kill.cpp

著名的l0pht代码！

#include <windows.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <tlhelp32.h> 
#define TITLE_SIZE          64
#define PROCESS_SIZE        MAX_PATH

typedef BOOL (WINAPI *PROCESSWALK)(HANDLE hSnapshot, LPPROCESSENTRY32 lppe);
typedef HANDLE (WINAPI *CREATESNAPSHOT)(DWORD dwFlags, DWORD th32ProcessID);

class CTaskListEntry
{
public:

	DWORD       dwProcessId;
    DWORD       dwInheritedFromProcessId;
    BOOL        flags;
    HWND        hwnd;
    CHAR        ProcessName[PROCESS_SIZE];
    CHAR        WindowTitle[TITLE_SIZE];
};

bool proclist(char *name)
{
	bool re=false;
	CREATESNAPSHOT pCreateToolhelp32Snapshot = NULL;
   PROCESSWALK    pProcess32First           = NULL;
   PROCESSWALK    pProcess32Next            = NULL;

   HINSTANCE      hKernel        = NULL;
   HINSTANCE      hProcessSnap   = NULL;
   PROCESSENTRY32 pe32           = {0};
   DWORD          dwTaskCount    = 0;

    // Obtain a module handle to KERNEL so that we can get the addresses of
    // the 32-bit Toolhelp functions we need.
    hKernel = GetModuleHandle("KERNEL32.DLL");

    if (hKernel)
    {
        pCreateToolhelp32Snapshot =
          (CREATESNAPSHOT)GetProcAddress(hKernel, "CreateToolhelp32Snapshot");

        pProcess32First = (PROCESSWALK)GetProcAddress(hKernel,
                                                      "Process32First");
        pProcess32Next  = (PROCESSWALK)GetProcAddress(hKernel,
                                                      "Process32Next");
    }
    
    // make sure we got addresses of all needed Toolhelp functions.
    if (!(pProcess32First && pProcess32Next && pCreateToolhelp32Snapshot))
       return re;
       

    // Take a snapshot of all processes currently in the system.
    hProcessSnap = (HINSTANCE) pCreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if (hProcessSnap == (HANDLE)-1)
        return re;

    // Walk the snapshot of processes and for each process, get information
    // to display.
    dwTaskCount = 0;
    pe32.dwSize = sizeof(PROCESSENTRY32);   // must be filled out before use
    if (pProcess32First(hProcessSnap, &pe32))
    {
        do
        {
            LPSTR pCurChar;

			//SAMPLE: use our class instead of raw structs
			CTaskListEntry* pEntry = new CTaskListEntry;

            // strip path and leave executabe filename splitpath
            for (pCurChar = (pe32.szExeFile + lstrlen (pe32.szExeFile));
                 *pCurChar != '\\' && pCurChar != pe32.szExeFile; 
                 --pCurChar)

//					 ;	// nothing
			
            lstrcpy(pEntry->ProcessName, pCurChar);
            pEntry->flags = 0;
            pEntry->dwProcessId = pe32.th32ProcessID;
			
			if(strcmp( pCurChar, name )==0){
						
				HANDLE  hProc  = 0;
  
				hProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pEntry->dwProcessId );
				if(hProc)
						 {
				//	MessageBox(NULL,"ftp",pCurChar,MB_OK );
							 TerminateProcess(hProc,1);
							 re=true;
							}
				

				CloseHandle(hProc);

			
			}
            ++dwTaskCount;   // keep track of how many tasks we've got so far
//			refList.Add(pEntry);
        }
        while (pProcess32Next(hProcessSnap, &pe32));
    }
    else
        dwTaskCount = 0;    // Couldn't walk the list of processes.

    // Don't forget to clean up the snapshot object...
    CloseHandle (hProcessSnap);




    return re;
}