演示无驱动执行Ring0代码（C++） (转)

来源：互联网发布：淘宝旧书店编辑：程序博客网时间：2024/06/07 05:43

/********************************************************************

程序: 演示无驱动执行Ring0代码

创建时间:

作者: Ring0Demo.c v1.0 by zzzEVAzzz

来源:

目的: 演示无驱动执行Ring0代码

原理: 通过/Device/PhysicalMemory修改NtVdmControl入口，跳转到Ring0Code

注意:

最后修改:

整理: hengai

编译环境: VC6 + WindowsXP 未能通过编译

*********************************************************************/

#include "StdAfx.h"

#include <Windows.h>

#include <Ntsecapi.h>

#include <Aclapi.h>

#pragma comment (lib,"ntdll.lib") // Copy From DDK

#pragma comment (lib,"Kernel32.lib")

#pragma comment (lib,"Advapi32.lib")

//------------------ 数据类型声明开始 --------------------//

typedef struct _SYSTEM_MODULE_INFORMATION {

ULONG Reserved[2];

PVOID Base;

ULONG Size;

ULONG Flags;

USHORT Index;

USHORT Unknown;

USHORT LoadCount;

USHORT ModuleNameOffset;

CHAR ImageName[256];

} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;

typedef struct _OBJECT_ATTRIBUTES {

ULONG Length;

HANDLE RootDirectory;

PUNICODE_STRING ObjectName;

ULONG Attributes;

PVOID SecurityDescriptor;

PVOID SecurityQualityOfService;

} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;

typedef enum _SECTION_INHERIT {

ViewShare = 1,

ViewUnmap = 2

} SECTION_INHERIT;

typedef struct _MY_PROCESS_INFO {

ULONG PID;

ULONG KPEB;

ULONG CR3;

CHAR Name[16];

ULONG Reserved;

} MY_PROCESS_INFO, *PMY_PROCESS_INFO;

typedef long NTSTATUS;

//------------------ 数据类型声明结束 --------------------//

//--------------------- 预定义开始 -----------------------//

#define NT_SUCCESS(Status) ((NTSTATUS)(Status) >= 0)

#define STATUS_SUCCESS 0x00000000

#define STATUS_UNSUCCESSFUL 0xC0000001

#define STATUS_NOT_IMPLEMENTED 0xC0000002

#define STATUS_INFO_LENGTH_MISMATCH 0xC0000004

#define STATUS_INVALID_PARAMETER 0xC000000D

#define STATUS_ACCESS_DENIED 0xC0000022

#define STATUS_BUFFER_TOO_SMALL 0xC0000023

#define OBJ_KERNEL_HANDLE 0x00000200

#define SystemModuleInformation 11

#define InitializeObjectAttributes( p, n, a, r, s ) { /

(p)->Length = sizeof( OBJECT_ATTRIBUTES ); /

(p)->RootDirectory = r; /

(p)->Attributes = a; /

(p)->ObjectName = n; /

(p)->SecurityDescriptor = s; /

(p)->SecurityQualityOfService = NULL; /

}

//--------------------- 预定义结束 -----------------------//

//------------------ Native API声明开始 ------------------//

NTSYSAPI

VOID

NTAPI

RtlInitUnicodeString(

PUNICODE_STRING DestinationString,

PCWSTR SourceString

);

NTSYSAPI

NTSTATUS

NTAPI

ZwQuerySystemInformation(

ULONG SystemInformationClass,

PVOID SystemInformation,

ULONG SystemInformationLength,

PULONG ReturnLength

);

NTSYSAPI

NTSTATUS

NTAPI

ZwOpenSection(

OUT PHANDLE SectionHandle,

IN ACCESS_MASK DesiredAccess,

IN POBJECT_ATTRIBUTES ObjectAttributes

);

NTSYSAPI

NTSTATUS

NTAPI

ZwMapViewOfSection(

IN HANDLE SectionHandle,

IN HANDLE ProcessHandle,

IN OUT PVOID *BaseAddress,

IN ULONG ZeroBits,

IN ULONG CommitSize,

IN OUT PLARGE_INTEGER SectionOffset OPTIONAL,

IN OUT PULONG ViewSize,

IN %