众所周知,蓝屏有很多种,如系统错误,过热,系统进程被结束……很多蓝屏都是用户“自愿”的,但蓝屏代码总是系统设置的。但其实蓝屏都调用了一个dll里的函数。没错,就是ntdll.dll。所以,我们就可以调用微软“提供”的函数,自定义错误代码蓝屏。
NTHeaders.h:
#ifndef _NT_HDRS_
#define _NT_HDRS_
#include <windows.h>
typedef /*__success(return >= 0)*/ LONG NTSTATUS;
typedef NTSTATUS *PNTSTATUS;
#define STATUS_SUCCESS ((NTSTATUS)0x00000000L)
typedef struct _LSA_UNICODE_STRING {
USHORT Length;
USHORT MaximumLength;
PWSTR Buffer;
} LSA_UNICODE_STRING, *PLSA_UNICODE_STRING, UNICODE_STRING, *PUNICODE_STRING;
typedef enum _HARDERROR_RESPONSE_OPTION {
OptionAbortRetryIgnore,
OptionOk,
OptionOkCancel,
OptionRetryCancel,
OptionYesNo,
OptionYesNoCancel,
OptionShutdownSystem
} HARDERROR_RESPONSE_OPTION, *PHARDERROR_RESPONSE_OPTION;
typedef enum _HARDERROR_RESPONSE {
ResponseReturnToCaller,
ResponseNotHandled,
ResponseAbort,
ResponseCancel,
ResponseIgnore,
ResponseNo,
ResponseOk,
ResponseRetry,
ResponseYes
} HARDERROR_RESPONSE, *PHARDERROR_RESPONSE;
#endif
blue.cpp:
#include <Windows.h>
#include "NTHeaders.h"
HINSTANCE hInst; // 当前实例
typedef UINT (CALLBACK* NTRAISEHARDERROR)(NTSTATUS, ULONG, PUNICODE_STRING, PVOID,HARDERROR_RESPONSE_OPTION, PHARDERROR_RESPONSE);
typedef UINT (CALLBACK* RTLADJUSTPRIVILEGE)(ULONG, BOOL, BOOL, PINT);
int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd)
{
HINSTANCE hDLL = LoadLibrary(TEXT("ntdll.dll"));
NTRAISEHARDERROR NtRaiseHardError;
RTLADJUSTPRIVILEGE RtlAdjustPrivilege;
int nEn = 0;
HARDERROR_RESPONSE reResponse;
if (hDLL != NULL)
{
NtRaiseHardError = (NTRAISEHARDERROR)GetProcAddress(hDLL, "NtRaiseHardError");
RtlAdjustPrivilege = (RTLADJUSTPRIVILEGE)GetProcAddress(hDLL, "RtlAdjustPrivilege");
if (!NtRaiseHardError)
{
// handle the error
FreeLibrary(hDLL);
return 0;
}
if (!RtlAdjustPrivilege)
{
// handle the error
FreeLibrary(hDLL);
return 0;
}
RtlAdjustPrivilege(0x13, TRUE, FALSE, &nEn);//0x13 = SeShutdownPrivilege
NtRaiseHardError(0xc0054188,0,0,0,OptionShutdownSystem,&reResponse);
}
return 1;
}
注:只可用于Windows!请不要用于交(po)友(hai)!