ULONG getPspTerminateThreadByPointerAddress()
{
    UNICODE_STRING  FunName;
    UCHAR FeatureCode[2]={0x50,0xe8};//特征码push    eax call XXXX
    ULONG   FeatureAddress = 0; //找到的特征码的首地址
    ULONG   FunAddress = 0;
    ULONG   RetAddress = 0;//最终返回
    ULONG   FunAdd = 0;

    RtlInitUnicodeString(&FunName,L"PsTerminateSystemThread");
    FunAdd =(ULONG) MmGetSystemRoutineAddress(&FunName);

    DbgPrint("PsTerminateSystemThread -- %08X",FunAdd);
    //首先获取PsTerminateSystemThread这个函数地址.其实这个就是直接调用的PspTerminateThreadByPointer
    //这个函数本身非常短小,所以通过搜索特征.定位call 然后将call的地址拿出来并进行运算即可

    FeatureAddress = SearchFeatureCodeForAddress(FunAdd,FeatureCode,2,0x27);
    //PsTerminateSystemThread函数需要搜索的长度0x27

    DbgPrint("FeatureAddress -- %08X",FeatureAddress);

    RtlCopyMemory(&FunAddress,(PULONG)(FeatureAddress + 2),4);

    //目标地址=下条指令的地址+机器码E8后面所跟的32位数
    //注意，机器码E8后面所跟的32位数 是 little-endian 格式的，低8位在前，高8位在后
    RetAddress = FunAddress + ( FeatureAddress + 2 + 4 );

    return RetAddress;
}

ULONG SearchFeatureCodeForAddress(ULONG StartAddress,PUCHAR FeatureCode,int FeatureCodeSize,int Search_MaxLength)
{
    PUCHAR Start_scan = (PUCHAR)StartAddress;
    BOOLEAN IsTrue = FALSE;
    ULONG Real_address = 0;
    int i,fi;

    for (i = 0; i < Search_MaxLength; i++)
    {
        if (Start_scan[i] == FeatureCode[0])
        {
            for (fi = 0; fi < FeatureCodeSize; fi++)
            {
                if (Start_scan[i + fi] != FeatureCode[fi])
                {
                    //任何一个字节不同,都标记失败,跳出
                    IsTrue = FALSE;
                    break;
                }else
                {
                    if (fi == FeatureCodeSize-1)
                    {
                        IsTrue = TRUE;
                        //指定长度的字节都相同.认为找到了
                    }
                }
            }

            if (IsTrue == TRUE)
            {
                Real_address = (ULONG)&Start_scan[i];
                break;
            }
        }
    }
    return Real_address;
}