16,551
社区成员
发帖
与我相关
我的任务
分享在VC中，打破系统RING0级限制，让RING3级的应用程序执行光盘读取的INT13功能！这已经是在CSDN多天没有得到解决的问题了
打破系统RING0级限制，让RING3级的应用程序执行光盘读取的INT13功能！
大家帮助想想，
不用VXD技术
顶多修改IDT寄存器。
这已经是在CSDN多天没有得到解决的问题了
我不相信CSDN解决不了！
大家帮助想想，
不用VXD技术
顶多修改IDT寄存器。
这已经是在CSDN多天没有得到解决的问题了
我不相信CSDN解决不了！
...全文
请发表友善的回复…
发表回复
snowingedge 2001-04-30
- 打赏
- 举报
fd()兄：
请原谅我的愚笨。能不能解释详细点？？？？你说选择子的段地址部分一样？？
中断例程和我自己的程序的段地址一样？？如果是这样，是不是和windows的flat模式有关？？
请教！！！
请原谅我的愚笨。能不能解释详细点？？？？你说选择子的段地址部分一样？？
中断例程和我自己的程序的段地址一样？？如果是这样，是不是和windows的flat模式有关？？
请教！！！
111222 2001-04-30
- 打赏
- 举报
http://www.csdn.net/expert/TopicView.asp?id=97760
fd 2001-04-30
- 打赏
- 举报
应该是描述符
fd 2001-04-30
- 打赏
- 举报
选择子所映射的偏移和界限都是一样的所以不用修改
snowingedge 2001-04-30
- 打赏
- 举报
这段代码只是修改了IDT中断门的OFFSET部分，但选择子的段地址却没有修改。这对吗？？？
assert 2001-03-13
- 打赏
- 举报
好象不是，抓个 CIH看看就知道了。
gongbird 2001-03-05
- 打赏
- 举报
我在那个例子里些了一个调用VXD service的代码来证明是不是真的到了ring0，可是死机
能告诉我为什么吗？可以的话，帮我看看下面的问题好吗？
http://www.csdn.net/expert/TopicView.asp?id=69200
能告诉我为什么吗？可以的话，帮我看看下面的问题好吗？
http://www.csdn.net/expert/TopicView.asp?id=69200
bzshow 2001-03-05
- 打赏
- 举报
CIH的原理我不知道。
gongbird 2001-03-05
- 打赏
- 举报
楼上的，那段代码是不是用的CIH的原理啊？
hackerning 2001-03-05
- 打赏
- 举报
???
bzshow 2001-03-05
- 打赏
- 举报
; This program switches ring from ring 3 to ring 0
; It utillizes the fact that the page where the IDT is store is not protected in
; win 9x.
; it fetches the gate of an exception and then saves it.
; then it makes the exception points down to code within the process context
; then it causes the exception which succesfully transfers to a ring 0 selector
; it iret's the interupt and restores the original gate so other programs can
; use it safely.
.386P
LOCALS
JUMPS
.MODEL FLAT, STDCALL ; with STDCALL we must reverse the sequence of pushes
; before a APIn call.
UNICODE = 0 ; Needed for w32.inc
INCLUDE W32.inc ; Windows definitions, messages, errors, structures,
; API functions declarations. Some additions of mine.
; Thanks to Barry Kauler and Sven Schreiber.
lp EQU OFFSET
extrn SetUnhandledExceptionFilter : PROC
.DATA
skod db 0
lpOldGate dd 0
IDT db 6 dup (0)
;---- Error Messages
szExceptionCaused db "Exception Caused - could not switch to ring 0",0
szError db "Error",0
ExceptionUsed EQU 5
.CODE
start:
call SetUnhandledExceptionFilter, lp ExceptCallBack ; Catch exceptions
; (security if ring transform
; doesn't work)
sidt fword ptr IDT ; fetch IDT register
mov ebx, dword ptr [IDT+2] ; ebx -> IDT
add ebx, 8*ExceptionUsed ; Ebx -> IDT entry of ExceptionUsed
cli ; Clear interupts
mov dx, word ptr [ebx+6] ; Save the current gate highword
shl edx, 16d
mov dx, word ptr [ebx] ; lowword
mov [lpOldGate], edx
mov eax, offset Ring0Code ; "install hook" - that is newgate
mov word ptr [ebx], ax ; lowword
shr eax, 16d
mov word ptr [ebx+6], ax ; highword
int ExceptionUsed ; cause exception
mov ebx, dword ptr [IDT+2] ; restore gate
add ebx, 8*ExceptionUsed
mov edx, [lpOldGate]
mov word ptr [ebx], dx
shr edx, 16d
mov word ptr [ebx+6], dx
CALL ExitProcess, -1 ; exit
Ring0Code PROC
mov eax, cr0 ; Ring0 code here..
iretd
Ring0Code ENDP
ExceptCallBack PROC
call MessageBoxA, 0, lp szError, lp szExceptionCaused, 0
call ExitProcess, -1
ret
ExceptCallBack ENDP
ends
end start
; It utillizes the fact that the page where the IDT is store is not protected in
; win 9x.
; it fetches the gate of an exception and then saves it.
; then it makes the exception points down to code within the process context
; then it causes the exception which succesfully transfers to a ring 0 selector
; it iret's the interupt and restores the original gate so other programs can
; use it safely.
.386P
LOCALS
JUMPS
.MODEL FLAT, STDCALL ; with STDCALL we must reverse the sequence of pushes
; before a APIn call.
UNICODE = 0 ; Needed for w32.inc
INCLUDE W32.inc ; Windows definitions, messages, errors, structures,
; API functions declarations. Some additions of mine.
; Thanks to Barry Kauler and Sven Schreiber.
lp EQU OFFSET
extrn SetUnhandledExceptionFilter : PROC
.DATA
skod db 0
lpOldGate dd 0
IDT db 6 dup (0)
;---- Error Messages
szExceptionCaused db "Exception Caused - could not switch to ring 0",0
szError db "Error",0
ExceptionUsed EQU 5
.CODE
start:
call SetUnhandledExceptionFilter, lp ExceptCallBack ; Catch exceptions
; (security if ring transform
; doesn't work)
sidt fword ptr IDT ; fetch IDT register
mov ebx, dword ptr [IDT+2] ; ebx -> IDT
add ebx, 8*ExceptionUsed ; Ebx -> IDT entry of ExceptionUsed
cli ; Clear interupts
mov dx, word ptr [ebx+6] ; Save the current gate highword
shl edx, 16d
mov dx, word ptr [ebx] ; lowword
mov [lpOldGate], edx
mov eax, offset Ring0Code ; "install hook" - that is newgate
mov word ptr [ebx], ax ; lowword
shr eax, 16d
mov word ptr [ebx+6], ax ; highword
int ExceptionUsed ; cause exception
mov ebx, dword ptr [IDT+2] ; restore gate
add ebx, 8*ExceptionUsed
mov edx, [lpOldGate]
mov word ptr [ebx], dx
shr edx, 16d
mov word ptr [ebx+6], dx
CALL ExitProcess, -1 ; exit
Ring0Code PROC
mov eax, cr0 ; Ring0 code here..
iretd
Ring0Code ENDP
ExceptCallBack PROC
call MessageBoxA, 0, lp szError, lp szExceptionCaused, 0
call ExitProcess, -1
ret
ExceptCallBack ENDP
ends
end start
