#include <windows.h>
#include <stdio.h>
#include <tlhelp32.h>
#include <string.h>
#define CLASS_NAME "KillProcessClass"
#define ID_EDIT 1001 // 输入框ID
#define ID_BUTTON 1002 // 按钮ID
#define ID_INPUT_TIP 1003 // 顶部输入提示ID
#define ID_RESULT_BOX 1004 // 下方结果显示框ID
#define MAX_PROCESSES 100
#define MAX_RESULT_TEXT 2048 // 结果文本最大长度
// 函数声明
LRESULT CALLBACK WindowProc(HWND hwnd, UINT uMsg, WPARAM wParam, LPARAM lParam);
BOOL WildcardMatch(const char* pattern, const char* str);
int GetMatchingProcessIDs(const char* pattern, DWORD* pids);
BOOL ExecuteCommand(const char* cmd);
void KillMatchingProcesses(HWND hwnd);
void CreateCustomFont();
void CreateBgBrush();
// 全局变量
HFONT hFont = NULL;
HBRUSH hBgBrush;
// 通配符匹配函数
BOOL WildcardMatch(const char* pattern, const char* str) {
while (*pattern && *str) {
if (*pattern == '*') {
if (*(pattern + 1) == '\0') return TRUE;
while (*str) {
if (WildcardMatch(pattern + 1, str++)) return TRUE;
}
return FALSE;
} else if (*pattern == '?' || *pattern == *str) {
pattern++;
str++;
} else {
return FALSE;
}
}
while (*pattern == '*') pattern++;
return (*pattern == '\0' && *str == '\0');
}
// 获取匹配的进程ID
int GetMatchingProcessIDs(const char* pattern, DWORD* pids) {
PROCESSENTRY32 pe32;
pe32.dwSize = sizeof(PROCESSENTRY32);
int count = 0;
HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if (hSnapshot == INVALID_HANDLE_VALUE) return 0;
if (Process32First(hSnapshot, &pe32)) {
do {
if (WildcardMatch(pattern, pe32.szExeFile)) {
if (count < MAX_PROCESSES) {
pids[count++] = pe32.th32ProcessID;
}
}
} while (Process32Next(hSnapshot, &pe32) && count < MAX_PROCESSES);
}
CloseHandle(hSnapshot);
return count;
}
// 执行命令
BOOL ExecuteCommand(const char* cmd) {
STARTUPINFO si = {sizeof(si)};
si.dwFlags = STARTF_USESHOWWINDOW;
si.wShowWindow = SW_HIDE;
PROCESS_INFORMATION pi;
BOOL success = CreateProcess(NULL, (char*)cmd, NULL, NULL, FALSE, 0, NULL, NULL, &si, &pi);
if (success) {
WaitForSingleObject(pi.hProcess, INFINITE);
CloseHandle(pi.hProcess);
CloseHandle(pi.hThread);
}
return success;
}
// 终止匹配进程（结果显示在专用框中）
void KillMatchingProcesses(HWND hwnd) {
// 获取结果显示框句柄
HWND hResultBox = GetDlgItem(hwnd, ID_RESULT_BOX);
char pattern[256] = {0};
GetWindowText(GetDlgItem(hwnd, ID_EDIT), pattern, sizeof(pattern)-1);
// 清空之前的结果
SetWindowText(hResultBox, "");
// 检查输入为空
if (pattern[0] == '\0') {
SetWindowText(hResultBox, "提示：请输入进程名（支持通配符*和?，如QQ*.exe）");
return;
}
// 查找匹配进程
DWORD pids[MAX_PROCESSES] = {0};
int pidCount = GetMatchingProcessIDs(pattern, pids);
if (pidCount == 0) {
char info[256];
sprintf(info, "未找到匹配进程：%s", pattern);
SetWindowText(hResultBox, info);
return;
}
// 批量终止进程并记录结果
int successCount = 0;
char result[MAX_RESULT_TEXT] = "处理结果：\r\n";
char temp[128];
for (int i = 0; i < pidCount; i++) {
// 尝试tskill
char cmdTskill[256];
sprintf(cmdTskill, "tskill %d", pids[i]);
if (ExecuteCommand(cmdTskill)) {
successCount++;
sprintf(temp, "成功终止 PID：%d\r\n", pids[i]);
} else {
// 尝试强制终止
char cmdTaskkill[256];
sprintf(cmdTaskkill, "taskkill /F /PID %d", pids[i]);
if (ExecuteCommand(cmdTaskkill)) {
successCount++;
sprintf(temp, "强制终止 PID：%d\r\n", pids[i]);
} else {
sprintf(temp, "终止失败 PID：%d\r\n", pids[i]);
}
}
// 防止结果文本过长
if (strlen(result) + strlen(temp) < MAX_RESULT_TEXT - 1) {
strcat(result, temp);
}
}
// 显示最终统计
char finalInfo[MAX_RESULT_TEXT];
sprintf(finalInfo, "共找到 %d 个进程，成功终止 %d 个\r\n%s",
pidCount, successCount, result);
SetWindowText(hResultBox, finalInfo);
}
// 创建字体
void CreateCustomFont() {
hFont = CreateFont(
-13, 0, 0, 0, FW_REGULAR,
FALSE, FALSE, FALSE, ANSI_CHARSET,
OUT_DEFAULT_PRECIS, CLIP_DEFAULT_PRECIS,
DEFAULT_QUALITY, DEFAULT_PITCH | FF_DONTCARE,
"SimSun"
);
if (!hFont) hFont = (HFONT)GetStockObject(DEFAULT_GUI_FONT);
}
// 创建背景画刷
void CreateBgBrush() {
hBgBrush = CreateSolidBrush(RGB(135, 206, 250));
}
// 主函数
int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow) {
CreateCustomFont();
CreateBgBrush();
WNDCLASS wc = {0};
wc.lpfnWndProc = WindowProc;
wc.hInstance = hInstance;
wc.lpszClassName = CLASS_NAME;
wc.hbrBackground = hBgBrush;
if (!RegisterClass(&wc)) {
MessageBox(NULL, "窗口类注册失败", "错误", MB_ICONERROR);
return 0;
}
// 窗口尺寸和居中
int width = 500, height = 330;
int x = (GetSystemMetrics(SM_CXSCREEN) - width) / 2;
int y = (GetSystemMetrics(SM_CYSCREEN) - height) / 2;
HWND hwnd = CreateWindowEx(
0, CLASS_NAME, "进程杀手（支持通配符）",
WS_OVERLAPPEDWINDOW & ~WS_THICKFRAME & ~WS_MAXIMIZEBOX,
x, y, width, height, NULL, NULL, hInstance, NULL
);
if (!hwnd) {
MessageBox(NULL, "窗口创建失败", "错误", MB_ICONERROR);
return 0;
}
ShowWindow(hwnd, nCmdShow);
UpdateWindow(hwnd);
MSG msg;
while (GetMessage(&msg, NULL, 0, 0)) {
TranslateMessage(&msg);
DispatchMessage(&msg);
}
// 释放资源
if (hFont && hFont != (HFONT)GetStockObject(DEFAULT_GUI_FONT)) DeleteObject(hFont);
DeleteObject(hBgBrush);
return 0;
}
// 窗口过程（分离输入提示和结果显示）
LRESULT CALLBACK WindowProc(HWND hwnd, UINT uMsg, WPARAM wParam, LPARAM lParam) {
switch (uMsg) {
case WM_CREATE: {
// 1. 顶部输入提示（固定文本，不变化）
HWND hInputTip = CreateWindow("STATIC", "请输入进程名（支持通配符*和?，如QQ*.exe）",
WS_VISIBLE | WS_CHILD | SS_LEFT,
20, 20, 450, 20, // 位置靠上
hwnd, (HMENU)ID_INPUT_TIP, ((LPCREATESTRUCT)lParam)->hInstance, NULL);
SendMessage(hInputTip, WM_SETFONT, (WPARAM)hFont, TRUE);
// 2. 输入框
HWND hEdit = CreateWindow("EDIT", "",
WS_VISIBLE | WS_CHILD | WS_BORDER | ES_AUTOHSCROLL,
20, 50, 450, 25,
hwnd, (HMENU)ID_EDIT, ((LPCREATESTRUCT)lParam)->hInstance, NULL);
SendMessage(hEdit, WM_SETFONT, (WPARAM)hFont, TRUE);
// 3. 按钮
HWND hButton = CreateWindow("BUTTON", "终止匹配进程",
WS_VISIBLE | WS_CHILD | BS_PUSHBUTTON,
20, 90, 450, 30,
hwnd, (HMENU)ID_BUTTON, ((LPCREATESTRUCT)lParam)->hInstance, NULL);
SendMessage(hButton, WM_SETFONT, (WPARAM)hFont, TRUE);
// 4. 下方结果显示框（专用区域，带边框）
HWND hResultBox = CreateWindow("STATIC", "结果将显示在这里...",
WS_VISIBLE | WS_CHILD | SS_LEFT | SS_WORDELLIPSIS | WS_BORDER,
20, 140, 450, 150, // 位置靠下，加大高度
hwnd, (HMENU)ID_RESULT_BOX, ((LPCREATESTRUCT)lParam)->hInstance, NULL);
SendMessage(hResultBox, WM_SETFONT, (WPARAM)hFont, TRUE);
break;
}
// 统一设置静态文本背景色
case WM_CTLCOLORSTATIC: {
HDC hdcStatic = (HDC)wParam;
SetTextColor(hdcStatic, RGB(0, 0, 0)); // 文本黑色
SetBkColor(hdcStatic, RGB(135, 206, 250)); // 背景天蓝色
return (LRESULT)hBgBrush;
}
// 按钮点击事件
case WM_COMMAND:
if (LOWORD(wParam) == ID_BUTTON && HIWORD(wParam) == BN_CLICKED) {
KillMatchingProcesses(hwnd); // 结果会显示在专用框中
}
break;
case WM_DESTROY:
PostQuitMessage(0);
break;
default:
return DefWindowProc(hwnd, uMsg, wParam, lParam);
}
return 0;
}
[培训]Windows内核深度攻防：从Hook技术到Rootkit实战！
最后于 2025-9-27 20:29
被TkBinary编辑
，原因： 排版
