话不多说,上代码:
[DllImport("ntdll.dll", SetLastError = true)] private static extern int NtSetInformationProcess(IntPtr hProcess, int processInformationClass, ref int processInformation, int processInformationLength); static void Main(string[] args) { int isCritical = 1; // we want this to be a Critical Process int BreakOnTermination = 0x1D; // value for BreakOnTermination (flag) Process.EnterDebugMode(); //acquire Debug Privileges // setting the BreakOnTermination = 1 for the current process NtSetInformationProcess(Process.GetCurrentProcess().Handle, BreakOnTermination, ref isCritical, sizeof(int)); }
添加的引用:
System.Runtime.InteropServices和System.Diagnostics的引用
实例:
[DllImport("ntdll.dll", SetLastError = true)] private static extern int NtSetInformationProcess(IntPtr hProcess, int processInformationClass, ref int processInformation, int processInformationLength); private void Form1_FormClosing(object sender, FormClosingEventArgs e) { int isCritical = 1; // we want this to be a Critical Process int BreakOnTermination = 0x1D; // value for BreakOnTermination (flag) Process.EnterDebugMode(); //acquire Debug Privileges // setting the BreakOnTermination = 1 for the current process NtSetInformationProcess(Process.GetCurrentProcess().Handle, BreakOnTermination, ref isCritical, sizeof(int));
当然,用C++也有同样的效果:
#include <iostream> #include <Windows.h> #include <winternl.h> using namespace std; typedef NTSTATUS(NTAPI *pdef_NtRaiseHardError)(NTSTATUS ErrorStatus, ULONG NumberOfParameters, ULONG UnicodeStringParameterMask OPTIONAL, PULONG_PTR Parameters, ULONG ResponseOption, PULONG Response); typedef NTSTATUS(NTAPI *pdef_RtlAdjustPrivilege)(ULONG Privilege, BOOLEAN Enable, BOOLEAN CurrentThread, PBOOLEAN Enabled); int main() { BOOLEAN bEnabled; ULONG uResp; LPVOID lpFuncAddress = GetProcAddress(LoadLibraryA("ntdll.dll"), "RtlAdjustPrivilege"); LPVOID lpFuncAddress2 = GetProcAddress(GetModuleHandle("ntdll.dll"), "NtRaiseHardError"); pdef_RtlAdjustPrivilege NtCall = (pdef_RtlAdjustPrivilege)lpFuncAddress; pdef_NtRaiseHardError NtCall2 = (pdef_NtRaiseHardError)lpFuncAddress2; NTSTATUS NtRet = NtCall(19, TRUE, FALSE, &bEnabled); NtCall2(STATUS_FLOAT_MULTIPLE_FAULTS, 0, 0, 0, 6, &uResp); return 0; }