Blog

  
#include  <windows.h>

typedef NTSTATUS (*PSPTERPROC) ( PEPROCESS Process, NTSTATUS ExitStatus );  
PSPTERPROC MyPspTerminateProcess ;  
NTSTATUS  
PsLookupProcessByProcessId(  
  IN HANDLE ProcessId,  
  OUT PEPROCESS *Process  
  );  

void Unload(PDRIVER_OBJECT pDriverObj)  
{  
  DbgPrint("Driver Stop\n");  
}  

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObj, PUNICODE_STRING pRegistryString)  
{  
  PEPROCESS hProcess;  
  MyPspTerminateProcess =(PSPTERPROC)0x805c8642;  

  //比如冰刃的进程ID为1732  
  if(PsLookupProcessByProcessId(1732,&hProcess)==STATUS_SUCCESS)  
  {  
  MyPspTerminateProcess(hProcess,0);  
  }  
  pDriverObj->DriverUnload = Unload;  
  return STATUS_SUCCESS;  
}