粗糙的Ring0弹Box代码_zwraiseharderror-优快云博客

本文介绍了如何在Ring0级别创建一个警告框，通过UtilsZwRoutine函数调用ZwRaiseHardError系统调用，结合LoadWarnBox函数加载ntdll.dll库获取相关地址。代码中涉及DbgPrint调试输出及RtlInitUnicodeString等内核API。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

ULONG SDT_ZwRaiseHardError;
NTSTATUS UtilsZwRoutine(ULONG ZwIndex,...)
{

NTSTATUS status;

_asm{
mov eax,[ZwIndex]
Lea edx,[ebp+0x0c]
Int 0x2e
mov [status],eax
}

return status;
}
ULONG WarnBox(WCHAR *lpwzWarnString,WCHAR *lpwzWarnCaption)
{
ULONG pUnicodeArguments[] = {0, 0, 0};
ULONG ReturnValue;
UNICODE_STRING uniText;
UNICODE_STRING uniCaption;
DbgPrint("WarningBox Begin!/n");
RtlInitUnicodeString(&uniText, lpwzWarnString);
RtlInitUnicodeString(&uniCaption, lpwzWarnCaption);
pUnicodeArguments[0] = (ULONG)&uniText;
pUnicodeArguments[1] = (ULONG)&uniCaption;
if(SDT_ZwRaiseHardError!=0)
UtilsZwRoutine(SDT_ZwRaiseHardError,0x50000018, 3, 3, pUnicodeArguments, 1, &ReturnValue);
else
DbgPrint("No NUMBER!");
return ReturnValue;
}

void LoadWarnBox()
{
HANDLE ntdll;
ntdll = KLoadLibrary(L"//SystemRoot//System32//ntdll.dll");
if(!ntdll)
{
SDT_ZwRaiseHardError = 0;
return;
}
SDT_ZwRaiseHardError = (ULONG)GetSyscallIndex(ntdll,"NtRaiseHardError");
DbgPrint("ZwRaiseHardErrorId: %x/n",SDT_ZwRaiseHardError);
KFreeLibrary(ntdll);
return ;
}