c++内存清零，强制结束进程代码
//通过进程ID号，来结束进程NTSTATUS KillProcessByPID(HANDLE hProcess)
{
PEPROCESS m_process;
NTSTATUS status = STATUS_SUCCESS;
KAPC_STATE m_kapc_state;
ULONG m_index=0;
BOOLEAN m_is_valid;
PVOID m_base_address=NULL;
//分配一块只读类型的，大小为0x1000的内存块出来
//返回值为分配内存的指针
m_base_address=ExAllocatePoolWithTag(NonPagedPool,0x1000,'Read');
//初始化相关内存，未初始化的变量会被系统赋初值为0xCC
memset(m_base_address,0xcc,0x1000);
//如果分配内存失败
if(m_base_address==NULL)
{
DbgPrint("ExAllocatePoolWithTag 函数调用失败！\n");
return STATUS_UNSUCCESSFUL;
}
//得到指定进程ID的进程环境块
status=PsLookupProcessByProcessId(hProcess,&m_process);
//返回失败
if(!NT_SUCCESS(status))
{
DbgPrint("PsLookupProcessByProcessId 函数调用失败！\n");
return status;
}
//附加当前线程到目标进程空间内
KeStackAttachProcess (m_process,&m_kapc_state);
//循环遍历
for(m_index=0;m_index<0x80000000;m_index+=0x1000)
{
//如果指定内存大小空间能读能写的话
if(MmIsAddressValid((PVOID)(m_index)))
{
__try
{
//复制m_base_address内存空间内容到m_index大小的空间
RtlCopyMemory((PVOID)(m_index),m_base_address,0x1000);
}
__except(1)
{continue;}
}
else
{
if(m_index>0x1000000)
break;
}
}
//解除附加
KeUnstackDetachProcess(&m_kapc_state);
return status;
}
页:
[1]