|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 |
/* 在Ring0中结束进程 by exchen 2009-10-08 */ #include<ntddk.h> #include<wdm.h> NTSTATUS Unload(IN PDRIVER_OBJECT DriverObject) { DbgPrint("驱动已经卸载\n"); } void EndProcess() { HANDLE ProcessHandle; NTSTATUS status; OBJECT_ATTRIBUTES ObjectAttributes; CLIENT_ID myCid; ULONG dwPid = 1688; DbgPrint("进入结束进程状态\n"); InitializeObjectAttributes(&ObjectAttributes,0,0,0,0); myCid.UniqueProcess = (HANDLE)dwPid; myCid.UniqueThread = 0; status = ZwOpenProcess ( &ProcessHandle, PROCESS_ALL_ACCESS, &ObjectAttributes, &myCid ); if (!NT_SUCCESS(status)) { DbgPrint("打开进程出错\n"); } status = ZwTerminateProcess( ProcessHandle, 0 ); if(!NT_SUCCESS(status)) { DbgPrint("结束进程出错\n"); } ZwClose(ProcessHandle); DbgPrint("%x",status); } NTSTATUS DriverEntry( IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath ) { DbgPrint("驱动已经加载了\n"); EndProcess(); DriverObject->DriverUnload = Unload; return STATUS_SUCCESS; } |
转载请注明：exchen's blog » 在 Ring0 中结束进程