQ.exe");
printf("pid: %d\n", pid);
ZwOpenProcess zop = (ZwOpenProcess)GetProcAddress( GetModuleHandle("ntdll.dll"), "ZwOpenProcess" );
printf("f open: %d\n", zop);
ZwTerminateProcess ztp = (ZwTerminateProcess)GetProcAddress( GetModuleHandle("ntdll.dll"), "ZwTerminateProcess" );
printf("f terminate: %d\n", ztp);
HANDLE hProc;
CLIENT_ID cid;
cid.UniqueProcess = (HANDLE)pid;
cid.UniqueThread = 0;
OBJECT_ATTRIBUTES attr;
attr.Length = sizeof(OBJECT_ATTRIBUTES);
attr.RootDirectory = NULL;
attr.ObjectName = NULL;
attr.Attributes = NULL;
attr.SecurityDescriptor = NULL;
attr.SecurityQualityOfService = NULL;
zop(&hProc, PROCESS_TERMINATE, &attr, &cid);
printf("handle: %d\n", hProc);
printf("open error: %d\n", GetLastError());
ztp(hProc, 0);
printf("close error: %d\n", GetLastError());
return 0;
}
