Z
zhxdiannao
Unregistered / Unconfirmed
GUEST, unregistred user!
请问用delphi如何编写能结束杀软进程的东西?主要是用来对付单位的瑞星和定时关机软件,现在能结束一般程序了,但是我的卡巴的avp.exe结束不了。
参照网上代码,我照猫画虎写的程序如下所示:
本人没有恶意应用目的,现在用一个叫做“killer 2.0”(作者 暗眼)的软件,
只能每次手工填入
ravcopy.exe|ravmon.exe|ravmond.exe|ravstud.exe|ravtask.exe|rsaupd.exe|rstray.exe
这一大串文件列表(瑞星真他吗的变态!),若要生成针对瑞星的专门程序,得花200元买他的完整功能板,因此才想自己写一个程序,请帮助我kill瑞星!
~~~~~~~~~~~~~~~~~~~~~
unit Unit1;
interface
uses
Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
Dialogs,Tlhelp32, StdCtrls;
type
TForm1 = class(TForm)
Edit1: TEdit;
Button1: TButton;
procedure Button1Click(Sender: TObject);
private
{ Private declarations }
public
{ Public declarations }
end;
var
Form1: TForm1;
implementation
{$R *.dfm}
//根据进程名称来杀死进程是用以下函数:
function KillTask(ExeFileName: string): Integer;
const
PROCESS_TERMINATE = $0001;
var
ContinueLoop: BOOL;
FSnapshotHandle: THandle;
FProcessEntry32: TProcessEntry32;
begin
Result := 0;
FSnapshotHandle := CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
FProcessEntry32.dwSize := SizeOf(FProcessEntry32);
ContinueLoop := Process32First(FSnapshotHandle, FProcessEntry32);
while Integer(ContinueLoop) <> 0 do
begin
if ((UpperCase(ExtractFileName(FProcessEntry32.szExeFile)) =
UpperCase(ExeFileName)) or (UpperCase(FProcessEntry32.szExeFile) =
UpperCase(ExeFileName))) then
Result := Integer(TerminateProcess(
OpenProcess(PROCESS_TERMINATE,BOOL(0),FProcessEntry32.th32ProcessID),0));
ContinueLoop := Process32Next(FSnapshotHandle, FProcessEntry32);
end;
CloseHandle(FSnapshotHandle);
end;
//但是对于服务程序,它会提示"拒绝访问".其实只要程序拥有Debug权限即可:
function EnablePrivilege(hToken: Cardinal; PrivName: string; bEnable: Boolean): Boolean;
var
TP: TOKEN_PRIVILEGES;
Dummy: Cardinal;
begin
TP.PrivilegeCount := 1;
LookupPrivilegeValue(nil, pchar(PrivName), TP.Privileges[0].Luid);
if bEnable then
TP.Privileges[0].Attributes := SE_PRIVILEGE_ENABLED
else TP.Privileges[0].Attributes := 0;
AdjustTokenPrivileges(hToken, False, TP, SizeOf(TP), nil, Dummy);
Result := GetLastError = ERROR_SUCCESS;
end;
function EnableDebugPrivilege: Boolean;
var
hToken: Cardinal;
begin
OpenProcessToken(GetCurrentProcess, TOKEN_ADJUST_PRIVILEGES, hToken);
result:=EnablePrivilege(hToken, 'SeDebugPrivilege', True);
CloseHandle(hToken);
end;
procedure TForm1.Button1Click(Sender: TObject);
begin
EnableDebugPrivilege;//提升权限
KillTask(edit1.Text);//关闭该服务程序.
end;
end.
~~~~~~~~~~~~~~~~~~~~~~~
是不是软件提升权限还不够?
参照网上代码,我照猫画虎写的程序如下所示:
本人没有恶意应用目的,现在用一个叫做“killer 2.0”(作者 暗眼)的软件,
只能每次手工填入
ravcopy.exe|ravmon.exe|ravmond.exe|ravstud.exe|ravtask.exe|rsaupd.exe|rstray.exe
这一大串文件列表(瑞星真他吗的变态!),若要生成针对瑞星的专门程序,得花200元买他的完整功能板,因此才想自己写一个程序,请帮助我kill瑞星!
~~~~~~~~~~~~~~~~~~~~~
unit Unit1;
interface
uses
Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
Dialogs,Tlhelp32, StdCtrls;
type
TForm1 = class(TForm)
Edit1: TEdit;
Button1: TButton;
procedure Button1Click(Sender: TObject);
private
{ Private declarations }
public
{ Public declarations }
end;
var
Form1: TForm1;
implementation
{$R *.dfm}
//根据进程名称来杀死进程是用以下函数:
function KillTask(ExeFileName: string): Integer;
const
PROCESS_TERMINATE = $0001;
var
ContinueLoop: BOOL;
FSnapshotHandle: THandle;
FProcessEntry32: TProcessEntry32;
begin
Result := 0;
FSnapshotHandle := CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
FProcessEntry32.dwSize := SizeOf(FProcessEntry32);
ContinueLoop := Process32First(FSnapshotHandle, FProcessEntry32);
while Integer(ContinueLoop) <> 0 do
begin
if ((UpperCase(ExtractFileName(FProcessEntry32.szExeFile)) =
UpperCase(ExeFileName)) or (UpperCase(FProcessEntry32.szExeFile) =
UpperCase(ExeFileName))) then
Result := Integer(TerminateProcess(
OpenProcess(PROCESS_TERMINATE,BOOL(0),FProcessEntry32.th32ProcessID),0));
ContinueLoop := Process32Next(FSnapshotHandle, FProcessEntry32);
end;
CloseHandle(FSnapshotHandle);
end;
//但是对于服务程序,它会提示"拒绝访问".其实只要程序拥有Debug权限即可:
function EnablePrivilege(hToken: Cardinal; PrivName: string; bEnable: Boolean): Boolean;
var
TP: TOKEN_PRIVILEGES;
Dummy: Cardinal;
begin
TP.PrivilegeCount := 1;
LookupPrivilegeValue(nil, pchar(PrivName), TP.Privileges[0].Luid);
if bEnable then
TP.Privileges[0].Attributes := SE_PRIVILEGE_ENABLED
else TP.Privileges[0].Attributes := 0;
AdjustTokenPrivileges(hToken, False, TP, SizeOf(TP), nil, Dummy);
Result := GetLastError = ERROR_SUCCESS;
end;
function EnableDebugPrivilege: Boolean;
var
hToken: Cardinal;
begin
OpenProcessToken(GetCurrentProcess, TOKEN_ADJUST_PRIVILEGES, hToken);
result:=EnablePrivilege(hToken, 'SeDebugPrivilege', True);
CloseHandle(hToken);
end;
procedure TForm1.Button1Click(Sender: TObject);
begin
EnableDebugPrivilege;//提升权限
KillTask(edit1.Text);//关闭该服务程序.
end;
end.
~~~~~~~~~~~~~~~~~~~~~~~
是不是软件提升权限还不够?