//===============================PspTerminateProcess结束进程=============================================
/*PspTerminateProcess是内核未导出函数，需要自己定位
方法有二：
1、暴力搜索内存
2、从函数调用中定位（跟定位 SSDT Shadow一个原理）*/
//1、解析Ntoskerl.exe文件定位地址

typedef struct _SYSTEM_MODULE_INFORMATION
{
	ULONG Reserved[2];
	PVOID Base;  //基址
	ULONG Size;  // 镜像大小
	ULONG Flags;
	USHORT Index;
	USHORT Unknown;
	USHORT LoadCount;
	USHORT ModuleNameOffset;
	CHAR ImageName[256];
	
}SYSTEM_MODULE_INFORMATION,*PSYSTEM_MODULE_INFORMATION;

typedef NTSTATUS (*PSPTERMINATETPROCESS)(PEPROCESS Process,NTSTATUS ExitStatus);

ULONG GetPspTerminateProcess()
{
	//利用ZwQuerySystemInformation依据SystemModuleInformation获取Ntoskerl.exe基址和镜像大小，然后特征码搜索定位
	NTSTATUS status;
	PVOID buffer;
	ULONG size;   //动态分配大小
	ULONG code1=0x8b55ff8b, code2=0xa16456ec, code3=0x00000124, code4=0x3b08758b;   //SP2
	ULONG address;
	ULONG NtoskerlBase;
	ULONG NtoskerlEndAddress;
	ULONG i;
	PSYSTEM_MODULE_INFORMATION module;
	
	ZwQuerySystemInformation(SystemModuleInformation,&size,0,&size);  //返回需要size大小
	KdPrint(("[GetPspTerminateProcess] size:0x%x\n",size));
	buffer=ExAllocatePoolWithTag(NonPagedPool,size,MEM_TAG);
	if(buffer==NULL)
	{
		KdPrint(("[GetPspTerminateProcess] malloc memory failed\n"));
		return 0;
	}
	status=ZwQuerySystemInformation(SystemModuleInformation,buffer,size,0);
	if(!NT_SUCCESS(status))
	{
		KdPrint(("[GetPspTerminateProcess] query failed\n"));
		return status;
	}
	module=(PSYSTEM_MODULE_INFORMATION)((PULONG)buffer+1);
	NtoskerlBase=(ULONG)module->Base;
	NtoskerlEndAddress=(ULONG)module->Base+(ULONG)module->Size;
    KdPrint(("[GetPspTerminateProcess] Size :0x%x\n",(ULONG)module->Size));  //打印验证
	KdPrint(("[GetPspTerminateProcess] NtoskerlBase :0x%x\n",NtoskerlBase));  //打印验证
    KdPrint(("[GetPspTerminateProcess] NtoskerlEndAddress :0x%x\n",NtoskerlEndAddress));  //打印验证
	ExFreePool(buffer);
	//搜索特征码
	for(i=NtoskerlBase;i<=NtoskerlEndAddress;i++)
	{   
		if(MmIsAddressValid((PULONG)i))
		{  //蓝屏原因：搜索到之后就应该退出,少句代码return address
			if((*(PULONG)i==code1)&&(*(PULONG)(i+4)==code2)&&(*(PULONG)(i+8)==code3)&&(*(PULONG)(i+12)==code4))
			{
				address=(ULONG)i;
				KdPrint(("[GetPspTerminateProcess] address :0x%x\n",address));  //打印地址
				return address;
			}
		}
	}
	return 0;
}

VOID KillProcessWithPsp(ULONG epro)
{
	PSPTERMINATETPROCESS MyPspTerminateProcess;
	ULONG address;
	address=GetPspTerminateProcess();
	if(MmIsAddressValid((PULONG)address))
	{
		MyPspTerminateProcess =(PSPTERMINATETPROCESS)address;  //定位PspTerminateProcess
		MyPspTerminateProcess((PEPROCESS)epro,0);              //杀进程
	}
	else
		return;
	
}

[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)