KillProcess.zip

#include <Windows.h> #include <Ntsecapi.h> #include <aclapi.h rel='nofollow' onclick='return false;'> #include <tlhelp32.h> #pragma comment (lib,"ntdll.lib") // Copy From DDK #pragma comment (lib,"Kernel32.lib") #pragma comment (lib,"Advapi32.lib") #pragma comment(linker, "/ENTRY:main") #ifndef ULONG_PTR #define ULONG_PTR unsigned long #endif //------------------ 数据类型声明开始 --------------------// typedef struct _PROCESS_BASIC_INFORMATION { NTSTATUS ExitStatus; ULONG PebBaseAddress; ULONG_PTR AffinityMask; LONG BasePriority; ULONG_PTR UniqueProcessId; ULONG_PTR InheritedFromUniqueProcessId; } PROCESS_BASIC_INFORMATION; typedef PROCESS_BASIC_INFORMATION *PPROCESS_BASIC_INFORMATION; typedef struct _SYSTEM_HANDLE_INFORMATION { ULONG ProcessId; UCHAR ObjectTypeNumber; UCHAR Flags; USHORT Handle; PVOID Object; ACCESS_MASK GrantedAccess; } SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION; typedef struct _SYSTEM_MODULE_INFORMATION { ULONG Reserved[2]; PVOID Base; ULONG Size; ULONG Flags; USHORT Index; USHORT Unknown; USHORT LoadCount; USHORT ModuleNameOffset; CHAR ImageName[256]; } SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION; typedef struct _OBJECT_ATTRIBUTES { ULONG Length; HANDLE RootDirectory; PUNICODE_STRING ObjectName; ULONG Attributes; PVOID SecurityDescriptor; PVOID SecurityQualityOfService; } OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES; typedef enum _SECTION_INHERIT { ViewShare = 1, ViewUnmap = 2 } SECTION_INHERIT; typedef struct _MY_PROCESS_INFO { ULONG PID; ULONG KPEB; ULONG CR3; CHAR Name[16]; ULONG Reserved; } MY_PROCESS_INFO, *PMY_PROCESS_INFO; typedef struct _CLIENT_ID { HANDLE UniqueProcess; HANDLE UniqueThread; } CLIENT_ID; typedef CLIENT_ID *PCLIENT_ID; typedef long NTSTATUS; //------------------ 数据类型声明结束 --------------------// //--------------------- 预定义开始 -----------------------// #define NT_SUCCESS(Status) ((NTSTATUS)(Status) >= 0) #define STATUS_SUCCESS 0x00000000 #define STATUS_UNSUCCESSFUL 0xC0000001 #define STATUS_NOT_IMPLEMENTED 0xC0000002 #define STATUS_INFO_LENGTH_MISMATCH 0xC0000004 #define STATUS_INVALID_PARAMETER 0xC000000D #define STATUS_ACCESS_DENIED 0xC0000022 #define STATUS_BUFFER_TOO_SMALL 0xC0000023 #define OBJ_KERNEL_HANDLE 0x00000200 #define SystemModuleInformation 11 #define SystemHandleInformation 0x10 #define InitializeObjectAttributes( p, n, a, r, s ) { (p)->Length = sizeof( OBJECT_ATTRIBUTES );(p)->RootDirectory = r; (p)->Attributes = a; (p)->ObjectName = n; (p)->SecurityDescriptor = s; (p)->SecurityQualityOfService = NULL; } //--------------------- 预定义结束 -----------------------// //------------------ Native API声明开始 ------------------// /* NTSYSAPI NTSTATUS NTAPI ZwQuerySystemInformation( ULONG SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength ); */ typedef NTSTATUS (NTAPI* PNtZwQuerySystemInformation) (ULONG, PVOID, ULONG, PULONG); PNtZwQuerySystemInformation ZwQuerySystemInformation; /* NTSYSAPI NTSTATUS NTAPI ZwOpenProcess( OUT PHANDLE ProcessHandle, IN ACCESS_MASK AccessMask, IN POBJECT_ATTRIBUTES ObjectAttributes, IN PCLIENT_ID ClientId ); */ typedef NTSTATUS (NTAPI* PNtZwOpenProcess) (OUT PHANDLE, IN ACCESS_MASK, IN POBJECT_ATTRIBUTES, IN PCLIENT_ID); PNtZwOpenProcess ZwOpenProcess; /* NTSYSAPI NTSTATUS NTAPI ZwAllocateVirtualMemory( IN HANDLE ProcessHandle, IN OUT PVOID *BaseAddress, IN ULONG ZeroBits, IN OUT PULONG RegionSize, IN ULONG AllocationType, IN ULONG Protect ); */ typedef NTSTATUS (NTAPI* PNtZwAllocateVirtualMemory) (IN HANDLE, IN OUT PVOID, IN ULONG, IN OUT PULONG, IN ULONG, IN ULONG); PNtZwAllocateVirtualMemory ZwAllocateVirtualMemory; /* NTSYSAPI NTSTATUS NTAPI ZwDuplicateObject( IN HANDLE SourceProcessHandle, IN PHANDLE SourceHandle, IN HANDLE TargetProcessHandle, OUT PHANDLE TargetHandle, IN ACCESS_MASK DesiredAccess OPTIONAL, IN BOOLEAN InheritHandle, IN ULONG Options );*/ typedef NTSTATUS (NTAPI* PNtZwDuplicateObject) ( IN HANDLE, IN PHANDLE, IN HANDLE, OUT PHANDLE, IN ACCESS_MASK, IN BOOLEAN, IN ULONG); PNtZwDuplicateObject ZwDuplicateObject; /* NTSYSAPI NTSTATUS NTAPI ZwQueryInformationProcess( IN HANDLE ProcessHandle, IN PVOID ProcessInformationClass, OUT PVOID ProcessInformation, IN ULONG ProcessInformationLength, OUT PULONG ReturnLength );*/ typedef NTSTATUS(NTAPI* PNtZwQueryInformationProcess)(IN HANDLE, IN PVOID, OUT PVOID, IN ULONG, OUT PULONG ); PNtZwQueryInformationProcess ZwQueryInformationProcess; /* NTSYSAPI NTSTATUS NTAPI ZwProtectVirtualMemory( IN HANDLE ProcessHandle, IN OUT PVOID *BaseAddress, IN OUT PULONG NumberOfBytesToProtect, IN ULONG NewAccessProtection, OUT PULONG OldAccessProtection );*/ typedef NTSTATUS (NTAPI* PNtZwProtectVirtualMemory) (IN HANDLE, IN OUT PVOID, IN OUT PULONG, IN ULONG , OUT PULONG); PNtZwProtectVirtualMemory ZwProtectVirtualMemory; /* NTSYSAPI NTSTATUS NTAPI ZwWriteVirtualMemory( IN HANDLE ProcessHandle, IN PVOID BaseAddress, IN PVOID Buffer, IN ULONG NumberOfBytesToWrite, OUT PULONG NumberOfBytesWritten OPTIONAL ); */ typedef NTSTATUS (NTAPI *PNtZwWriteVirtualMemory) ( IN HANDLE, IN PVOID, IN PVOID, IN ULONG, OUT PULONG ); PNtZwWriteVirtualMemory ZwWriteVirtualMemory; /* NTSYSAPI NTSTATUS NTAPI ZwClose( IN HANDLE ObjectHandle ); */ typedef NTSTATUS (NTAPI *PNtZwClose) ( IN HANDLE ); PNtZwClose ZwClose; /* NTSYSAPI NTSTATUS NTAPI ZwFreeVirtualMemory( IN HANDLE ProcessHandle, IN PVOID *BaseAddress, IN OUT PULONG RegionSize, IN ULONG FreeType ); */ typedef NTSTATUS (NTAPI *PNtZwFreeVirtualMemory)( IN HANDLE, IN PVOID, IN OUT PULONG, IN ULONG ); PNtZwFreeVirtualMemory ZwFreeVirtualMemory; //------------------ Native API声明结束 ------------------// //------------------ 程序正式开始 ------------------// DWORD GetPidByName(char *szName) { HANDLE hProcessSnap = INVALID_HANDLE_VALUE; PROCESSENTRY32 pe32={0}; DWORD dwRet=0; hProcessSnap =CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); if(hProcessSnap == INVALID_HANDLE_VALUE) return 0; pe32.dwSize = sizeof(PROCESSENTRY32); if(Process32First(hProcessSnap, &pe32)) { do { if(lstrcmpi(szName,pe32.szExeFile)==0) { dwRet=pe32.th32ProcessID; break; } } while (Process32Next(hProcessSnap,&pe32)); } else return 0; if(hProcessSnap !=INVALID_HANDLE_VALUE) CloseHandle(hProcessSnap); return dwRet; } void KillIce(ULONG dwProcessId) { HMODULE hNTDLL = LoadLibrary ("ntdll"); HANDLE ph, h_dup; ULONG bytesIO; PVOID buf; ULONG i; CLIENT_ID cid1; OBJECT_ATTRIBUTES attr; HANDLE csrss_id; PROCESS_BASIC_INFORMATION pbi; PVOID p0, p1; ULONG sz, oldp; ULONG NumOfHandle; PSYSTEM_HANDLE_INFORMATION h_info; HMODULE hNtDll = ::GetModuleHandle( "ntdll.dll" ); if( hNtDll == NULL ) return ; // 函数 ++ // ZwQuerySystemInformation ZwQuerySystemInformatio