Miten tuhoaisin prosessit Visual Basicillä (VB6) joita en pysty tuhoamaan tehtävienhallinnasta (ei tarvittavia oikeuksia)?
Exploittaamalla jotain turva-aukkoa.
Moikka JoonasK!
kokeile tätä...
Dim Prosessit, Prosessi
'Projektiin referenssi:
'Microsoft WMI Scripting V1.2 Library
'C:\WINDOWS\system32\wbem\wbemdisp.TLB)
Set Prosessit = GetObject _
("winmgmts:{impersonationLevel=impersonate}") _
.InstancesOf("Win32_Process")
For Each Prosessi In Prosessit
  With Prosessi
    If LCase(.Name) = "joku.exe" Then
      .Kill()
    End If
  End With
Next
Set Prosessit = Nothing.Kill()
Syntax error, lisäsin referenssin.
EDIT: Löysin ratkaisun.
Sub TuhoaProsessi(nimi As String)
Dim Prosessi, Prosessit
Set Prosessit = GetObject _
    ("winmgmts:{impersonationLevel=impersonate}") _
    .InstancesOf("Win32_Process")
For Each Prosessi In Prosessit
    With Prosessi
        If LCase(.Name) = nimi Then
                On Error GoTo prosessia_ei_loydy
                Prosessi.Terminate
        End If
    End With
Next
MsgBox "Prosessi " & nimi & " sammutettu", vbOKOnly, "Prosessin tuhoaminen onnistui"
Exit Sub
prosessia_ei_loydy:
MsgBox "Prosessia " & nimi & " ei löytynyt", vbOKOnly, "Prosessin tuhoaminen epäonnistui"
Exit Sub
End SubToimii.
Pieni lisäys: Tämä toimii mutta ei sulje kaikkia prosesseja, tarkoitus olisi että voisi sulkea myös prosesseja joita ei pysty rajoitusten (ei järjestelmänvalvoja) takia.
No eihän se nyt tietenkään ole mahollista, ellei Windowsista sitten löydy tietoturva-aukkoa, joka moisen mahollistaa.
JoonasK kirjoitti:
Pieni lisäys: Tämä toimii mutta ei sulje kaikkia prosesseja, tarkoitus olisi että voisi sulkea myös prosesseja joita ei pysty rajoitusten (ei järjestelmänvalvoja) takia.
Pystyyks se sulkemaan niitä, jos käynnistät sen järjestelmänvalvojana?
Newb kirjoitti:
Pystyyks se sulkemaan niitä, jos käynnistät sen järjestelmänvalvojana?
Pystyy. Ja se on mahdollista ilman mitään tietoturva-aukkojakin. Siis pakottaa prosessi sammumaan.
JoonasK kirjoitti:
Ja se on mahdollista ilman mitään tietoturva-aukkojakin. Siis pakottaa prosessi sammumaan.
Ei ole, ellet ole prosessin omistaja tai järjestelmänvalvoja.
Eikös PostMessage:lla tai SendMessage:lla voi lähettää sille prosessille WM_QUIT,WM_CLOSE tai WM_DESTROY jonka pitäisi tuhota sen väkisin?
En tosin oo itse ihan varma miten se tehdään.
shell "taskkill /f /im ""softa.exe"""
Toimisko tollanen?
Jos ei niin toinen vaihtoehto on käyttää TerminateProcessia tai lähettää se WM_CLOSE suljettavalle prosessille SendMessagella.
Private Declare Function TerminateProcess Lib "kernel32" Alias "TerminateProcess" (ByVal hProcess As Long, ByVal uExitCode As Long) As Long
Sub TuhoaProsessi(nimi As String, method as Integer)
Dim Prosessi, Prosessit
Set Prosessit = GetObject _
    ("winmgmts:{impersonationLevel=impersonate}") _
    .InstancesOf("Win32_Process")
For Each Prosessi In Prosessit
    With Prosessi
        If LCase(.Name) = nimi Then
            If method = 1 Then
                'PostMessage app_hwnd, WM_QUIT, 0, vbNullString
                TerminateProcess Prosessi, 0
            ElseIf method = 2 Then
                Shell "taskkill /f /im " & nimi
            ElseIf method = 3 Then
                Prosessi.Terminate
            End If
        End If
    End With
Next
End SubKokeilin TuhoaProsessi "notepad.exe", 1 (eli TerminateProcess):
Object doesn't support this property or method
EDIT: Tämä
Public Declare Function TerminateProcess Lib "kernel32" Alias "TerminateProcess" (ByVal hProcess As Long, ByVal uExitCode As Long) As Long
on moduulissa.
Kokeilin TuhoaProsessi "notepad.exe", 2 (eli shell "taskkill /f /im"):
File not found
Googlesta löytyi TerminateProcessille esimerkki...
Private Type PROCESSENTRY32
  dwSize As Long
  cntUsage As Long
  th32ProcessID As Long
  th32DefaultHeapID As Long
  th32ModuleID As Long
  cntThreads As Long
  th32ParentProcessID As Long
  pcPriClassBase As Long
  dwFlags As Long
  szExeFile As String * 260
End Type
Private Type OSVERSIONINFO
  dwOSVersionInfoSize As Long
  dwMajorVersion As Long
  dwMinorVersion As Long
  dwBuildNumber As Long
  dwPlatformId As Long
  szCSDVersion As String * 128
End Type
Private Declare Function Process32First Lib "kernel32" (ByVal hSnapshot As Long, lppe As PROCESSENTRY32) As Long
Private Declare Function Process32Next Lib "kernel32" (ByVal hSnapshot As Long, lppe As PROCESSENTRY32) As Long
Private Declare Function CloseHandle Lib "Kernel32.dll" (ByVal Handle As Long) As Long
Private Declare Function OpenProcess Lib "Kernel32.dll" (ByVal dwDesiredAccessas As Long, ByVal bInheritHandle As Long, ByVal dwProcId As Long) As Long
Private Declare Function EnumProcesses Lib "psapi.dll" (ByRef lpidProcess As Long, ByVal cb As Long, ByRef cbNeeded As Long) As Long
Private Declare Function GetModuleFileNameExA Lib "psapi.dll" (ByVal hProcess As Long, ByVal hModule As Long, ByVal ModuleName As String, ByVal nSize As Long) As Long
Private Declare Function EnumProcessModules Lib "psapi.dll" (ByVal hProcess As Long, ByRef lphModule As Long, ByVal cb As Long, ByRef cbNeeded As Long) As Long
Private Declare Function CreateToolhelp32Snapshot Lib "kernel32" (ByVal dwFlags As Long, ByVal th32ProcessID As Long) As Long
Private Declare Function GetVersionEx Lib "kernel32" Alias "GetVersionExA" (lpVersionInformation As OSVERSIONINFO) As Long
Private Declare Function TerminateProcess Lib "kernel32" (ByVal hProcess As Long, ByVal uExitCode As Long) As Long
Private Const PROCESS_TERMINATE = &H1
Private Const VER_PLATFORM_WIN32_WINDOWS = 1
Private Const PROCESS_QUERY_INFORMATION = 1024
Private Const PROCESS_VM_READ = 16
Private Const TH32CS_SNAPPROCESS = &H2
Private Function CheckVersion() As Long
  Dim tOS As OSVERSIONINFO
  tOS.dwOSVersionInfoSize = Len(tOS)
  Call GetVersionEx(tOS)
  CheckVersion = tOS.dwPlatformId
End Function
Public Function GetEXEProcessID(ByVal sEXE As String) As Long
  Dim aPID() As Long
  Dim lProcesses As Long
  Dim lProcess As Long
  Dim lModule As Long
  Dim sName As String
  Dim iIndex As Integer
  Dim bCopied As Long
  Dim lSnapShot As Long
  Dim tPE As PROCESSENTRY32
  Dim bDone As Boolean
  If CheckVersion() = VER_PLATFORM_WIN32_WINDOWS Then
    'Windows 9x
    'Create a SnapShot of the Currently Running Processes
    lSnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0)
    If lSnapShot < 0 Then Exit Function
    tPE.dwSize = Len(tPE)
    'Buffer the First Processes Info..
    bCopied = Process32First(lSnapShot, tPE)
    Do While bCopied
      'While there are Processes List them..
      sName = Left$(tPE.szExeFile, InStr(tPE.szExeFile, Chr(0)) - 1)
      sName = Mid(sName, InStrRev(sName, "\") + 1)
      If InStr(sName, Chr(0)) Then
        sName = Left(sName, InStr(sName, Chr(0)) - 1)
      End If
      bCopied = Process32Next(lSnapShot, tPE)
      If StrComp(sEXE, sName, vbTextCompare) = 0 Then
        GetEXEProcessID = tPE.th32ProcessID
        Exit Do
      End If
    Loop
  Else
    'Windows NT
    'The EnumProcesses Function doesn't indicate how many Process there are,
    'so you need to pass a large array and trim off the empty elements
    'as cbNeeded will return the no. of Processes copied.
    ReDim aPID(255)
    Call EnumProcesses(aPID(0), 1024, lProcesses)
    lProcesses = lProcesses / 4
    ReDim Preserve aPID(lProcesses)
    For iIndex = 0 To lProcesses - 1
      'Get the Process Handle, by Opening the Process
      lProcess = OpenProcess(PROCESS_QUERY_INFORMATION Or PROCESS_VM_READ, 0, aPID(iIndex))
      If lProcess Then
        'Just get the First Module, all we need is the Handle to get
        'the Filename..
        If EnumProcessModules(lProcess, lModule, 4, 0&) Then
          sName = Space(260)
          Call GetModuleFileNameExA(lProcess, lModule, sName, Len(sName))
          If InStr(sName, "\") > 0 Then
            sName = Mid(sName, InStrRev(sName, "\") + 1)
          End If
          If InStr(sName, Chr(0)) Then
            sName = Left(sName, InStr(sName, Chr(0)) - 1)
          End If
          If StrComp(sEXE, sName, vbTextCompare) = 0 Then
            GetEXEProcessID = aPID(iIndex)
            bDone = True
          End If
        End If
        'Close the Process Handle
        lRet = CloseHandle(lProcess)
        If bDone Then Exit For
      End If
    Next
  End If
End Function
Public Function TerminateEXE(ByVal sEXE As String) As Boolean
  Dim lPID As Long
  Dim lProcess As Long
  lPID = GetEXEProcessID(sEXE)
  If lPID = 0 Then Exit Function
  lProcess = OpenProcess(PROCESS_TERMINATE, 0, lPID)
  Call TerminateProcess(lProcess, 0&)
  Call CloseHandle(lProcess)
  TerminateEXE = True
End FunctionYllä oleva koodi johonkin moduuliin.
Ja tota voi käyttää esim. näin:
Private sub command1_Click() TerminateExe "prosessi.exe" End sub
Edit. huom.
lainaus:
The terms terminate and kill should be used carefully; they usually imply unconditional and immediate removal from the system, as is done by TerminateProcess, which should be avoided. Many problems can be caused by TerminateProcess, including loss of data.
Any time someone says they want to terminate a process but they are not clear about the necessity to actually terminate a process, I ask for clarification.
The first solution that should be tried/suggested is to simply send a WM_CLOSE message to the application's main window. The WM_CLOSE message is essentially the equivalent to clicking the "X" at the top right of the window.
Use of TerminateProcess should be the last resort. It should never be used if there is another way to get the application to end.
Ei tuhoa kaikkia prosesseja, kokeilin tuhota NetControl 2-serveriä. :/
JoonasK kirjoitti:
Ei tuhoa kaikkia prosesseja, kokeilin tuhota NetControl 2-serveriä. :/
Jossei sitä noin voi tuhota, niin turha edes yrittää.
JoonasK kirjoitti:
Pystyy. Ja se on mahdollista ilman mitään tietoturva-aukkojakin. Siis pakottaa prosessi sammumaan.
Et voi sammuttaa prosessia johon sinulla ei ole oikeuksia PISTE.
Miten olisi.. poistaa/disabloida ohjelma jota et halua käynnistyvän?
Tuolla on 3 sivuinen opas Windowsin palveluihin ja optimointiin:
http://www.overclockersclub.com/guides/
Paljon lisää aiheesta googlella. "disable winxp services" mikäli tämä on ollenkaan mitä hait?
Minkä prosessin yleensä haluaisit tuhota?
Aihe on jo aika vanha, joten et voi enää vastata siihen.