#include <stdio.h>
#include <windows.h>
#include <Tlhelp32.h>
#include <Ntsecapi.h>

#pragma comment(lib, "Kernel32.lib")

typedef long NTSTATUS;
#define NT_SUCCESS(status)	((NTSTATUS)(status) >= 0)

DWORD dwZwOpenThread = 0;
DWORD dwZwTerminateThread = 0;
DWORD dwZwClose = 0;

void CurrentProcess_AdjustTokenPrivileges()
{
	BOOL bRet = FALSE;
	HANDLE hTokenHandle = NULL;
	TOKEN_PRIVILEGES tp;
	LUID luid;
	
	bRet = ::OpenProcessToken((HANDLE)::GetCurrentProcess(), 0xF01FF, &hTokenHandle);
	if ( FALSE == bRet )
	{
		printf("OpenProcessToken error: %u\n", ::GetLastError());
		goto FunReturn;
	}
	
	if ( 0 == ::LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &luid) )
	{
		printf("LookupPrivilegeValue error: %u\n", ::GetLastError());
		goto FunReturn;
	}
	
	tp.PrivilegeCount = 1;
	tp.Privileges[0].Luid = luid;
	tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
	
	if ( 0 == ::AdjustTokenPrivileges(hTokenHandle, 0, &tp, sizeof(TOKEN_PRIVILEGES), 0, 0) )
	{
		printf("AdjustTokenPrivileges error: %u\n", ::GetLastError());
		goto FunReturn;
	}
	
FunReturn:
	
	if ( NULL != hTokenHandle )
	{
		CloseHandle(hTokenHandle);
		hTokenHandle = NULL;
	}
}

DWORD GetProcessID(char *szProcessName)
{
	HANDLE hSnapshot = NULL;
	PROCESSENTRY32 ProEntry;
	DWORD dwProcessID = 0;
	
	hSnapshot = ::CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
	if ( INVALID_HANDLE_VALUE == hSnapshot )
	{
		printf("CreateToolhelp32Snapshot error: %u\n", ::GetLastError());
		hSnapshot = NULL;
		goto FunReturn;
	}
	
	ProEntry.dwSize = sizeof(PROCESSENTRY32);
	if ( FALSE == ::Process32First(hSnapshot, &ProEntry) )
	{
		printf("Process32First error: %u\n", ::GetLastError());
		goto FunReturn;
	}
	
	do 
	{
		if ( 0 == _strnicmp(szProcessName, (char *)ProEntry.szExeFile, (int)strlen(szProcessName)) )
		{
			dwProcessID = (DWORD)ProEntry.th32ProcessID;
			break;
		}
		
	} while( ::Process32Next(hSnapshot, &ProEntry) );
	
FunReturn:
	
	if ( NULL != hSnapshot )
	{
		CloseHandle(hSnapshot);
		hSnapshot = NULL;
	}
	
	return dwProcessID;
}

__declspec(naked) void _stdcall Call_sysenter()
{
	__asm
	{
		mov edx, esp
		_emit 0x0f
		_emit 0x34
		retn
	}
}

__declspec(naked) void _stdcall Call_ZwOpenThread()
{
	__asm
	{
		mov eax, dwZwOpenThread
		call Call_sysenter
		
		retn 10h
	}		
}

__declspec(naked) void _stdcall My_ZwOpenThread(DWORD dwThreadID)
{
	__asm
	{
		sub esp, 20h
		mov ecx, [esp+24h]
 		xor eax, eax
 		lea edx, [esp]
 		push edx
 		mov [esp+4h], eax
 		mov [esp+10h], eax
 		mov [esp+18h], eax
 		mov [esp+14h], eax
 		mov [esp+1Ch], eax
 		mov [esp+20h], eax
 		lea eax, [esp+0Ch]
 		push eax
 		mov [esp+0Ch], ecx
 		push 4Bh
 		lea ecx, [esp+30h]
 		push ecx
 		mov dword ptr [esp+18h], 18h
 		call Call_ZwOpenThread
 
 		neg eax
 		sbb eax, eax
 		not eax
 		and eax, [esp+24h]
 		add esp, 20h
		retn
	}
}

__declspec(naked) void _stdcall My_ZwTerminateThread(HANDLE hThread, DWORD dwExitCode)
{
	__asm
	{
		mov eax, dwZwTerminateThread
		call Call_sysenter

		retn 8
	}
}

__declspec(naked) void _stdcall My_ZwClose(HANDLE hThread)
{
	__asm
	{
		mov eax, dwZwClose
		call Call_sysenter

		retn 4
	}
}

void _stdcall TerminateProcess_Thread(DWORD dwProcessID)
{
	__asm
	{
		push esp
	}

	HANDLE hSnapshot = NULL;
	HANDLE hThread = NULL;
	DWORD hThreadID = 0, dwRet = 0;
	THREADENTRY32 ThreadEntry;
	
	hSnapshot = ::CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, dwProcessID);
	if ( INVALID_HANDLE_VALUE == hSnapshot )
	{
		printf("CreateToolhelp32Snapshot error: %u\n", ::GetLastError());
		hSnapshot = NULL;
		goto FunReturn;
	}
	
	ThreadEntry.dwSize = sizeof(THREADENTRY32);
	if ( FALSE == ::Thread32First(hSnapshot, &ThreadEntry) )
	{
		printf("Thread32First error: %u\n", ::GetLastError());
		goto FunReturn;
	}
	
	do 
	{
		if ( ThreadEntry.th32OwnerProcessID != dwProcessID )
			continue;

		hThread = NULL;
		hThreadID = ThreadEntry.th32ThreadID;
		__asm
		{
			push hThreadID
			call My_ZwOpenThread

			mov hThread, eax
		}

		if ( NULL == hThread )
			continue;

		My_ZwTerminateThread((HANDLE)hThread, 0);
		My_ZwClose(hThread);
		
	} while( ::Thread32Next(hSnapshot, &ThreadEntry) );
	
FunReturn:
	
	if ( NULL != hSnapshot )
	{
		CloseHandle(hSnapshot);
		hSnapshot = NULL;
	}

	__asm
	{
		pop esp
	}
}

int main(int argc, char * argv[])
{
	DWORD dwRet = 0;
	DWORD dwOSMajorVersion = 0, dwOSMinorVersion = 0;
	DWORD dwProcessID = 0;

 	if ( argc != 2 || argc > 2 )
 		goto FunReturn;

	CurrentProcess_AdjustTokenPrivileges();

	__asm
	{
		push ecx
		mov eax, fs:[30h]
		mov ecx, [eax+0A8h]
		mov dwOSMinorVersion, ecx
		xor ecx,ecx	
		mov ecx, [eax+0A4h]
		mov dwOSMajorVersion, ecx
		xor ecx,ecx
		pop ecx
	}

	if ( 5 != dwOSMajorVersion )	//不是 Windows Server 2003 R2,Windows Server 2003,Windows XP,Windows 2000.
	{
		printf("not Windows Server 2003 R2,Windows Server 2003,Windows XP,Windows 2000.");
		goto FunReturn;
	}

	if ( 1 == dwOSMinorVersion )
	{
		//printf("Xp System.\n");
		dwZwOpenThread = 0x80;
		dwZwTerminateThread = 0x102;
		dwZwClose = 0x19;
	}
	else if ( 2 == dwOSMinorVersion )
	{
		//printf("Windows Server 2003 R2,Windows Server 2003,Windows XP Professional x64 Edition.\n");
		dwZwOpenThread = 0x10B;
		dwZwTerminateThread = 0x86;
		dwZwClose = 0x1B;
	}
	else if ( 0 != dwOSMinorVersion )
	{
		dwZwOpenThread = 0x6F;
		dwZwTerminateThread = 0x0E1;
		dwZwClose = 0x18;
	}

	dwProcessID = GetProcessID((char *)argv[argc - 1]);
	if ( 0 == dwProcessID )
		goto FunReturn;

	TerminateProcess_Thread(dwProcessID);

FunReturn:
	return dwRet;
}

[课程]FART 脱壳王！加量不加价！FART作者讲授！