您的位置:首页 > 其它

杀手归来!Process Killer 终于可以笑傲江湖了!

2008-03-11 17:06 405 查看
.CodeFormat {font-family:"Courier New", Courier, mono; font-size:10pt; }继前2片《谋杀》系列失败后,

(1) 发现了在公司的电脑中影响Windows性能,造成硬盘唱狂响曲的罪魁祸首!
(2) 谋杀失败!可以杀掉Notepad.exe这样的进程,却对CcmExec.exe这个进程没有办法!

并没有放弃,彻底分析后,终于让Killer可以笑傲江湖了...

摘略如下:

之所以不能杀掉...最大的原因就是执行的程序的级别小于要杀掉的进程的级别,所以重点就是要解决这个问题!

代码如下:

''' API for Changing the Process' PrivilegePrivate Declare Function GetCurrentProcess Lib "KERNEL32" () As LongPrivate Declare Function LookupPrivilegeValue Lib "advapi32.dll" Alias "LookupPrivilegeValueA" (ByVal lpSystemName As String, ByVal lpName As String, lpLuid As LUID) As LongPrivate Declare Function AdjustTokenPrivileges Lib "advapi32.dll" (ByVal TokenHandle As Long, ByVal DisableAllPrivileges As Long, NewState As TOKEN_PRIVILEGES, ByVal BufferLength As Long, PreviousState As TOKEN_PRIVILEGES, ReturnLength As Long) As LongPrivate Declare Function OpenProcessToken Lib "advapi32.dll" (ByVal ProcessHandle As Long, ByVal DesiredAccess As Long, TokenHandle As Long) As Long''' Adjust PriviledgesSub AdjustSelfTokenPrivileges()

  Dim hdlProcessHandle As Long  Dim hdlTokenHandle As Long  Dim tmpLuid As LUID
  Dim tkp As TOKEN_PRIVILEGES
  Dim tkpNewButIgnored As TOKEN_PRIVILEGES
  Dim lBufferNeeded As Long  Dim lp As Long  hdlProcessHandle = GetCurrentProcess()
  lp = OpenProcessToken(hdlProcessHandle, TOKEN_ALL_ACCESS, hdlTokenHandle)
  lp = LookupPrivilegeValue("", "SeDebugPrivilege", tmpLuid)
  tkp.PrivilegeCount = 1  tkp.Privileges(0).pLuid = tmpLuid
  tkp.Privileges(0).Attributes = SE_PRIVILEGE_ENABLED
  lp = AdjustTokenPrivileges(hdlTokenHandle, False, tkp, Len(tkpNewButIgnored), tkpNewButIgnored, lBufferNeeded)

End Sub

可以看到提高了Process Privilege后,就可以了!



同时,增加了2个特性,一个是从ini文件中读取配置信息:



另外一个是最小化到系统栏中,单击或双击托盘图标后恢复窗口:



改了这么多地方,就给他叫1.5.0版吧...

活活,正好赶上Firefox目前的主流版本...^ ^!
内容来自用户分享和网络整理,不保证内容的准确性,如有侵权内容,可联系管理员处理 点击这里给我发消息
标签: