note: KillProcess On R0

来源：互联网发布：天敏网络机顶盒说明书编辑：程序博客网时间：2024/05/29 10:52

金山毒霸的进程可以在R0直接关掉

NTSTATUS KillProcess(DWORD dwPid){    NTSTATUS            status = STATUS_UNSUCCESSFUL;    HANDLE              hProcess = INVALID_HANDLE_VALUE;    OBJECT_ATTRIBUTES   ObjAttrib;    CLIENT_ID           ClientId;    DBGPRT((">> KillProcess [0x%X]\r\n", dwPid));    InitializeObjectAttributes(&ObjAttrib, NULL, OBJ_INHERIT, NULL, NULL);    ClientId.UniqueProcess = (HANDLE)dwPid;    ClientId.UniqueThread = NULL;    __try    {        status = ZwOpenProcess(            &hProcess,             PROCESS_ALL_ACCESS,             &ObjAttrib,             &ClientId);        if (NT_SUCCESS(status))        {            status = ZwTerminateProcess(hProcess, 0);            if (NT_SUCCESS(status))            {                DBGPRT(("ZwTerminateProcess OK"));            }            else            {                DBGPRT(("status = 0x%X when ZwTerminateProcess", status));            }                            ZwClose(hProcess);        }        else            DBGPRT(("status = 0x%X when ZwOpenProcess", status));    }    _except(EXCEPTION_EXECUTE_HANDLER)    {        DBGPRT(("_except(EXCEPTION_EXCUTE_HANDLER)"));    }        DBGPRT(("<< KillProcess [0x%X]\r\n", dwPid));        return STATUS_SUCCESS;}