本文共 1216 字，大约阅读时间需要 4 分钟。

金山毒霸的进程可以在R0直接关掉

NTSTATUS KillProcess(DWORD dwPid){    NTSTATUS            status = STATUS_UNSUCCESSFUL;    HANDLE              hProcess = INVALID_HANDLE_VALUE;    OBJECT_ATTRIBUTES   ObjAttrib;    CLIENT_ID           ClientId;    DBGPRT((">> KillProcess [0x%X]\r\n", dwPid));    InitializeObjectAttributes(&ObjAttrib, NULL, OBJ_INHERIT, NULL, NULL);    ClientId.UniqueProcess = (HANDLE)dwPid;    ClientId.UniqueThread = NULL;    __try    {        status = ZwOpenProcess(            &hProcess,             PROCESS_ALL_ACCESS,             &ObjAttrib,             &ClientId);        if (NT_SUCCESS(status))        {            status = ZwTerminateProcess(hProcess, 0);            if (NT_SUCCESS(status))            {                DBGPRT(("ZwTerminateProcess OK"));            }            else            {                DBGPRT(("status = 0x%X when ZwTerminateProcess", status));            }                            ZwClose(hProcess);        }        else            DBGPRT(("status = 0x%X when ZwOpenProcess", status));    }    _except(EXCEPTION_EXECUTE_HANDLER)    {        DBGPRT(("_except(EXCEPTION_EXCUTE_HANDLER)"));    }        DBGPRT(("<< KillProcess [0x%X]\r\n", dwPid));        return STATUS_SUCCESS;}

转载地址：https://lostspeed.blog.csdn.net/article/details/12801223 如侵犯您的版权，请留言回复原文章的地址，我们会给您删除此文章，给您带来不便请您谅解！