1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
| #include <ntddk.h>
BOOLEAN FLAG = TRUE;
HANDLE hThread;
BOOLEAN FindPidTable(ULONG Process, char* name)
{
int i;
ULONG ObjectTable = *(PULONG)(Process + 0xc4);
ULONG TableCode = *(PULONG)(ObjectTable + 0x0);
char white[] = "csrss.exe";
char white2[] = "explorer.exe";
if (!strncmp(white, (char*)(Process + 0x174), strlen(white)))
{
return 0;
}
if (!strncmp(white2, (char*)(Process + 0x174), strlen(white2)))
{
return 0;
}
for (i = 0; i < 512; i++)
{
ULONG value = *(PULONG)(TableCode + i * 8);
if (value < 0x80000000) continue;
ULONG Pro = (value & 0xfffffffc) + 0x18;
if (!strncmp(name,(char*)(Pro + 0x174), strlen(name)))
{
return 1;
}
}
return 0;
}
BOOLEAN CloseProcess(ULONG Process)
{
ULONG PspCidTable;
_asm
{
mov eax, fs: [0x34]
mov eax, [eax + 0x80]
mov eax, [eax]
mov eax, [eax]
mov PspCidTable, eax
}
DbgPrint("PspCidTable : %x\n", PspCidTable);
ULONG PID = 0;
for (int i = 0; i < 0x800; i += 4)
{
ULONG value = *(PULONG)(PspCidTable + i * 2);
if (value < 0x80000000) continue;
ULONG Pro = (value & 0xfffffffc);
if (!strncmp((char*)(Process + 0x174), (char*)(Pro + 0x174), strlen((char*)(Process + 0x174))))
{
DbgPrint("PID: %d\n", i);
DbgPrint("Find Process: %s\n", (char*)(Pro + 0x174));
PID = i;
break;
}
}
if (PID == 0)
{
DbgPrint("未找到对应进程 ....错误\n");
return FALSE;
}
HANDLE handle = NULL;
CLIENT_ID client_id;
client_id.UniqueProcess = (HANDLE)PID;
client_id.UniqueThread = (HANDLE)0;
OBJECT_ATTRIBUTES attr = { sizeof(OBJECT_ATTRIBUTES), 0, NULL, NULL };
attr.Attributes = 0;
NTSTATUS ret = NtOpenProcess(&handle, PROCESS_ALL_ACCESS, &attr, &client_id);
if (!NT_SUCCESS(ret))
{
DbgPrint("NtOpenProcess 打开进程失败\n");
return FALSE;
}
ZwTerminateProcess(handle, 0);
ZwClose(handle);
return TRUE;
}
VOID FindAllProcess(char* name)
{
ULONG curProcess;
__asm
{
mov eax, dword ptr fs : [0x124] ;
mov ecx, [eax + 0x44];
mov curProcess, ecx;
}
PLIST_ENTRY plistProcess = (PLIST_ENTRY)(curProcess + 0x88);
while (plistProcess->Flink != (PLIST_ENTRY)(curProcess + 0x88))
{
ULONG nextProcess = ((ULONG)(plistProcess)) - 0x88;
plistProcess = plistProcess->Flink;
if (FindPidTable(nextProcess, name))
{
DbgPrint("进程[%s]打开了[%s]的句柄\n", (char*)(nextProcess + 0x174), name);
DbgPrint("正在结束该进程...\n");
if (CloseProcess(nextProcess))
{
DbgPrint("进程已被结束...\n");
}
else
{
DbgPrint("关闭进程失败\n");
}
}
}
}
VOID ThreadFunc(PVOID StartContext)
{
DbgPrint("Create Thread Success\n");
LARGE_INTEGER timer = { 0 };
timer.QuadPart = - 10 * 1000 * 1000;
while (FLAG)
{
KeDelayExecutionThread(KernelMode, FALSE, &timer);
FindAllProcess("test.exe");
}
DbgPrint("Thread End End End\n");
ZwClose(hThread);
}
VOID DriverUnload(PDRIVER_OBJECT driver)
{
DbgPrint("卸载了\n");
FLAG = FALSE;
LARGE_INTEGER timer = { 0 };
timer.QuadPart = -30 * 1000 * 1000;
KeDelayExecutionThread(KernelMode, FALSE, &timer);
}
NTSTATUS DriverEntry(PDRIVER_OBJECT driver, PUNICODE_STRING reg_path)
{
driver->DriverUnload = DriverUnload;
DbgPrint("加载了\n");
PsCreateSystemThread(&hThread, 0, NULL, NULL, NULL, ThreadFunc, NULL);
return STATUS_SUCCESS;
}
|
