Ring3下蓝屏的代码demo

最新推荐文章于 2024-05-14 12:53:43 发布

Mikasys

最新推荐文章于 2024-05-14 12:53:43 发布

阅读量531

点赞数

分类专栏：逆向系统 Windows 文章标签：操作系统内核

本文链接：https://blog.csdn.net/Mikasys/article/details/120512961

版权

#include <stdio.h>
#include <windows.h>
#include <tlhelp32.h>

const ULONG SE_DEBUG_PRIVILEGE = 20;
const ULONG SE_SHUTDOWN_PRIVILEGE = 19;

typedef struct _UNICODE_STRING
{
   
	USHORT Length;
	USHORT MaximumLength;
	PWCH   Buffer;
}UNICODE_STRING, *PUNICODE_STRING;

typedef enum _PROCESSINFOCLASS
{
   
	ProcessBasicInformation,           //0
	ProcessQuotaLimits,                //1
	ProcessIoCounters,                 //2
	ProcessVmCounters,                 //3
	ProcessTimes,                      //4
	ProcessBasePriority,               //5
	ProcessRaisePriority,              //6
	ProcessDebugPort,                  //7 
	ProcessExceptionPort,              //8
	ProcessAccessToken,                //9
	ProcessLdtInformation,             //10
	ProcessLdtSize,                    //11
	ProcessDefaultHardErrorMode,       //12
	ProcessIoPortHandlers,             //13
	ProcessPooledUsageAndLimits,       //14
	ProcessWorkingSetWatch,            //15
	ProcessUserModeIOPL,               //16 
	ProcessEnableAlignmentFaultFixup,  //17
	ProcessPriorityClass,              //18
	ProcessWx86Information,            //19
	ProcessHandleCount,                //20
	ProcessAffinityMask,               //21
	ProcessPriorityBoost,              //22
	ProcessDeviceMap,                  //23
	ProcessSessionInformation,         //24
	ProcessForegroundInformation,      //25
	ProcessWow64Information,           //26
	ProcessImageFileName,              //27
	ProcessLUIDDeviceMapsEnabled,      //28
	ProcessBreakOnTermination,         //29  0x1D
	ProcessDebugObjectHandle,          //30
	ProcessDebugFlags,                 //31
	ProcessHandleTracing,              //32
	ProcessIoPriority,                 //33
	ProcessExecuteFlags,               //34
	ProcessTlsInformation,             //35
	ProcessCookie,                     //36
	ProcessImageInformation,           //37
	ProcessCycleTime,                  //38
	ProcessPagePriority,               //39
	ProcessInstrumentationCallback,    //40
	ProcessThreadStackAllocation,      //41
	ProcessWorkingSetWatchEx,          //42
	ProcessImageFileNameWin32,         //43
	ProcessImageFileMapping,           //44
	ProcessAffinityUpdateMode,         //45
	ProcessMemoryAllocationMode,       //46
	MaxProcessInfoClass                //47
} PROCESSINFOCLASS;

typedef enum _THREADINFOCLASS
{
   
	ThreadBasicInformation,             //0
	ThreadTimes,                        //1
	ThreadPriority,                     //2
	ThreadBasePriority,                 //3
	ThreadAffinityMask