hengai 阅读(1042) 评论(4)

/********************************************************************

 

      : 演示无驱动执行Ring0代码

  创建时间:

      : Ring0Demo.c v1.0 by zzzEVAzzz

      :

      : 演示无驱动执行Ring0代码

      : 通过\Device\PhysicalMemory修改NtVdmControl入口,跳转到Ring0Code

           

      :

  最后修改:

 

      : hengai

  编译环境: VC6 + WindowsXP 未能通过编译

      

*********************************************************************/

 

#include "StdAfx.h"

#include <Windows.h>

#include <Ntsecapi.h>

#include <Aclapi.h>

 

#pragma comment (lib,"ntdll.lib")       // Copy From DDK

#pragma comment (lib,"Kernel32.lib")

#pragma comment (lib,"Advapi32.lib")

 

 

//------------------ 数据类型声明开始 --------------------//

typedef struct _SYSTEM_MODULE_INFORMATION {

  ULONG Reserved[2];

  PVOID Base;

  ULONG Size;

  ULONG Flags;

  USHORT Index;

  USHORT Unknown;

  USHORT LoadCount;

  USHORT ModuleNameOffset;

  CHAR ImageName[256];

} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;

 

typedef struct _OBJECT_ATTRIBUTES {

  ULONG Length;

  HANDLE RootDirectory;

  PUNICODE_STRING ObjectName;

  ULONG Attributes;

  PVOID SecurityDescriptor;

  PVOID SecurityQualityOfService;

} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;

 

typedef enum _SECTION_INHERIT {

  ViewShare = 1,

    ViewUnmap = 2

} SECTION_INHERIT;

 

typedef struct _MY_PROCESS_INFO {

  ULONG PID;

  ULONG KPEB;

  ULONG CR3;

  CHAR Name[16];

  ULONG Reserved;

} MY_PROCESS_INFO, *PMY_PROCESS_INFO;

 

typedef long NTSTATUS;

//------------------ 数据类型声明结束 --------------------//

 

//--------------------- 预定义开始 -----------------------//

#define NT_SUCCESS(Status) ((NTSTATUS)(Status) >= 0)

#define STATUS_SUCCESS              0x00000000

#define STATUS_UNSUCCESSFUL         0xC0000001

#define STATUS_NOT_IMPLEMENTED      0xC0000002

#define STATUS_INFO_LENGTH_MISMATCH 0xC0000004

#define STATUS_INVALID_PARAMETER    0xC000000D

#define STATUS_ACCESS_DENIED        0xC0000022

#define STATUS_BUFFER_TOO_SMALL     0xC0000023

#define OBJ_KERNEL_HANDLE           0x00000200

#define SystemModuleInformation     11

 

#define InitializeObjectAttributes( p, n, a, r, s ) { \

(p)->Length = sizeof( OBJECT_ATTRIBUTES );         \

(p)->RootDirectory = r;                            \

(p)->Attributes = a;                               \

(p)->ObjectName = n;                               \

(p)->SecurityDescriptor = s;                       \

(p)->SecurityQualityOfService = NULL;              \

}

//--------------------- 预定义结束 -----------------------//

 

//------------------ Native API声明开始 ------------------//

NTSYSAPI

VOID

NTAPI

RtlInitUnicodeString(

                     PUNICODE_STRING DestinationString,

                     PCWSTR SourceString

                     );

 

NTSYSAPI

NTSTATUS

NTAPI

ZwQuerySystemInformation(

                         ULONG SystemInformationClass,

                         PVOID SystemInformation,

                         ULONG SystemInformationLength,

                         PULONG ReturnLength

                         );

 

NTSYSAPI

NTSTATUS

NTAPI

ZwOpenSection(

              OUT PHANDLE SectionHandle,

              IN ACCESS_MASK DesiredAccess,

              IN POBJECT_ATTRIBUTES ObjectAttributes

              );

 

NTSYSAPI

NTSTATUS

NTAPI

ZwMapViewOfSection(

                   IN HANDLE SectionHandle,

                   IN HANDLE ProcessHandle,

                   IN OUT PVOID *BaseAddress,

                   IN ULONG ZeroBits,

                   IN ULONG CommitSize,

                   IN OUT PLARGE_INTEGER SectionOffset OPTIONAL,

                   IN OUT PULONG ViewSize,

                   IN %


评论列表
Ghostex
re: [转载] 演示无驱动执行Ring0代码(C++)
烦请楼上的兄弟给俺这里砸一份,不胜感激啊,呵呵 :)
GhostEx@126.com
再次谢谢!
senpan
re: [转载] 演示无驱动执行Ring0代码(C++)
给份来
plunix
re: [转载] 演示无驱动执行Ring0代码(C++)
也能给我一份么。谢谢
plunix@163.com

发表评论
切换编辑模式