NTSTATUS ForceTerminateProcess(IN HANDLE Processid){ NTSTATUS status; HANDLE hProcess; PEPROCESS MyProcess; PEPROCESS TargetProcess; MyProcess = PsGetCurrentProcess();//先取得自身的eprocess status = PsLookupProcessByProcessId(Processid,&TargetProcess); if(!NT_SUCCESS(status)) { KdPrint(("PsLookupProcessByProcessId 失败 pid[%d] error 0x%08X\r\n",Processid,status)); return status; } //先打开自身 status = ObOpenObjectByPointer( MyProcess, 0, NULL, PROCESS_ALL_ACCESS, * PsProcessType, KernelMode, &hProcess ); if(!NT_SUCCESS(status)) { ObDereferenceObject (MyProcess); KdPrint(("ObOpenObjectByPointer 失败 error 0x%08X\r\n",status)); return status; } //接下来,修改在自身进程中找出hProcess的HandleTable,修改其Object指针为目标进程指针 //改掉句柄里指向的Object ModifyHandleObject(MyProcess, TargetProcess, hProcess); //然后,结束吧 status = ZwTerminateProcess(hProcess,0); if(!NT_SUCCESS(status)) { KdPrint(("ZwTerminateProcess 失败 error 0x%08X\r\n",status)); } //结束完,把句柄恢复回去 ModifyHandleObject(MyProcess, MyProcess, hProcess); NtClose(hProcess); return status;}
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课