Esempio n. 1
0
BOOL SlayProcess(DWORD PID)
{
   HANDLE hp = GetProcessHandleWithEnoughRights(PID, PROCESS_TERMINATE);
   if (hp != NULL)
   {
   // if all went well, we've now got a handle to the process
   // that grants us PROCESS_TERMINATE permissions
      BOOL bReturn = TerminateProcess(hp, 1);

   // don't forget to close process handle
      ::CloseHandle(hp);

      return(bReturn);
   }

   return(FALSE);
}
Esempio n. 2
0
BOOL WINAPI InjectLibW(DWORD dwProcessId, PCWSTR pszLibFile) 

{

	BOOL fOk = FALSE; // Assume that the function fails

	HANDLE hProcess = NULL, hThread = NULL;

	PWSTR pszLibFileRemote = NULL;



	// Get a handle for the target process.

	hProcess = 



		GetProcessHandleWithEnoughRights(

		dwProcessId,

		PROCESS_QUERY_INFORMATION |   // Required by Alpha

		PROCESS_CREATE_THREAD     |   // For CreateRemoteThread

		PROCESS_VM_OPERATION      |   // For VirtualAllocEx/VirtualFreeEx

		PROCESS_VM_WRITE              // For WriteProcessMemory

		);

	if (hProcess == NULL)

		return(FALSE);



	// Calculate the number of bytes needed for the DLL's pathname

	int cch = 1 + lstrlenW(pszLibFile);

	int cb  = cch * sizeof(WCHAR);



	// Allocate space in the remote process for the pathname

	pszLibFileRemote = 

		(PWSTR) VirtualAllocEx(hProcess, NULL, cb, MEM_COMMIT, PAGE_READWRITE);



	if (pszLibFileRemote != NULL)

	{

		// Copy the DLL's pathname to the remote process's address space

		if (WriteProcessMemory(hProcess, pszLibFileRemote, 

			(PVOID) pszLibFile, cb, NULL))

		{

			// Get the real address of LoadLibraryW in Kernel32.dll

			PTHREAD_START_ROUTINE pfnThreadRtn = (PTHREAD_START_ROUTINE)

				GetProcAddress(GetModuleHandle(TEXT("Kernel32")), "LoadLibraryW");

			if (pfnThreadRtn != NULL)

			{

				// Create a remote thread that calls LoadLibraryW(DLLPathname)

				hThread = CreateRemoteThread(hProcess, NULL, 0, 

					pfnThreadRtn, pszLibFileRemote, 0, NULL);

				if (hThread != NULL)

				{

					// Wait for the remote thread to terminate

					//WaitForSingleObject(hThread, INFINITE);



					fOk = TRUE; // Everything executed successfully



					//CloseHandle(hThread);

				}

			}

		}

		// Free the remote memory that contained the DLL's pathname

		//VirtualFreeEx(hProcess, pszLibFileRemote, 0, MEM_RELEASE);

	}



	//CloseHandle(hProcess);



	return(fOk);

}