Código: Seleccionar todo

unit ZwTerminateProcessTest;

interface

uses
  nt_status,
  ntoskrnl,
  NtoskrnlCustom;

function _DriverEntry(
  DriverObject: PDriverObject;
  RegistryPath: PUnicodeString
  ): NTSTATUS; stdcall;

implementation

function OpenProcess(PID: DWORD): Thandle; stdcall;
var
  ProcessHandle: Thandle;
  ClientId: CLIENT_ID;
  ObjectAttributes: OBJECT_ATTRIBUTES;
begin
  ProcessHandle := 0;

  ObjectAttributes.Length := SizeOf(OBJECT_ATTRIBUTES);
  ObjectAttributes.RootDirectory := 0;
  ObjectAttributes.ObjectName := nil;
  ObjectAttributes.Attributes := 0;
  ObjectAttributes.SecurityDescriptor := nil;
  ObjectAttributes.SecurityQualityOfService := nil;

  ClientId.UniqueProcess := PID;
  ClientId.UniqueThread := 0;

  ZwOpenProcess(
    @ProcessHandle,
    $001F0FFF,
    @ObjectAttributes,
    @ClientId
    );

  Result := ProcessHandle;
end;

procedure DoIt;
var hProcess: Thandle;
begin

 [color=#FF0000] // IMPORTANT: "1064" is Process's ID, Change it with your target Process ID.[/color]
  hProcess := OpenProcess(1064);
  if hProcess <> 0 then
  begin
    DbgPrint('OpenProcess: Success -->> Process handle is:0x%X', hProcess);
    if ZwTerminateProcess(hProcess, 0) = 0 then
      DbgPrint('ZwTerminateProcess - Killed')
    else
      DbgPrint('ZwTerminateProcess - Failed');
  end
  else
    DbgPrint('OpenProcess: Failed to get Process handle');

  ZwClose(hProcess);
end;

function _DriverEntry(DriverObject: PDriverObject; RegistryPath: PUnicodeString): NTSTATUS; stdcall;
begin
  DbgPrint('Driver -->> Loaded');
  DoIt;
  DbgPrint('Driver -->> Leaving');
  Result := STATUS_DEVICE_CONFIGURATION_ERROR;
end;
end.