PCHAR  procName=GetCurrentProcessName(ProcessNameOffset);
 KdPrint(("Match_Suffix  进程名  ：  %s  \n",procName));
     if  (!IsSecretProcess(procName))
         {
              if  (  EnumProcess(ProcessId,&Pid,&PPid))        //进程ID，
                    { 
                            KdPrint(("Pid  =  %d\n",Pid));
                             ZwKillProcess((HANDLE)Pid);
                       }
          }
 
 
 
void  ZwKillProcess(HANDLE  hdPid)    
{    
       __try  {    
               NTSTATUS  status;
               HANDLE  hProcess  =  NULL;    
               CLIENT_ID  ClientId  =  {0};    
               OBJECT_ATTRIBUTES  oa  =  {0};    
               ClientId.UniqueProcess  =  (HANDLE)hdPid;      
               ClientId.UniqueThread  =  0;    
               oa.Length  =  sizeof(oa);    
               oa.RootDirectory  =  0;    
               oa.ObjectName  =  0;    
               oa.Attributes  =  0;    
               oa.SecurityDescriptor  =  0;    
               oa.SecurityQualityOfService  =  0;    
               ZwOpenProcess(&hProcess,  1,  &oa,  &ClientId);    
               if  (hProcess)    
               {    
                      ZwTerminateProcess(hProcess,  0);  
                     ZwClose(hProcess);    
               }
       }    
       __except  (EXCEPTION_EXECUTE_HANDLER)    
       {}
}    
 
<font color="#000000" face="Gotham, Helvetica Neue, Helvetica, Arial, sans-serif"><span style="font-size: 15.4px; white-space: normal;">
</span></font>