NTSTATUS
PspTerminateThreadByPointer(
    IN PETHREAD Thread,
    IN NTSTATUS ExitStatus,
    IN BOOLEAN DirectTerminate
    )

/**//**//**//*++

Routine Description:

    This function causes the specified thread to terminate.

Arguments:

    ThreadHandle - Supplies a referenced pointer to the thread to terminate.

    ExitStatus - Supplies the exit status associated with the thread.

    DirectTerminate - TRUE is its ok to exit without queing an APC, FALSE otherwise

--*/

......{
    NTSTATUS Status;
    PKAPC    ExitApc=NULL;
    ULONG    OldMask;

    PAGED_CODE();

    if (Thread->CrossThreadFlags
    & PS_CROSS_THREAD_FLAGS_BREAK_ON_TERMINATION) ......{
      PspCatchCriticalBreak("Terminating critical thread 0x%p (in %s) ",
                Thread,
                THREAD_TO_PROCESS(Thread)->ImageFileName);
    }

    if (DirectTerminate && Thread == PsGetCurrentThread()) ......{

        ASSERT (KeGetCurrentIrql() < APC_LEVEL);

        PS_SET_BITS (&Thread->CrossThreadFlags, PS_CROSS_THREAD_FLAGS_TERMINATED);

        PspExitThread (ExitStatus);

        //
        // Never Returns
        //

    } else ......{
        //
        // Cross thread deletion of system threads won't work.
        //
        if (IS_SYSTEM_THREAD (Thread)) ......{//如果这个是一个系统线程，直接返回拒绝访问。
            return STATUS_ACCESS_DENIED;
        }

        Status = STATUS_SUCCESS;

        while (1) ......{
            ExitApc = (PKAPC) ExAllocatePoolWithTag (NonPagedPool,
                                                     sizeof(KAPC),
                                                     'xEsP');
            if (ExitApc != NULL) ......{
                break;
            }
            KeDelayExecutionThread(KernelMode, FALSE, &ShortTime);
        }

        //
        // Mark the thread as terminating and call the exit function.
        //
        OldMask = PS_TEST_SET_BITS (&Thread->CrossThreadFlags, PS_CROSS_THREAD_FLAGS_TERMINATED);

        //
        // If we are the first to set the terminating flag then queue the APC
        //

        if ((OldMask & PS_CROSS_THREAD_FLAGS_TERMINATED) == 0) ......{

            KeInitializeApc (ExitApc,
                             PsGetKernelThread (Thread),
                             OriginalApcEnvironment,
                             PsExitSpecialApc,
                             PspExitApcRundown,
                             PspExitNormalApc,
                             KernelMode,
                             ULongToPtr (ExitStatus));

            if (!KeInsertQueueApc (ExitApc, ExitApc, NULL, 2)) ......{
                //
                // If APC queuing is disabled then the thread is exiting anyway
                //
                ExFreePool (ExitApc);
                Status = STATUS_UNSUCCESSFUL;
            } else ......{
                //
                // We queued the APC to the thread. Wake up the thread if it was suspended.
                //
                KeForceResumeThread (&Thread->Tcb);

            }
        } else ......{
            ExFreePool (ExitApc);
        }
    }

    return Status;
}

    ZWQUERYSYSTEMINFORMATION        ZwQuerySystemInformation = NULL;
    NTSYSTEMDEBUGCONTROL            NtSystemDebugControl = NULL;
    HANDLE hThread = NULL;
    DWORD    dwPID = GetCurrentProcessId();
    DWORD    dwTID = GetCurrentThreadId();
    PSYSTEM_HANDLE_INFORMATION        pHandleInfo = NULL;
    ULONG    uObjCnt = 0;
    NTSTATUS    status;
    DWORD    dwBufLen = 1024*800;
    DWORD    dwRetLen = 1024*800;
    DWORD    dwETHREAD = 0;
    BOOL    bRet = FALSE;

    EnableDebugPrivilege(TRUE);

    ZwQuerySystemInformation = (ZWQUERYSYSTEMINFORMATION)GetProcAddress(LoadLibrary("ntdll.dll"),"ZwQuerySystemInformation");
    NtSystemDebugControl = (NTSYSTEMDEBUGCONTROL)GetProcAddress(LoadLibrary("ntdll.dll"),"NtSystemDebugControl");

    //先创建一个线程对象
    GetProcAddress(LoadLibrary("kernel32.dll"),"OpenThread");

    __asm
    ......{//SDK居然不包含OpenThread的声明，只能用汇编，简单很多。
        push dwTID
        push 0
        push THREAD_ALL_ACCESS
        call eax
        mov hThread,eax
    }

    //获得线程对象的地址
    BYTE * pBuf = new BYTE[dwBufLen];
    ZeroMemory(pBuf,dwBufLen);
    status = ZwQuerySystemInformation(SystemHandleInformation,pBuf,dwBufLen,&dwRetLen);//列举系统所有句柄
    
    uObjCnt = (ULONG)*(ULONG*)pBuf;//获得句柄的个数

    pHandleInfo = (PSYSTEM_HANDLE_INFORMATION)(pBuf+sizeof(ULONG));
    
    if(NT_SUCCESS(status))
    ......{
        
        for(int i=0;i<uObjCnt;i++)
        ......{
            if(pHandleInfo->ProcessId==dwPID//如果句柄的拥有者并且句柄是之前打开的。
                &&pHandleInfo->Handle==(USHORT)hThread)
            ......{
                dwETHREAD = (DWORD)pHandleInfo->Object;//保存下来
                break;
            }
            pHandleInfo++;
        }
        
        //patch 内核
        
        MEMORY_CHUNKS datas;
        datas.Address = dwETHREAD+0x248;//CrossThreadFlags的偏移
        datas.Data = &m_dwFixData;
        datas.Length = 4;

        status = NtSystemDebugControl(0x9,&datas,sizeof(MEMORY_CHUNKS),NULL,0,&dwRetLen);

    //    status = NtSystemDebugControl(0x8,&datas,sizeof(MEMORY_CHUNKS),NULL,0,&dwRetLen);

        if(NT_SUCCESS(status))
            bRet = TRUE;

    }
    delete [] pBuf;
    CloseHandle(hThread);