Process protection--crossthreadflags Flag bit

Principle:

1. Set the thread crossthreadflags flag bit for all threads of the process to terminated or system.

Effect: Task Manager, Wsyscheck,icesword cannot end the process.

However, PCH unter can end a protected process. However, Pchunter cannot end a protected thread in a normal way, and must use the force end thread to end the thread.

Code:

VOID Setthreadflagtoterminatedbythreadid (ulong dwthreadid) {ulong Ulflagoffset; NTSTATUS status = status_unsuccessful; Pulong PFlag; Pethread Ethead; HANDLE Threadhandle;__try{threadhandle = (HANDLE) Dwthreadid;ulflagoffset = Getcrossthreadflagoffset ();//dprintf ("[ Protectprocess]getcrossthreadflagoffset:0x%08x\r\n ", ulflagoffset); status = Pslookupthreadbythreadid (threadHandle , &ethead); if (! Nt_success (status) {dprintf ("Pslookupthreadbythreadid errorid:0x%08x, tid:0x%08x\r\n", status, dwThreadID); return status;} dprintf ("ethread:0x%08x\n", ethead);p flag = (ulong*) ((Puchar) Ethead + ulflagoffset);//dprintf ("Ulflag address:0x%0 8X value:0x%08x\n ", PFlag, *pflag); *pflag |= ps_cross_thread_flags_terminated;dprintf (" New Ulflag address:0x%08x value : 0x%08x\n ", PFlag, *pflag);} __except (exception_execute_handler) {dprintf ("EXCEPTION on set thread Cross flags!"); return status;}}

RING3 Program and RING0 program:

http://download.csdn.net/detail/xiaocaiju/8192897

Process protection--crossthreadflags Flag bit