justify">); NTSTATUS (* NtTerminateProcessPointer) (HANDLE ProcessHandle OPTIONAL, NTSTATUS ExitStatus); NTSTATUS (* NtTerminateThreadPointer) (HANDLE ThreadHandle, NTSTATUS ExitStatus); NTSTATUS (* NtWriteVirtualMemoryPointer) (HANDLE ProcessHandle, PVOID BaseAddress, PVOID Buffer, ULONG NumberOfBytesToWrite, PULONG NumberOfBytesWritten OPTIONAL); NTSTATUS (* NtDebugActiveProcessPointer) (HANDLE Process, HANDLE DebugObject);TrueNtOpenProcess;TrueNtTerminateProcess;TrueNtWriteVirtualMemory;TrueNtDebugActiveProcess;TrueNtTerminateThread;TrueNtOpenThread;OpenProcessId;TerminateProcessId;WriteVirtualMemoryId;DebugActiveProcessId;TerminateThreadId;OpenThreadId;GetPid(HANDLE ProcessHandle) {process=0; PID; (,
,,,
& process,);
__try
{= (ULONG) PsGetProcessId (process);
}
__except (EXCEPTION_EXECUTE_HANDLER)
{STATUS_INVALID_PARAMETER;
}; (process); PID;
}; (HANDLE ThreadHandle, NTSTATUS ExitStatus)
{uPid=0; thread=NULL; status=STATUS_UNSUCCESSFUL;=ObReferenceObjectByHandle (,
,
* PsThreadType,,
(PVOID *) & thread,); (! NT_SUCCESS (status))
{TrueNtTerminateThread (,);
}=(ULONG) PsGetThreadProcessId (); (); (uPid == ProtectedPid) {STATUS_ACCESS_DENIED;
} return TrueNtTerminateThread (,);
}; NewNtOpenThread (
__out PHANDLE ThreadHandle,
__in ACCESS_MASK DesiredAccess,
__in POBJECT_ATTRIBUTES ObjectAttributes,
__in PCLIENT_ID ClientId) {uPid=0; thread=NULL; status=STATUS_UNSUCCESSFUL;=ObReferenceObjectByHandle (,
,
* PsThreadType,,
(PVOID *) & thread,); (! NT_SUCCESS (status))
{TrueNtOpenThread (ThreadHandle, DesiredAccess, ObjectAttributes, ClientId);
}=(ULONG) PsGetThreadProcessId (); (); (uPid == ProtectedPid) {STATUS_ACCESS_DENIED;
}
return TrueNtOpenThread (ThreadHandle, DesiredAccess, ObjectAttributes, ClientId);
}; NewNtOpenProcess (PHANDLE ProcessHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId) {
ULONG ProcessId;
__try
{= ClientId-> UniqueProcess;
}
__except (EXCEPTION_EXECUTE_HANDLER)
{STATUS_INVALID_PARAMETER;
} (ProcessId == ProtectedPid) {STATUS_ACCESS_DENIED;
} TrueNtOpenProcess (,,,);
}; NewNtTerminateProcess (HANDLE ProcessHandle OPTIONAL, NTSTATUS ExitStatus) {(GetPid (ProcessHandle) == ProtectedPid) {STATUS_ACCESS_DENIED;
} else TrueNtTerminateProcess (OPTIONAL,);
}; NewNtWriteVirtualMemory (HANDLE ProcessHandle, PVOID BaseAddress, PVOID Buffer, ULONG NumberOfBytesToWrite, PULONG NumberOfBytesWritten OPTIONAL) {(GetPid (ProcessHandle) == ProtectedPid) {STATUS_ACCESS_DENIE...
