//weibo: @少仲

一個應用程式想要結束另一個程序所要做的事：首先獲得目標的程序ID,接著利用OpenProcess獲取程序控制代碼（確保足夠許可權）,最後將控制代碼傳給TerminateProcess了結那個程序.

首先,為什麼要暴力搜尋?因為這些函式都是未公開的函式.通過WinDbg來找到這些函式的名字.

kd> x nt!*Ps*terminate*
805c9eb6 nt!PsTerminateSystemThread =<no type information>
805c9ee4 nt!PsTerminateProcess = <notype information>
805c9b02 nt!PspTerminateThreadByPointer =<no type information>
805c9da4 nt!PspTerminateProcess = <notype information>
805cd84e nt!PspTerminateAllProcessesInJob =<no type information>
 

那麼如何搜尋到PspTerminateProcess的地址呢?再次反彙編PspTerminateProcess看看.

uf PspTerminateProcess:
805c9da4 8bff            mov     edi,edi
805c9da6 55              push    ebp
805c9da7 8bec            mov     ebp,esp
805c9da9 56              push    esi
805c9daa 64a124010000    mov    eax,dword ptr fs:[00000124h]
805c9db0 8b7508          mov     esi,dword ptr [ebp+8]
805c9db3 3b7044          cmp     esi,dword ptr [eax+44h]
805c9db6 7507            jne     nt!PspTerminateProcess+0x1b (805c9dbf)
 

看到了地址805c9da4,現在通過特徵碼來定位它在系統中的位置.

kd> dd PspTerminateProcess L8
805c9da4 8b55ff8b a16456ec 00000124 3b08758b
805c9db4 07754470 00000db8 575aebc0 0248be8d

通過校驗這32個位元組.網上大部分校驗的是16位元組.甚至還有更巧妙的演算法..還有大牛給出了用kmp演算法定位地址的方法.但是某貼中看了mj大牛說的話,暴搜特徵碼不是追求效率而是追求準確.所以就定位了32位元組...(經測試,win xp 定位16位元組可以準確無誤的找到函式地址,而win7 以上要定位更多位元組)

typedef  NTSTATUS  (*PSPTERPROC)( PEPROCESS Process,NTSTATUSExitStatus);
PSPTERPROC MyPspTerminateProcess =NULL;
 
PVOID GetPspTerminateProcessAddr()
{
    ULONG size,index;
    PULONG buf;
    ULONG i;
    PSYSTEM_MODULE_INFORMATIONmodule;
    PVOID driverAddress=0;
    ULONG ntosknlBase;
    ULONG ntosknlEndAddr;
    ULONG curAddr;
    NTSTATUS status;
    PVOID retAddr;
   
    ULONG code1=0x8b55ff8b,code2=0xa16456ec,code3=0x00000124,code4=0x3b08758b;
    ULONG code5=0x07754470,code6=0x00000db8,code7=0x575aebc0,code8=0x0248be8d;
 
    ZwQuerySystemInformation(SystemModuleInformation,&size, 0, &size);
    if(NULL==(buf = (PULONG)ExAllocatePoolWithTag(PagedPool,size,'aaa')))
    {
        DbgPrint("failedalloc memory failed \n");
        return 0;
    }
    status=ZwQuerySystemInformation(SystemModuleInformation,buf,size , 0);
    if(!NT_SUCCESS(status ))
    {
        DbgPrint("failedquery\n");
        return 0;
    }
    module = (PSYSTEM_MODULE_INFORMATION)((PULONG )buf+ 1);
    ntosknlEndAddr=(ULONG)module->Base+(ULONG)module->Size;
    ntosknlBase=(ULONG)module->Base;
    curAddr=ntosknlBase;
    ExFreePool(buf);
   
    for (i=curAddr;i<=ntosknlEndAddr;i++)
    {
        if ((*((ULONG *)i)==code1)&&(*((ULONG *)(i+4))==code2)&&(*((ULONG*)(i+8))==code3)&&(*((ULONG*)(i+12))==code4)&&(*((ULONG*)(i+16))==code5)&&(*((ULONG*)(i+20))==code6)&&(*((ULONG*)(i+24))==code7)&&(*((ULONG*)(i+28))==code8) )
        {
            retAddr=(PVOID*)i;
            DbgPrint("PspTerminateProcessadress is:%x\n",retAddr);
            MyPspTerminateProcess = (PSPTERPROC)retAddr;
            return retAddr;
        }
    }
    DbgPrint("Can'tFind PspTerminateProcess Address:%x\n");
    return 0;
}

得到了地址,儲存在MyPspTerminateProcess中,那麼現在就可以來結束程序了.通過PsLookupProcessByProcessId來找到Eprocess,然後MyPspTerminateProcess(Eprocess, 0)就ok了.

 2.呼叫APC來結束程序.其實這個方法本質上來講和第一種是一樣的.因為第一種方法就是通過PspTerminateProcess ->PspTerminateThreadByPointer ->KeInitializeApc/KeInsertQueueApc來結束程序的.但是不同的是第一種方法用PspTerminateProcess通過PEPROCESS的hreadListHead連結串列來獲取所有執行緒,然後PspTerminateThreadByPointer一個個的把執行緒幹掉.我這裡從新修改了它,不用PsGetNextProcessThread來遍歷執行緒.而是用一個我認為足夠大的數字來列舉並結束執行緒
過程為PsLookupThreadByThreadId傳入執行緒ID獲取執行緒結構指標，再通過IoThreadToProcess傳入執行緒指標結構，返回執行緒所屬的程序指標，然後對比確定該執行緒屬於目標程序後，呼叫PspTerminateThreadBypointer傳入該執行緒結構指標，幹掉它

BOOLEAN My_PspTerminateProcess(PEPROCESSProcess)
{
    ULONG i;
    PETHREAD txtd;
    PEPROCESS txps;
    NTSTATUS st = STATUS_UNSUCCESSFUL;
    for (i=8;i<=65536;i+=4)
    {
        st = PsLookupThreadByThreadId(i,&txtd);
        if ( NT_SUCCESS(st) )
        {
            txps=IoThreadToProcess(txtd);
            if ( txps == Process )
            {
                MyPspTerminatePsByPointer(txtd);
            }
        }
    }
    return TRUE;
}
 
NTSTATUS MyPspTerminatePsByPointer(PETHREADThread)
{
    //系統執行緒常量標誌
    ULONG Systerm_Thread_Sign= 0x10;
    ULONG Size = 0;
    ULONG i = 0;
    PKAPC pApc = 0;
 
    if ( MmIsAddressValid((PVOID)Thread))//首先要校驗地址,有效的話就DKOM
    {
        *(PULONG)((ULONG)Thread + 0x248) =Systerm_Thread_Sign;
 
        pApc = ExAllocatePoolWithTag(NonPagedPool,sizeof(KAPC),'apc');
 
        if (pApc)
        {
            //apcrt 是apc例程
            KeInitializeApc(pApc,Thread,OriginalApcEnvironment,APCRT,0,0,KernelMode,0);
            KeInsertQueueApc(pApc,pApc,0,2);
        }
    }
   
    return STATUS_SUCCESS;
}
 
VOID APCRT(PKAPC Apc,PKNORMAL_ROUTINE*NormalRoutine,PVOID  *NormalContext,PVOID *SystemArgument1,PVOID *SystemArgument2)
{
    ExFreePool(Apc);
    PsTerminateSystemThread(STATUS_SUCCESS);
}

3.記憶體清零法.attach到程序,然後將資料填充為0

BOOLEAN ZeroKill(ULONG PID)
{
    NTSTATUS ntStatus=STATUS_SUCCESS;
    int i = 0;
    PVOID handle;
    PEPROCESS Eprocess;
    ntStatus = PsLookupProcessByProcessId(PID,&Eprocess);
 
    if (NT_SUCCESS(ntStatus))
    {
        KeAttachProcess(Eprocess);//Attach程序虛擬空間
        for(i = 0;i <= 0x7fffffff;i+= 0x1000)
        {
            if(MmIsAddressValid((PVOID)i))
            {
                _try
                {
                    ProbeForWrite((PVOID)i,0x1000,sizeof(ULONG));
                    memset((PVOID)i,0xcc,0x1000);
                }_except(1)
                {
                    continue; 
                }
            }
            else
            {
                if(i>0x1000000)  //填這麼多足夠破壞程序資料了
                    break;
            }
        }
       
        KeDetachProcess();
 
        if(ObOpenObjectByPointer((PVOID)Eprocess,0,NULL, 0, NULL,KernelMode, &handle)!=STATUS_SUCCESS)
            return FALSE;
        ZwTerminateProcess((HANDLE)handle,STATUS_SUCCESS);
        ZwClose((HANDLE)handle );
        return TRUE;
    }
 
 
    return FALSE;
}