伪造句柄方法结束进程.pdfVIP

伪造句柄方法结束进程 学习各种高级外挂制作技术，马上去百度有哪些信誉好的足球投注网站 魔鬼作坊，点击第一个站进入， 快速成为做挂达人。 TerminateProcess函数分析: TerminateProcess NtTerminateProcess PspTerminateThreadByPointer(ObReferenceObjectByHandle, PsGetNextProcessThread(loop)) -Self:PspExitThread -Other:KeInsertQueueApc,KiInsertQueueApc /* *@implemented */ NTSTATUS NTAPI NtTerminateProcess(INHANDLE ProcessHandle OPTIONAL, INNTSTATUS ExitStatus) { NTSTATUSStatus; PEPROCESS Process,CurrentProcess= PsGetCurrentProcess(); PETHREAD Thread,CurrentThread =PsGetCurrentThread(); BOOLEAN KillByHandle; PAGED_CODE(); PSTRACE(PS_KILL_DEBUG, ProcessHandle: %pExitStatus:%p\n, ProcessHandle, ExitStatus); /*Were we passeda processhandle? */ if (ProcessHandle) { /*Yeswe were,useit */ KillByHandle =TRUE; } else { /*Wewerent...weassume this is suicide */ KillByHandle =FALSE; ProcessHandle =NtCurrentProcess(); } /*Get the ProcessObject*/ Status=ObReferenceObjectByHandle(ProcessHandle, PROCESS_TERMINATE, PsProcessType, KeGetPreviousMode(), (PVOID*)Process, NULL); if (!NT_SUCCESS(Status))return(Status); /*Check if thisis a CriticalProcess,and Bugcheck*/ if (Process-BreakOnTermination) { /*Break to debugger*/ PspCatchCriticalBreak(Terminating critical process0x%p(%s)\n, Process, Process-ImageFileName); } /*Lock theProcess*/ if (!ExAcquireRundownProtection(Process-RundownProtect)) { /*Failed tolock,fal */ ObDereferenceObject(Process); returnSTATUS_PROCESS_IS_TERMINATING; } /*Set thedelete flag, unl