if (!Length) break; if (*(USHORT *)pOpcode == 0x80F6) //f6804802000010 test byte ptr [eax+248h],10h { Offset=*(USHORT *)((ULONG)pOpcode+2); return Offset; //break; } } return 0; }
VOID KernelTerminateThreadRoutine( IN PKAPC Apc, IN OUT PKNORMAL_ROUTINE *NormalRoutine, IN OUT PVOID *NormalContext, IN OUT PVOID *SystemArgument1, IN OUT PVOID *SystemArgument2 ) { ULONG ThreadFlagsOffset=GetThreadFlagsOffset(); PULONG ThreadFlags; DbgPrint("[TerminateThread] KernelTerminateThreadRoutine.\n"); ExFreePool(Apc); if (ThreadFlagsOffset) { ThreadFlags=(ULONG *)((ULONG)(PsGetCurrentThread())+ThreadFlagsOffset); *ThreadFlags=(*ThreadFlags)|PS_CROSS_THREAD_FLAGS_SYSTEM; PsTerminateSystemThread(STATUS_SUCCESS); //o(∩_∩)o } else { //failed :'( } return; //never be here }
BOOLEAN TerminateThread(PETHREAD Thread) { PKAPC Apc=NULL; BOOLEAN blnSucceed=FALSE; if (!MmIsAddressValid(Thread)) return FALSE; //error. Apc=ExAllocatePool(NonPagedPool,sizeof(KAPC)); KeInitializeApc(Apc, Thread, OriginalApcEnvironment, KernelTerminateThreadRoutine, NULL, NULL, KernelMode, NULL); //special apc blnSucceed=KeInsertQueueApc(Apc, NULL, NULL, 0); //add some code works like KeForceResumeThread here. return blnSucceed; }
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObj, PUNICODE_STRING pRegistryString) { DbgPrint("[TerminateThread] DriverEntry.\n"); TerminateThread((PETHREAD)0xff6f3c70); // for test pDriverObj->DriverUnload = DriverUnload; return STATUS_SUCCESS; //do NOT return an unsuccessful value here, or you need to wait for apc routine return. }