Playing with verbs II: using remote thread Ring3 to kill verbs (severe)

Recently, we have been testing various major targets and found a serious problem with the micropoints. In fact, the micropoints are the inline hook NtCreateThread function, as shown below:

Kd> u 805c6ad0

Nt! NtCreateThread:

805c6ad0 e929714079JmpMp110003! F0042 + 0x642 (f99cdbfe)

805c6ad5 90Nop

805c6ad6 90Nop

805c6ad7 e80416f7ffCallNt! _ SEH_prolog (805380e0)

805c6adc 8365fc00AndDword ptr [ebp-4], 0

805c6ae0 64a124010000MovEax, dword ptr fs: [00000124 h]

805c6ae6 8945e0MovDword ptr [ebp-20h], eax

805c6ae9 80b8400000000 CmpByte ptr [eax + 140 h], 0

In addition, the function for ending the process is also hooked by multiple inline entries, as shown below:

Kd> u 805c8694

Nt! PspTerminateProcess + 0x52:

805c8694 e80f654079CallMp110003! F0045 + 0xaa8 (f99ceba8)

805c8699 57PushEdi

805c869a 56PushEsi

805c869b e85e4f0000CallNt! PsGetNextProcessThread (805cd5fe)

805c86a0 8bf8MovEdi, eax

805c86a2 85ffTestEdi, edi

805c86a4 75eaJneNt! PspTerminateProcess + 0x4e (805c8690)

805c86a6 3986bc000000CmpDword ptr [esi + 0BCh], eax

Kd> u 805c85c8

Nt! NtTerminateProcess + 0x100:

805c85c8 e8db654079CallMp110003! F0045 + 0xaa8 (f99ceba8)

805c85cd eb11JmpNt! NtTerminateProcess + 0x118 (805c85e0)

805c85cf 817d0c04000140 CmpDword ptr [ebp + 0Ch], 40010004 h

805c85d6 7508JneNt! NtTerminateProcess + 0x118 (805c85e0)

805c85d8 6a00Push0

805c85da 53PushEbx

805c85db e8d4010700CallNt! DbgkClearProcessDebugObject (806387b4)

805c85e0 817d0822010000 CmpDword ptr [ebp + 8], 122 h

Kd> u 805c8598

Nt! NtTerminateProcess + 0xd0:<