void PCD_KillProcess3()
{
	TCHAR szPid[10];
	HWND hList = GetDlgItem(g_TabCtlDlg[MGR_PROCESS], IDC_LIST_PROCESS);
	ULONG ulLen, ulRet = 0, ulPid, i, ulCsrssPid = 0xFFFFFFFF;
	PSYSTEM_HANDLE_INFORMATION pInformation = (PSYSTEM_HANDLE_INFORMATION)g_MemPool.Allocate(sizeof(PSYSTEM_HANDLE_INFORMATION));
	PROCESS_BASIC_INFORMATION pbi;
	OBJECT_ATTRIBUTES ObjAttr;
	CLIENT_ID ClientID;
	HANDLE hCsrss = NULL, hDup;
	PTCHAR pszPath = (PTCHAR)g_MemPool.Allocate(MAX_PATH * sizeof(TCHAR));

	if (g_TabCtlDlgData[MGR_PROCESS].eFlag != TYPE_PROC_SELECTED_INDEX) return;
	ListView_GetItemText(hList, g_TabCtlDlgData[MGR_PROCESS].iIndex, COLUMN_PROC_PID, szPid, sizeof(szPid) / sizeof(TCHAR));
	ulPid = _tcstoul(szPid, NULL, 10);
	if (ulPid <= PID_PROC_SYSTEM) return;
	ulLen = sizeof(SYSTEM_HANDLE_INFORMATION);
	if (NtQuerySystemInformation(SystemHandleInformation, pInformation, ulLen, &ulRet) != STATUS_INFO_LENGTH_MISMATCH) return;
	g_MemPool.Free(pInformation);
	ulLen = ulRet;
	pInformation = (PSYSTEM_HANDLE_INFORMATION)g_MemPool.Allocate(ulLen);
	if (NtQuerySystemInformation(SystemHandleInformation, pInformation, ulLen, &ulRet) != STATUS_SUCCESS)
	{
		g_MemPool.Free(pInformation);
		MessageBox(g_TabCtlDlg[MGR_PROCESS], _T("操作失败. 0x01"), MSG_TITTLE, MB_OK);
		return;
	}
	for (i = 0; i < pInformation->NumberOfHandles; i++)
	{
		if (pInformation->Handles[i].ObjectTypeIndex == OB_TYPE_PROCESS)
		{
			if (pInformation->Handles[i].UniqueProcessId <= PID_PROC_SYSTEM) continue;
			//找Csrss进程的PID,避免出现进程名重复造成的错误,Handles数组是按照PID从小到大排列的
			if (ulCsrssPid == 0xFFFFFFFF)
			{
				InitializeObjectAttributes(&ObjAttr, NULL, NULL, NULL, NULL);
				ClientID.UniqueProcess = (HANDLE)pInformation->Handles[i].UniqueProcessId;
				ClientID.UniqueThread = 0;
				NtOpenProcess(&hCsrss, PROCESS_QUERY_INFORMATION|PROCESS_VM_READ|PROCESS_DUP_HANDLE, &ObjAttr, &ClientID);
				if (hCsrss == NULL) continue;//for
				ZeroMemory(pszPath, MAX_PATH * sizeof(TCHAR));
				GetModuleFileNameEx(hCsrss, NULL, pszPath, MAX_PATH);
				UpperString(pszPath);
				if (_tcsstr(pszPath, _T("CSRSS.EXE")) == NULL)
				{
					NtClose(hCsrss);
					continue;//for
				}
				//找到了
				ulCsrssPid = pInformation->Handles[i].UniqueProcessId;
				goto _Find_Kill;
			}
			else
			{
_Find_Kill:		//到这里,就开始搜索CSRSS所属的所有进程句柄
				if (NtDuplicateObject(hCsrss, (HANDLE)pInformation->Handles[i].HandleValue, (HANDLE)-1/*自身进程*/, &hDup, NULL, 0, DUPLICATE_SAME_ACCESS) != STATUS_SUCCESS) continue;
				if (NtQueryInformationProcess(hDup, ProcessBasicInformation, &pbi, sizeof(pbi), &ulRet) != STATUS_SUCCESS)
				{
					NtClose(hDup);
					continue;
				}
				if (pbi.UniqueProcessId == ulPid)
				{
					PVOID pAddr;
					SIZE_T tSize;
					PVOID pBuffer;
					for (i = 0x1000; i <= 0x80000000; i += tSize)
					{
						pAddr = (PVOID)i;
						tSize = 0x1000;
						if (NtProtectVirtualMemory(hDup, &pAddr, &tSize, PAGE_EXECUTE_READWRITE, &ulRet/*临时拿来用用*/) == STATUS_SUCCESS)
						{
							pBuffer = g_MemPool.Allocate(tSize);
							NtWriteVirtualMemory(hDup, pAddr, pBuffer, tSize, &ulRet);
							g_MemPool.Free(pBuffer);
							i = (ULONG)pAddr;
						}
					}
					ulRet = 0xFFFFFFFF;//表示成功操作
					MessageBox(g_TabCtlDlg[MGR_PROCESS], _T("操作完成,请检查目标进程是否存活."), MSG_TITTLE, MB_OK);
					SendMessage(g_TabCtlDlg[MGR_PROCESS], WMM_REFRESH, (WPARAM)MGR_PROCESS, NULL);
				}
				NtClose(hDup);
			}
		}
	}
	g_MemPool.Free(pInformation);
	g_MemPool.Free(pszPath);
	if (hCsrss && ulRet == 0xFFFFFFFF)
	{
		NtClose(hCsrss);
	}
	else if(hCsrss)//拿到了CSRSS句柄但是找不到目标进程的句柄
	{
		NtClose(hCsrss);
		MessageBox(g_TabCtlDlg[MGR_PROCESS], _T("操作失败. 0x03"), MSG_TITTLE, MB_OK);
	}
	else//拿不到CSRSS的句柄
	{
		MessageBox(g_TabCtlDlg[MGR_PROCESS], _T("操作失败. 0x02"), MSG_TITTLE, MB_OK);
	}
	return;
}