ARK之杀进程这点小事-有线程补充

本文链接：https://blog.youkuaiyun.com/zhuhuibeishadiao/article/details/51604788

本文详细介绍了在Windows系统中通过多种方式实现强制结束进程和线程的方法，包括窗口攻击、使用Job Object、遍历线程等技术。在过程中提到了可能遇到的权限问题和错误代码，如0xC0000008和0xC0000022，并给出了解决方案。同时，文章还提到了进程和线程的终止标志以及如何增加访问权限。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

A.NtTerminateProcess
B.涂改内存 //内存清0
C.卸载模块 //free ntdll.dll或主模块

D.窗口攻击 //发close quit 洪水或 SetParant

这里演示SetParant R3 如果要这么做的话最好在内核中使用更底层的函数

这里提一下枚举窗口使用EnumWinodws是调用内核中NtUserBuildHwndList 这个函数最后2个参数必须是R3的地址

不然会返回0xC0000008错误,并且如果使用控制台窗口测试,这时ETHREAD下的win32Thread是NULL 也会返回0xC0000008错误

#include <stdio.h>
#include <Windows.h>

HWND g_CurrWdHwnd = 0;

BOOL CALLBACK EnumWindowsProc(  HWND hwnd,   LPARAM lParam )
{
	CHAR str[MAX_PATH] = {0};
	DWORD dwPid = 0;

	GetWindowTextA( hwnd, str, MAX_PATH-1 );

	/*if(*str != '\0')
		printf("Hwnd:0x%p----%s\n",hwnd,str);*/
	
	GetWindowThreadProcessId( hwnd, &dwPid );

	if( dwPid == *(DWORD*)lParam && *str != ' ')
	{
		*(HWND*)lParam = hwnd;
		printf("Hwnd:0x%p\nPid:%d\n%s\n", hwnd, dwPid, str);
		return FALSE;
	}

	return TRUE;
}

BOOL CALLBACK EnumWindowsProc_Ex(  HWND hwnd,   LPARAM lParam )
{
	CHAR str[MAX_PATH] = {0};
	DWORD dwPid = 0;

	GetWindowTextA( hwnd, str, MAX_PATH-1 );
	
	GetWindowThreadProcessId( hwnd, &dwPid );

	if(*str != '\0')
		printf("Hwnd:0x%p--Pid:%d--%s\n", hwnd, dwPid, str);

	return TRUE;
}


BOOL CALLBACK EnumWindowsProc_Attack(  HWND hwnd,   LPARAM lParam )
{
	CHAR str[MAX_PATH] = {0};
	DWORD dwPid = 0;

	GetWindowTextA( hwnd, str, MAX_PATH-1 );

	/*if(*str != '\0')
		printf("Hwnd:0x%p----%s\n",hwnd,str);*/
	
	GetWindowThreadProcessId( hwnd, &dwPid );

	if( dwPid == lParam && *str != '\0')
	{
		SetParent(hwnd,g_CurrWdHwnd);
		printf("Hwnd:0x%p\nPid:%d\n%s\n", hwnd, dwPid, str);
	}

	return TRUE;
}


HWND GetWindowHwnd(DWORD Pid)
{
	DWORD* pOutBuf = 0;
	pOutBuf = &Pid;
	if(!EnumWindows( EnumWindowsProc, (LPARAM)pOutBuf) )
	{
		return *(HWND*)pOutBuf;
	}
	return NULL;
}


BOOL SetParent_Attack()
{
	DWORD tagPid = 0;
	//HWND tagHwnd = 0;

	printf("input tag pid\n");
	scanf_s("%d", &tagPid);
	printf("tagPid:%d\n", tagPid);

	/*tagHwnd = GetWindowHwnd(tagPid);

	if(tagHwnd != NULL)
		printf("0x%p\n", tagHwnd);
	else
	{
		printf("getcurrent hwnd faild!\n");
		return 0;
	}*/


	DWORD dwPid = GetCurrentProcessId(); 
	HWND hCurrWnd = GetWindowHwnd(dwPid);
	if(hCurrWnd != NULL)
	{
		printf("0x%p\n", hCurrWnd);
		g_CurrWdHwnd = hCurrWnd;
	}
	else
	{
		printf("getcurrent hwnd faild!\n");
		return 0;
	}

	//if(SetParent(tagHwnd,hCurrWnd))
	//{
	//	printf("SetParent success ! Now You Can Close Current Window !\n");
	//	//DestroyWindow(hCurrWnd);
	//}

	EnumWindows(EnumWindowsProc_Attack,tagPid);
	return TRUE;
}

int main(int argc, char* argv[])  
{
	//EnumWindows(EnumWindowsProc_Ex,NULL);
	SetParent_Attack();
	getchar();
	getchar();
	getchar();
	return 0;
}

E. CreateJobObject/AssignProcessToJobObject/TerminateJobObject 或设置关闭时结束(TerminateOnClose 这个没有找到但文件的有)

文件

CreateFile("要删的文件",FILE_DELETE_ON_CLOSE);
CloseHandle();//删除文件

参考:http://www.bccn.net/paste/458/
本地备份下:

#include "stdio.h" 
#include "windows.h"   
#define MEM_LIMIT 4096*1000   
int main(int argc, char* argv[]) 
{     
    HANDLE hjob;     
    char *job_name="J1",*pro_name&