ring0强杀的软件源码

#include "ntddk.h" #include <windef.h> #include <stdlib.h> #include "MyKiller.h" #include "dbghelp.h" //=========================================== typedef struct _KAPC_STATE { LIST_ENTRY ApcListHead[2]; PVOID Process; BOOLEAN KernelApcInProgress; BOOLEAN KernelApcPending; BOOLEAN UserApcPending; }KAPC_STATE, *PKAPC_STATE; typedef enum _KAPC_ENVIRONMENT { OriginalApcEnvironment, AttachedApcEnvironment, CurrentApcEnvironment, InsertApcEnvironment }KAPC_ENVIRONMENT; NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObj, PUNICODE_STRING pRegistryString); NTSTATUS DispatchCreate(PDEVICE_OBJECT pDevObj, PIRP pIrp); NTSTATUS DispatchClose(PDEVICE_OBJECT pDevObj, PIRP pIrp); VOID DriverUnload(PDRIVER_OBJECT pDriverObj); NTSTATUS DispatchIoctl(PDEVICE_OBJECT pDevObj, PIRP pIrp); NTKERNELAPI VOID KeAttachProcess (PEPROCESS Process); NTKERNELAPI VOID KeDetachProcess (VOID); NTKERNELAPI NTSTATUS PsLookupProcessByProcessId (IN ULONG ProcessId,OUT PEPROCESS *Process); NTKERNELAPI NTSTATUS PsLookupThreadByThreadId (IN ULONG ThreadId,OUT PETHREAD *Thread); NTKERNELAPI PEPROCESS IoThreadToProcess(IN PETHREAD Thread); NTKERNELAPI BOOLEAN MmIsAddressValid(IN PVOID VirtualAddress); NTKERNELAPI NTSTATUS MmUnmapViewOfSection(IN PEPROCESS Process,IN ULONG BaseAddress); NTKERNELAPI NTSTATUS ObOpenObjectByPointer( IN PVOID Object,IN ULONG HandleAttributes,IN PACCESS_STATE PassedAccessState,IN ACCESS_MASK DesiredAccess,IN POBJECT_TYPE ObjectType,IN KPROCESSOR_MODE AccessMode,OUT HANDLE Handle ); NTKERNELAPI VOID KeStackAttachProcess(PEPROCESS PROCESS,PKAPC_STATE ApcState); NTKERNELAPI VOID KeUnstackDetachProcess(PKAPC_STATE ApcState); NTKERNELAPI NTSTATUS PsTerminateSystemThread(IN NTSTATUS ExitStatus); NTKERNELAPI VOID KeInitializeApc(PKAPC Apc,PETHREAD Thread,KAPC_ENVIRONMENT Environment,PKKERNEL_ROUTINE KernelRoutine,PKRUNDOWN_ROUTINE RundownRoutine,PKNORMAL_ROUTINE NormalRoutine,KPROCESSOR_MODE ProcessorMode,PVOID NormalContext); NTKERNELAPI BOOLEAN KeInsertQueueApc(PKAPC Apc,PVOID SystemArgument1,PVOID SystemArgument2,KPRIORITY Increment); __declspec(dllimport) NTSTATUS ZwTerminateProcess(HANDLE ProcessHandle, NTSTATUS ExitStatus); __declspec(dllimport) NTSTATUS ZwClose(HANDLE ObjectHandle); __declspec(dllimport) NTSTATUS ZwAssignProcessToJobObject(HANDLE JobHandle,HANDLE ProcessHandle); __declspec(dllimport) NTSTATUS ZwCreateJobObject(OUT PHANDLE JobHandle,IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes); __declspec(dllimport) NTSTATUS ZwTerminateJobObject(HANDLE JobHandle,NTSTATUS ExitStatus); __declspec(dllimport) NTSTATUS ZwOpenProcess(HANDLE* pProcessHandle, ULONG AccessMask, OBJECT_ATTRIBUTES* pObjectAttributes, CLIENT_ID* pClientId); //==================== PEPROCESS eProcess; PETHREAD eThread; ULONG processID; ULONG threadID; ULONG EToffSET=0x248; //default is XP HANDLE hprocess; long myHproc; HANDLE myPID; ULONG NtdllBase; //==================== VOID ApcCallBack(PKAPC Apc,PKNORMAL_ROUTINE *NormalRoutine,PVOID *NormalContext,PVOID *SystemArgument1,PVOID *SystemArgument2) { ExFreePool(Apc); PsTerminateSystemThread(STATUS_SUCCESS); } NTSTATUS ForceTerminateThread(PETHREAD Thread) { ULONG SYS_THREAD = 0x10; NTSTATUS st = STATUS_UNSUCCESSFUL; ULONG Size = 0; ULONG i = 0; PKAPC pApc = 0; if ( MmIsAddressValid((PVOID)Thread) == TRUE) { pApc = ExAllocatePool(NonPagedPool, sizeof(KAPC)); //Fix Thread Type To SYSTEM THREAD *(PULONG)((ULONG)Thread+EToffSET)=SYS_THREAD; //XP=0x248, 2K3=0x240, VISTA+2k8=0x260, Win7=0x280 //If APC is OK if (pApc) { KeInitializeApc(pApc, Thread, OriginalApcEnvironment, ApcCallBack, 0, 0, KernelMode, 0); KeInsertQueueApc(pApc, pApc, 0, 2); } st = STATUS_SUCCESS; } return st; } NTSTATUS ForceTerminateProcess(PEPROCESS Process) { ULONG i; PETHREAD txtd; PEPROCESS txps; NTSTATUS st = STATUS_UNSUCCESSFUL; for (i=8;i<=65536;i=i+4) { st = PsLookupThreadByThreadId(i,&txtd); if ( NT_SUCCESS(st) ) { txps=IoThreadToProcess(txtd); if ( txps == Process ) { ForceTerminateThread(txtd); } } } return STATUS_SUCCESS; } NTSTATUS BreakProcessMemory(ULONG Process) { NTSTATUS st = STATUS_UNSUCCESSFUL; KAPC_STATE ks; ULONG EndAddress = (ULONG*)MmUserProbeAddress; ULONG i = 0; if (!MmIsAddressValid((PEPROCESS)Process)) return st; KeStackAttachProcess((PEPROCESS)Process, &ks); for (i = 0; i < EndAddress; i += 0x1000) { __try { if (MmIsAddressValid((PVOID)i)) { ProbeForWrite((CONST PVOID)i, 0x1000, 0x1000); memset((PVOID)i, 0xcc, 0x1000);//int 3 } } __except (EXCEPTION_EXECUTE_HANDLER) { } } KeUnstackDetachProcess(&ks); return STATUS_SUCCESS; } NTSTATUS NormalTerminateProcess(PEPROCESS Process) { NTSTATUS st = STATUS_UNSUCCESSFUL; KAPC_STATE ks; KeStackAttachProcess(Process, &ks); st = ZwTerminateProcess(0,0); KeUnstackDetachProcess(&ks); return st; } NTSTATUS TerminateProcess( PEPROCESS Process ) { NTSTATUS Status; OBJECT_ATTRIBUTES objOa; NTSTATUS st; HANDLE hJob; CLIENT_ID objCid; Status = STATUS_SUCCESS; __try { ObOpenObjectByPointer(Process,0,0,0,0,0,&hprocess) ; RtlZeroMemory(&objOa,sizeof(OBJECT_ATTRIBUTES)); objOa.Length = sizeof (OBJECT_ATTRIBUTES); st = ZwCreateJobObject(&hJob, 0, &objOa); if (NT_SUCCESS (st)) { st=ZwAssignProcessToJobObject(hJob, hprocess); if NT_SUCCESS(st) {ZwTerminateJobObject(hJob,0); ZwClose (hJob);} ZwClose (hprocess); } } __except(EXCEPTION_EXECUTE_HANDLER) { Status = 0; } return Status; } NTSTATUS ZwKP( PEPROCESS Process ) { NTSTATUS Status; NTSTATUS st; Status = STATUS_SUCCESS; __try { st=ObOpenObjectByPointer(Process,0,0,0,0,0,&hprocess) ; if NT_SUCCESS(st) {ZwTerminateProcess (hprocess,0); ZwClose(hprocess);} } __except(EXCEPTION_EXECUTE_HANDLER) { Status = 0; } return Status; } long Ring0OpenProcess(HANDLE Pid) { ULONG ProcessHandle=0; CLIENT_ID objCid; OBJECT_ATTRIBUTES objOa; RtlZeroMemory(&objOa,sizeof(OBJECT_ATTRIBUTES)); RtlZeroMemory(&objCid,sizeof(CLIENT_ID)); objOa.Length = sizeof(objOa); objCid.UniqueProcess = (HANDLE)Pid;//进程pid ZwOpenProcess (&(HANDLE)ProcessHandle, 0x1F0FFF, &objOa, &objCid);//打开进程 return ProcessHandle; } NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObj, PUNICODE_STRING pRegistryString) { NTSTATUS status = STATUS_SUCCESS; UNICODE_STRING ustrLinkName; UNICODE_STRING ustrDevName; PDEVICE_OBJECT pDevObj; dprintf("[MyKiller] DriverEntry: %S\n",pRegistryString->Buffer); // Create dispatch points for device control, create, close. pDriverObj->MajorFunction[IRP_MJ_CREATE] = DispatchCreate; pDriverObj->MajorFunction[IRP_MJ_CLOSE] = DispatchClose; pDriverObj->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DispatchIoctl; pDriverObj->DriverUnload = DriverUnload; RtlInitUnicodeString(&ustrDevName, DEVICE_NAME); status = IoCreateDevice(pDriverObj, 0, &ustrDevName, FILE_DEVICE_UNKNOWN, 0, FALSE, &pDevObj); dprintf("[MyKiller] Device Name %S",ustrDevName.Buffer); if(!NT_SUCCESS(status)) { dprintf("[MyKiller] IoCreateDevice = 0x%x\n", status); return status; } RtlInitUnicodeString(&ustrLinkName, LINK_NAME); status = IoCreateSymbolicLink(&ustrLinkName, &ustrDevName); if(!NT_SUCCESS(status)) { dprintf("[MyKiller] IoCreateSymbolicLink = 0x%x\n", status); IoDeleteDevice(pDevObj); return status; } dprintf("[MyKiller] SymbolicLink:%S",ustrLinkName.Buffer); return STATUS_SUCCESS; } VOID DriverUnload(PDRIVER_OBJECT pDriverObj) { UNICODE_STRING strLink; RtlInitUnicodeString(&strLink, LINK_NAME); // // Delete the symbolic link // IoDeleteSymbolicLink(&strLink); // // Delete the device object // IoDel