杀掉本地进程其实很简单,取得进程ID后,调用OpenProcess函数打开进程句柄,然后调用TerminateProcess函数就可以杀掉进程了。有些情况下并不能直接打开进程句柄,例如WINLOGON等系统进程,因为权限不够。这个时候我们就得先提升自己的进程的权限了。提升权限过程也不复杂,先调用GetCurrentProcess函数取得当前进程的句柄,然后调用OpenProcessToken打开当前进程的访问令牌,接着调用LookupPrivilegeValue函数取得你想提升的权限的值,最后调用AdjustTokenPrivileges函数给当前进程的访问令牌增加权限就可以了。一般有了SeDebugPrivilege特权后,就可以杀掉除Idle外的所有进程了。
FQz?3w&ia OK!那如何杀掉远程进程呢?说起来有点复杂,但其实也不难。
zSEs? <1>与远程系统建立IPC连接
<A5]]{9 + <2>在远程系统的系统目录admin$\system32中写入一个文件killsrv.exe
+|iYg/2 <3>调用函数OpenSCManager打开远程系统的Service Control Manager[SCM]
AK!hK>u` <4>调用函数CreateService在远程系统创建一个服务,服务指向的程序是在<2>中写入的程序killsrv.exe
}n_p$g[Nj/ <5>调用函数StartService启动刚才创建的服务,把想杀掉的进程的ID作为参数传递给它
;Q;[*B=kE <6>服务启动后,killsrv.exe运行,杀掉进程
wC_l@7t <7>清场
epHJ@ W@# 嗯!这样看来,我们需要两个程序了。Killsrv.exe的源代码如下:
ulFzZHJ /***********************************************************************
wXMDh$ Module:Killsrv.c
$~0Q@): Date:2001/4/27
WE6a' Author:ey4s
/iC;%r1L Http://www.ey4s.org v1JS~uDz ***********************************************************************/
7dG79H #include
*OJ/V O #include
-|k)tvAm #include "function.c"
LQ11ba #define ServiceName "PSKILL"
J5p"7bc 3.d"rl SERVICE_STATUS_HANDLE ssh;
Y9=K]GB
SERVICE_STATUS ss;
s=6}%%q6 /////////////////////////////////////////////////////////////////////////
b-U
eIjX void ServiceStopped(void)
:<Y}l-x {
[D-Q'"'A ss.dwServiceType=SERVICE_WIN32_OWN_PROCESS|SERVICE_INTERACTIVE_PROCESS;
9^"b*&>P ss.dwCurrentState=SERVICE_STOPPED;
g"s$}5{8: ss.dwControlsAccepted=SERVICE_ACCEPT_STOP;
,#FLM` ss.dwWin32ExitCode=NO_ERROR;
9E2j! ss.dwCheckPoint=0;
xkNyvqcw ss.dwWaitHint=0;
Rlnbdb;!k SetServiceStatus(ssh,&ss);
1OLqL return;
?bZovRx }
\!vN /////////////////////////////////////////////////////////////////////////
gWABY%!} void ServicePaused(void)
v~3B:k:?l {
3f" %G\ ss.dwServiceType=SERVICE_WIN32_OWN_PROCESS|SERVICE_INTERACTIVE_PROCESS;
vK7\JZ> ss.dwCurrentState=SERVICE_PAUSED;
*-W#G}O0 ss.dwControlsAccepted=SERVICE_ACCEPT_STOP;
n+@F`]Ke ss.dwWin32ExitCode=NO_ERROR;
(&|_quP7O ss.dwCheckPoint=0;
@E( 7V(m/ ss.dwWaitHint=0;
HoV^Y6 SetServiceStatus(ssh,&ss);
d)cOhZy return;
'{I_\~* }
=deMd`=J void ServiceRunning(void)
TD[EQ {
YjF|XPv+ l ss.dwServiceType=SERVICE_WIN32_OWN_PROCESS|SERVICE_INTERACTIVE_PROCESS;
|7,L`utp ss.dwCurrentState=SERVICE_RUNNING;
LE5.b]tv2 ss.dwControlsAccepted=SERVICE_ACCEPT_STOP;
\^( 0B8|w ss.dwWin32ExitCode=NO_ERROR;
9a\nszwa ss.dwCheckPoint=0;
JO=[YoTr ss.dwWaitHint=0;
D jk C SetServiceStatus(ssh,&ss);
Uz cx6sw return;
2%*MW"Q }
] Z8Vj7~ /////////////////////////////////////////////////////////////////////////
b2 _Yu^ void WINAPI servier_ctrl(DWORD Opcode)//服务控制程序
Sxdsv9w {
p4IZ
switch(Opcode)
t}IkK=f {
ZyOv.,y case SERVICE_CONTROL_STOP://停止Service
dm-pxE " ServiceStopped();
/>'V!iWyz break;
;.xoN|Per case SERVICE_CONTROL_INTERROGATE:
J q{7R SetServiceStatus(ssh,&ss);
}X
GEX:1K break;
3nT
Z)L } }
\s3]_1F;t return;
*
tCS }
JN^&S //////////////////////////////////////////////////////////////////////////////
SN4Q))dAU //杀进程成功设置服务状态为SERVICE_STOPPED
`%+ mO88o //失败设置服务状态为SERVICE_PAUSED
]E =Iu //
*Av"JAX void WINAPI ServiceMain(DWORD dwArgc,LPTSTR *lpszArgv)
&g2 Eptx# {
G}5 #l ssh=RegisterServiceCtrlHandler(ServiceName,servier_ctrl);
@
'@:sM_ if(!ssh)
Y(cN}44 {
5es[Ph|K5 ServicePaused();
yc|VJ2R* return;
1@u2im-O }
k = ?h~n0M ServiceRunning();
WI]o cF Sleep(100);
^[%%r3"$C //注意,argv[0]为此程序名,argv[1]为pskill,参数需要递增1
V8eB$in //argv[2]=target,argv[3]=user,argv[4]=pwd,argv[5]=pid
S'oGt&Z< if(KillPS(atoi(lpszArgv[5])))
OD']: ServiceStopped();
$$:ZX else
tXJUvish ServicePaused();
BCe_@ return;
G'YH6x, }
VG/3xR&y /////////////////////////////////////////////////////////////////////////////
UhIDRR void main(DWORD dwArgc,LPTSTR *lpszArgv)
K)TrZ 2 {
~|wbP6</:- SERVICE_TABLE_ENTRY ste[2];
#:T-hRu ste[0].lpServiceName=ServiceName;
hOhS) ste[0].lpServiceProc=ServiceMain;
Kwc6mlw~M ste[1].lpServiceName=NULL;
VqL.iZ- ste[1].lpServiceProc=NULL;
+[SgO}sF StartServiceCtrlDispatcher(ste);
2pdvWWh3l return;
pP(XIC }
cyxuK*x< /////////////////////////////////////////////////////////////////////////////
E}%hz*Q)( function.c中有两个函数,一个是提升权限的,一个是提供进程ID,杀进程的。代码如
5[j`6l 下:
T~h5B(J; /***********************************************************************
"c}@V*cO<d Module:function.c
P/&]?f0/ Date:2001/4/28
-,K! Author:ey4s
q80S[au Http://www.ey4s.org ]*7Y~dO ***********************************************************************/
iNwqF0 #include
<b/~.$a' ////////////////////////////////////////////////////////////////////////////
FI"`DMb} BOOL SetPrivilege(HANDLE hToken,LPCTSTR lpszPrivilege,BOOL bEnablePrivilege)
s1?[7yC {
p4p@^@<>X TOKEN_PRIVILEGES tp;
~b{Gz6u> LUID luid;
;[RZ0Uy= nx0K$Ptq if(!LookupPrivilegeValue(NULL,lpszPrivilege,&luid))
%e*@CbO$ {
<0S=,! printf("\nLookupPrivilegeValue error:%d", GetLastError() );
S*AERm return FALSE;
fwzb!"!.@ }
AkOO)0 tp.PrivilegeCount = 1;
\.mI tp.Privileges[0].Luid = luid;
<AJ97MLcc if (bEnablePrivilege)
tGB@$UmfU tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
:$MG*/Q else
*%KKNT'* tp.Privileges[0].Attributes = 0;
+l=r#JF // Enable the privilege or disable all privileges.
m Z1)wH , AdjustTokenPrivileges(
%LYnxo7#C hToken,
xq"Jy=4Q* FALSE,
#97h6m? &tp,
Fs[aa#v4B sizeof(TOKEN_PRIVILEGES),
VbBPB5 $q (PTOKEN_PRIVILEGES) NULL,
u{["50~ (PDWORD) NULL);
]
}f9JNf$ // Call GetLastError to determine whether the function succeeded.
Pz$R(TV if (GetLastError() != ERROR_SUCCESS)
q\\gpCgp {
vFEQ7qI printf("AdjustTokenPrivileges failed: %u\n", GetLastError() );
/ g 2b return FALSE;
IHRGw }
kA7mLrON return TRUE;
IKie1!ZU{" }
cyJG8f ////////////////////////////////////////////////////////////////////////////
}^B6yWUN BOOL KillPS(DWORD id)
9)VF 1LD {
-GLMmZJt HANDLE hProcess=NULL,hProcessToken=NULL;
l3 DYg BOOL IsKilled=FALSE,bRet=FALSE;
1#1 riM - __try
u+{a8= {
i1RiGS 3P;>XGCxZ if(!OpenProcessToken(GetCurrentProcess(),TOKEN_ALL_ACCESS,&hProcessToken))
dK>7fy;mv {
trE{ FT printf("\nOpen Current Process Token failed:%d",GetLastError());
ZcYh) HD __leave;
]r_;dY a }
aM4k *|H? //printf("\nOpen Current Process Token ok!");
9(":,M(/o if(!SetPrivilege(hProcessToken,SE_DEBUG_NAME,TRUE))
{&Q9"C {
<id}<H __leave;
1{P'7IEj }
s=[h?kB printf("\nSetPrivilege ok!");
F`9]=T0 U!Ek' if((hProcess=OpenProcess(PROCESS_ALL_ACCESS,FALSE,id))==NULL)
H:"maS\I {
VE8;sGaJ printf("\nOpen Process %d failed:%d",id,GetLastError());
0@AAulRl __leave;
`=7j$#6U }
;j2vHU#q- //printf("\nOpen Process %d ok!",id);
NzNA>[$[ if(!TerminateProcess(hProcess,1))
aN(|'uO@ {
qoAj]
") printf("\nTerminateProcess failed:%d",GetLastError());
c_elShK8# __leave;
MTUn3;c/ }
6d+p7x IsKilled=TRUE;
Afk$?wkL }
yV^s,P1 __finally
Uk\Id~xLV {
H<1WbM:w if(hProcessToken!=NULL) CloseHandle(hProcessToken);
S6[v;{xJ if(hProcess!=NULL) CloseHandle(hProcess);
>|;aIa@9 }
EAeqLtFqs return(IsKilled);
|<O9Sb_ }
t:fFU1x //////////////////////////////////////////////////////////////////////////////////////////////
Q?X>E3=U OK!服务端的程序已经好了。接下来还需要一个客户端。如果通过在客户端运行的时候,把killsrv.exe COPY到远程系统上,那么就需要提供两个exe文件给用户,这样显得不是很专业,呵呵。不如我们就把killsrv.exe的二进制码作为buff保存在客户端吧,这样在运行的时候,我们直接把buff中的内容写过去,这样提供给用户一个exe文件就可以了。Pskill.c的源代码如下:
]KJj6xn /*********************************************************************************************
R i^[i}
ModulesKill.c
tr7<]Hm: Create:2001/4/28
i E CrI3s Modify:2001/6/23
~/*MY Author:ey4s
g(4xC7xK6 Http://www.ey4s.org 1T[et- PsKill ==>Local and Remote process killer for windows 2k
(64yg **************************************************************************/
+5XpzZ{#Wa #include "ps.h"
/B}lO0]: #define EXE "killsrv.exe"
q/n,,! #define ServiceName "PSKILL"
Z>
r^SWL 5#K4bA #pragma comment(lib,"mpr.lib")
%AQIGBcgL //////////////////////////////////////////////////////////////////////////
$1v&azM. //定义全局变量
J(6oL SERVICE_STATUS ssStatus;
i'\T R|qd SC_HANDLE hSCManager=NULL,hSCService=NULL;
4rrSb* BOOL bKilled=FALSE;
/d%=E char szTarget[52]=;
B7!3-1<k> //////////////////////////////////////////////////////////////////////////
!o$!Fr c BOOL ConnIPC(char *,char *,char *);//建立IPC连接函数
aE2.L;Tk? BOOL InstallService(DWORD,LPTSTR *);//安装服务函数
t]-5 ]oI BOOL WaitServiceStop();//等待服务停止函数
[p<w._b i BOOL RemoveService();//删除服务函数
^yOZArc'r /////////////////////////////////////////////////////////////////////////
4R\Hpt int main(DWORD dwArgc,LPTSTR *lpszArgv)
{D=@n4JO {
f;b[w BOOL bRet=FALSE,bFile=FALSE;
,N0#!<}4 char tmp[52]=,RemoteFilePath[128]=,
/i77 szUser[52]=,szPass[52]=;
#f+$Ddg* HANDLE hFile=NULL;
=kuMWaD DWORD i=0,dwIndex=0,dwWrite,dwSize=sizeof(exebuff);
QqU!Najf !/wtYI-` //杀本地进程
mrw=T. if(dwArgc==2)
*M"}z {
Y0X-Zqk' if(KillPS(atoi(lpszArgv[1])))
z[;z>8|c printf("\nLoacl Process %s have beed killed!",lpszArgv[1]);
k5T,990 else
/3{b%0Aa printf("\nLoacl Process %s can't be killed!ErrorCode:%d",
hvaSH69*m lpszArgv[1],GetLastError());
:ijAqfX return 0;
"
W|%~h }
~sXcnxLz //用户输入错误
)+6MK(<" else if(dwArgc!=5)
->V<DZK {
y`=]T>X&x printf("\nPSKILL ==>Local and Remote Process Killer"
S;-
LIv "\nPower by ey4s"
ctGL-kp "\nhttp://www.ey4s.org 2001/6/23"
GN2Sn`; "\n\nUsage:%s <==Killed Local Process"
G
nG>7f[v "\n %s <==Killed Remote Process\n",
qo|WXwP2 lpszArgv[0],lpszArgv[0]);
=y-@AU8 return 1;
$b mLu=9 }
,KFapz! //杀远程机器进程
tdu$pC6 strncpy(szTarget,lpszArgv[1],sizeof(szTarget)-1);
p }~qf strncpy(szUser,lpszArgv[2],sizeof(szUser)-1);
% oo2/aF strncpy(szPass,lpszArgv[3],sizeof(szPass)-1);
pJtex^{!: %ALwz[~] //将在目标机器上创建的exe文件的路径
1{JV}O sprintf(RemoteFilePath,"\\%s\admin$\system32\%s",szTarget,EXE);
;&)-;l7M __try
WILMH`
{
>=-(UA //与目标建立IPC连接
hr)B[<9 if(!ConnIPC(szTarget,szUser,szPass))
aYSCw3C< {
t)}scf&^x printf("\nConnect to %s failed:%d",szTarget,GetLastError());
;-qO'V:; return 1;
~W-PD }
Uw7h=UQh printf("\nConnect to %s success!",szTarget);
~
(jKz}'~U //在目标机器上创建exe文件
MpR2]k#n< HKUn`ng hFile=CreateFile(RemoteFilePath,GENERIC_ALL,FILE_SHARE_READ|FILE_SHARE_WRIT
b"{'T]"*j E,
N=7pK&NHSG NULL,CREATE_ALWAYS,FILE_ATTRIBUTE_NORMAL,NULL);
k-^mIJo} if(hFile==INVALID_HANDLE_VALUE)
5f 5f0|ok {
:w^Ed%>y7 printf("\nCreate file %s failed:%d",RemoteFilePath,GetLastError());
#e$5d>j( __leave;
*vwbgJG! * }
73\JwOn~ //写文件内容
&eX!#nQ_. while(dwSize>dwIndex)
|Ur"&
Z{ {
{fjdr XY3v_5~/1F if(!WriteFile(hFile,&exebuff[dwIndex],dwSize-dwIndex,&dwWrite,NULL))
ZNvEW {
"9Q40w\ printf("\nWrite file %s
V:
TM] failed:%d",RemoteFilePath,GetLastError());
@W"KVPd __leave;
z+n,uHs }
Jh!I:;/ dwIndex+=dwWrite;
)`(p9@,V }
#$8% w //关闭文件句柄
",KCCis CloseHandle(hFile);
$cU!m(SILQ bFile=TRUE;
$arK( //安装服务
#;2n;.a if(InstallService(dwArgc,lpszArgv))
!'9Feoez {
CmoE_8U> //等待服务结束
v: OR if(WaitServiceStop())
R[hzMU}KB
{
4J/}]Dr5 //printf("\nService was stoped!");
7\ s"o&G }
>]vlkA( else
2OVRf0.R~ {
)x=1]T>v"' //printf("\nService can't be stoped.Try to delete it.");
Evg_q> }
Eu@huN*/ Sleep(500);
Oagsoik //删除服务
c2'Lfgx4 RemoveService();
&keR~~/ }
eEv@}1~ }
`ux{;4q __finally
0?:} P {
{ix?Brq/ //删除留下的文件
9 %I?).5 if(bFile) DeleteFile(RemoteFilePath);
r
w2arx //如果文件句柄没有关闭,关闭之~
FW G6uKv if(hFile!=NULL) CloseHandle(hFile);
3@$,s~+ 3 //Close Service handle
VoWNW if(hSCService!=NULL) CloseServiceHandle(hSCService);
jk [1{I/ //Close the Service Control Manager handle
_n50C"X=&( if(hSCManager!=NULL) CloseServiceHandle(hSCManager);
sg3OL/" //断开ipc连接
T^k7o^N> wsprintf(tmp,"\\%s\ipc$",szTarget);
9Hb6nm WNetCancelConnection2(tmp,CONNECT_UPDATE_PROFILE,TRUE);
tne ST. if(bKilled)
L"1}V printf("\nProcess %s on %s have been
/)}q Xx& killed!\n",lpszArgv[4],lpszArgv[1]);
($; 77fPR else
`-J%pEIza printf("\nProcess %s on %s can't be
ZJzt~
H killed!\n",lpszArgv[4],lpszArgv[1]);
afuOeZP }
deV
8 return 0;
'mFqEn }
Z8@J`0x //////////////////////////////////////////////////////////////////////////
xRzFlay8 BOOL ConnIPC(char *RemoteName,char *User,char *Pass)
Y4`}y-'d {
jZ~n[
f+Q NETRESOURCE nr;
2q=AEv/ char RN[50]="\\";
PGhY>$q>b bB1UZ O strcat(RN,RemoteName);
Vr`R>S,- strcat(RN,"\ipc$");
NflD/q/ L \F/hMXDlJ nr.dwType=RESOURCETYPE_ANY;
x7!L{(E3 nr.lpLocalName=NULL;
%\dz
m-d(C nr.lpRemoteName=RN;
( u\._Gwsx nr.lpProvider=NULL;
%InA+5s` c4^ks&)' if(WNetAddConnection2(&nr,Pass,User,FALSE)==NO_ERROR)
g"p%C:NN return TRUE;
4~Vx3gEV: else
=JK@z return FALSE;
g9}DnCT*. }
/_AnP /////////////////////////////////////////////////////////////////////////
4C61GB?Vy BOOL InstallService(DWORD dwArgc,LPTSTR *lpszArgv)
NV72 {
irFMmI b BOOL bRet=FALSE;
*rs5]U< __try
c1k/UcEcg~ {
M3c$=> //Open Service Control Manager on Local or Remote machine
e.7EU hSCManager=OpenSCManager(szTarget,NULL,SC_MANAGER_ALL_ACCESS);
IEsEdw]aZE if(hSCManager==NULL)
M/>7pZW {
P2BWuhF printf("\nOpen Service Control Manage failed:%d",GetLastError());
|,gc_G __leave;
2Mc3|T4)U }
ODNM+#}` //printf("\nOpen Service Control Manage ok!");
pN:Kdi //Create Service
bpJ(XN}E hSCService=CreateService(hSCManager,// handle to SCM database
;g5m0l5 ServiceName,// name of service to start
-:Da&V ServiceName,// display name
0WZ_7C? SERVICE_ALL_ACCESS,// type of access to service
-Ta9 pxZk SERVICE_WIN32_OWN_PROCESS,// type of service
8dZSi SERVICE_AUTO_START,// when to start service
LsqA**= SERVICE_ERROR_IGNORE,// severity of service
iNtaDX|%/ failure
JQ8fdP A EXE,// name of binary file
r@h5w_9 NULL,// name of load ordering group
#~}nFY. NULL,// tag identifier
Wuc S:8#| NULL,// array of dependency names
ZM!CaR NULL,// account name
9kN}c<o NULL);// account password
B(LWdap~ //create service failed
~:kZgUP_f if(hSCService==NULL)
42{Ew8 {
m ZtCL //如果服务已经存在,那么则打开
J>wt(] y if(GetLastError()==ERROR_SERVICE_EXISTS)
NO "xL, {
F\JM\{&F //printf("\nService %s Already exists",ServiceName);
42_`+Vt]d7 //open service
;f0I
8i,JN hSCService = OpenService(hSCManager, ServiceName,
"pi=$/RD9 SERVICE_ALL_ACCESS);
]HKQDc' if(hSCService==NULL)
0=@?ob7 {
bv]`!g:
C printf("\nOpen Service failed:%d",GetLastError());
LSa,1{ __leave;
A!s`[2 Z }
jSh5!6O //printf("\nOpen Service %s ok!",ServiceName);
&S{RGXj_ }
xu/cq9 else
1an^1! {
q>_/u" printf("\nCreateService failed:%d",GetLastError());
.zA^)qgL __leave;
twL3\
}N/B }
<k eVrCR }
nhB1D- //create service ok
`18qbot else
[;4g {
GY6`JWk //printf("\nCreate Service %s ok!",ServiceName);
.b3Qfxc> }
nrL9
E'F' |% F=po>w // 起动服务
~P*6ozSYpY if ( StartService(hSCService,dwArgc,lpszArgv))
3m]4= {
\8)U!9,$nn //printf("\nStarting %s.", ServiceName);
KyVQh8 Sleep(20);//时间最好不要超过100ms
ocqU=^ta while( QueryServiceStatus(hSCService, &ssStatus ) )
g`{;(/M+ {
8{wwd:6 if ( ssStatus.dwCurrentState == SERVICE_START_PENDING)
9oRy)_5Z(= {
/[a~3^Gs^ printf(".");
/f:dv?!km Sleep(20);
=)M/@T }
Hu\B"fdS else
R0P
iv: break;
D"Bl:W'?j }
/7aBDc-v if ( ssStatus.dwCurrentState != SERVICE_RUNNING )
=e/9&993 printf("\n%s failed to run:%d",ServiceName,GetLastError());
-V-RP;"> }
v~f HYa> else if(GetLastError()==ERROR_SERVICE_ALREADY_RUNNING)
$:=A'd2 {
7]U"Z* //printf("\nService %s already running.",ServiceName);
h;C5hU4P }
L"E7#} else
,0~^>K {
G"-?&)M#a printf("\nStart Service %s failed:%d",ServiceName,GetLastError());
(7mAt3n
k __leave;
(|[2J3ZET }
@oNH@a
j% bRet=TRUE;
*? 5*m+ }//enf of try
oz,np@f)J __finally
Jv>gwV{ {
j#X.KM return bRet;
s[M?as }
a=1NED' return bRet;
fV &KM*W*@ }
*"+=K,#D /////////////////////////////////////////////////////////////////////////
#zG&|<hc BOOL WaitServiceStop(void)
R?GDJ3 {
\kp8S'qVo BOOL bRet=FALSE;
6bomh2 //printf("\nWait Service stoped");
c&r70L, while(1)
8>trS=;n {
(n*^4@"2 Sleep(100);
#^`4DhQ/
1 if(!QueryServiceStatus(hSCService, &ssStatus))
w,.+IV$Kk {
"W=AB& printf("\nQueryServiceStatus failed:%d",GetLastError());
Sc>,lIM break;
S'|,oUWDb }
?zeJ#i if(ssStatus.dwCurrentState==SERVICE_STOPPED)
^WHE$4U` {
yWg@v+ bKilled=TRUE;
T_s_p bRet=TRUE;
Y#!UPhg< break;
4E;VM{ }
I!^;8Pg if(ssStatus.dwCurrentState==SERVICE_PAUSED)
!9u|fnC9 {
6DM$g=/' //停止服务
d:ARf bRet=ControlService(hSCService,SERVICE_CONTROL_STOP,NULL);
O-ew%@_ break;
H2&@shOOQJ }
r;B8i!gD else
\.C+ue {
TlXI|3Ip //printf(".");
&