NTSTATUS ForceTerminateProcess(IN HANDLE Processid)
{
NTSTATUS status;
HANDLE hProcess;
PEPROCESS MyProcess;
PEPROCESS TargetProcess;
MyProcess = PsGetCurrentProcess();//先取得自身的eprocess
status = PsLookupProcessByProcessId(Processid,&TargetProcess);
if(!NT_SUCCESS(status))
{
KdPrint(("PsLookupProcessByProcessId 失败 pid[%d] error 0x%08X\r\n",Processid,status));
return status;
}
//先打开自身
status = ObOpenObjectByPointer(
MyProcess,
0,
NULL,
PROCESS_ALL_ACCESS,
* PsProcessType,
KernelMode,
&hProcess
);
if(!NT_SUCCESS(status))
{
ObDereferenceObject (MyProcess);
KdPrint(("ObOpenObjectByPointer 失败 error 0x%08X\r\n",status));
return status;
}
//接下来，修改在自身进程中找出hProcess的HandleTable,修改其Object指针为目标进程指针
//改掉句柄里指向的Object
ModifyHandleObject(MyProcess, TargetProcess, hProcess);
//然后，结束吧
status = ZwTerminateProcess(hProcess,0);
if(!NT_SUCCESS(status))
{
KdPrint(("ZwTerminateProcess 失败 error 0x%08X\r\n",status));
}
//结束完，把句柄恢复回去
ModifyHandleObject(MyProcess, MyProcess, hProcess);
NtClose(hProcess);
return status;
}

[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)