ring3下的reload，你懂得！

Peace4once

代码是偷的~~偷了大部分wrk~~

DWORD GetProcessIdToKill( LPCTSTR szProcName )
{
  PROCESSENTRY32 pe;   
  DWORD dwRet;
  BOOL bInit = FALSE;
  HANDLE hProcess;

  ReGetReBuildFuncBase((PULONG)&ReCreateToolhelp32Snapshot,"kernel32.dll","CreateToolhelp32Snapshot");
  ReGetReBuildFuncBase((PULONG)&ReProcess32First,"kernel32.dll","Process32First");
  ReGetReBuildFuncBase((PULONG)&ReProcess32Next,"kernel32.dll","Process32Next");
  ReGetReBuildFuncBase((PULONG)&ReOpenProcess,"kernel32.dll","OpenProcess");
  ReGetReBuildFuncBase((PULONG)&ReTerminateProcess,"kernel32.dll","TerminateProcess");
  ReGetReBuildFuncBase((PULONG)&ReCloseHandle,"kernel32.dll","CloseHandle");
  if (ReCreateToolhelp32Snapshot &&
    ReProcess32First &&
    ReProcess32Next &&
    ReOpenProcess &&
    ReTerminateProcess &&
    ReCloseHandle)
  {
    bInit = TRUE;
  }
  if (!bInit)
  {
    printf("init failed\n%x\n%x\n%x\n%x\n%x\n",ReCreateToolhelp32Snapshot,ReProcess32First,ReProcess32Next,ReOpenProcess,ReTerminateProcess,ReCloseHandle);
    return 0;
  }
  HANDLE hSP = ReCreateToolhelp32Snapshot( TH32CS_SNAPPROCESS, 0 );
  if ( hSP )
  {
    pe.dwSize = sizeof( pe );

    for (dwRet = ReProcess32First(hSP, &pe );
      dwRet;
      dwRet = ReProcess32Next(hSP, &pe ) )
    {
      if (_strcmpi(pe.szExeFile,szProcName) == 0)
      {
        hProcess = ReOpenProcess(PROCESS_TERMINATE,FALSE,pe.th32ProcessID);
        if (hProcess)
        {
          printf("kill pid: %d\r\n",pe.th32ProcessID);
          ReTerminateProcess(hProcess,-1);
          ReCloseHandle(hProcess);   //结束

          return TRUE;
        }
      }
    }
    ReCloseHandle( hSP );
  }
  return FALSE;
}
int main(int argc, char *argv[])
{
  char lpModule[100] = {0};

  if (!InitDllModule()){
    printf("rebuild dll module failed\n");
    return 0;
  }
  printf("\n\ncall test\n\n");

  ReGetReBuildFuncBase((PULONG)&ReGetModuleFileName,"kernel32.dll","GetModuleFileNameA");
  if (ReGetModuleFileName){

    //for test
    ReGetModuleFileName(NULL,lpModule,sizeof(lpModule));
    printf("ReGetModuleFileName:0x%08x\n%s\n",ReGetModuleFileName,lpModule);

  }
  ReGetReBuildFuncBase((PULONG)&ReNtOpenProcess,"ntdll.dll","NtOpenProcess");
  if (ReNtOpenProcess){
    //for test
    HANDLE hProcess;
    ReNtOpenProcess(&hProcess,0,0,0);
    printf("ReNtOpenProcess:0x%08x\n",ReNtOpenProcess);
  }
  
  //for test
  GetProcessIdToKill("taskmgr.exe");

  //导入user32和shell32
  SendMessage(0,0,0,0);
  ShellExecute(0,0,0,0,0,0);
  return 0;
}