NtTerminateProcess:
這是一個Windows的關閉程式的函式,級別屬於核心級,大多數的程式都使用這個函式來實現關閉程式
也許你使用的是TerminateProcess,但是TerminateProcess是通過調用NtTerminateProcess來實現關閉程式的
函式原型:
C/C++:NtTerminateProcess(
IN HANDLE ProcessHandle OPTIONAL,
IN NTSTATUS ExitStatus);
Declare Function NtTerminateProcess Lib "ntdll" (ByVal hProc As Long, ByVal ExitCode As Long) As Long
參數意義:ProcessHandle : 進程的句柄,要用OpenProcess來獲得
ExitStatus:退出代碼
函式之間的調用:
TerminateProcess ->NtTerminateProcess ->ZwTerminateProcess
有時候,TerminateProcess 不能完全地結束一個進程,但是NtTerminateProcess 可以,ZwTerminateProcess 是基於核心驅動來關閉進程的.
C++的一個簡單示例:
#include <windows.h>
#include <stdio.h>
typedef DWORD (__stdcall *NtTerminateProcess)(HANDLE,UINT);
NtTerminateProcess fNtTerminateProcess=NULL;
BOOL ExitProc(HANDLE hProc)
{
HINSTANCE HMODULE=LoadLibrary("ntdll.dll"); //載入 ntdll.dll
if(hModule!=0)
{
fNtTerminateProcess=(NtTerminateProcess)GetProcAddress(hModule,"NtTerminateProcess"); //載入外部DLL函式
HANDLE hToken=OpenProcess(PROCESS_ALL_ACCESS,FALSE,(DWORD)hProc); //獲得進程的最大許可權
if(hToken!=0){ if(fNtTerminateProcess(hToken,1)==0) //關閉程式
{
printf("End Proc:%d\n",(int)hProc);
return TRUE;
}
else
{
return FALSE;
}
}
return FALSE;
}
VB的一個簡單示例:
Private Const PROCESS_ALL_ACCESS = &H1F0FFF '全權打開進程
Private Function GetMaxPrivilegeToProcess(ByVal ProcessID As Long) As Long
GetMaxPrivilegeToProcess = OpenProcess(PROCESS_ALL_ACCESS, False, ProcessID)
End Function
Public Function ExitProc(ByVal PID As Long) As Boolean
If NtTerminateProcess(PID, 1) = 0 Then
ExitProc = True
Else
ExitProc = False
End If
End Function
