当前位置： 文江博客话题详情

从用户模式创建 BSOD？

发布于 2024-11-29 08:05:04 字数 212 浏览 5 评论 0原文

有一天，我对我的 XP 盒子感到厌倦了，所以我决定尝试一些这个的答案问题看看它们是否会导致 BSOD。
他们没有，而且他们似乎最有可能这样做，所以我想知道是否有可能从 C/C++ 中的用户模式触发 BSOD，如果可以，如何触发？

原文

I was getting bored with my XP box one day, so I decided to try some of the answers to this question to see if any of them would cause a BSOD.
They didn't, and they seemed like they would be the most likely to do that, so I was wondering if it is possible to trigger a BSOD from user-mode in C/C++, and if so, how?

如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

扫码二维码加入Web技术交流群

发布评论

需要 登录 才能够评论， 你可以免费 注册 一个本站的账号。

评论（10）

百善笑为先 2024-12-06 08:05:04

就是这样：

#include <iostream>
#include <Windows.h>
#include <winternl.h>
using namespace std;
typedef NTSTATUS(NTAPI *pdef_NtRaiseHardError)(NTSTATUS ErrorStatus, ULONG NumberOfParameters, ULONG UnicodeStringParameterMask OPTIONAL, PULONG_PTR Parameters, ULONG ResponseOption, PULONG Response);
typedef NTSTATUS(NTAPI *pdef_RtlAdjustPrivilege)(ULONG Privilege, BOOLEAN Enable, BOOLEAN CurrentThread, PBOOLEAN Enabled);
int main()
{
    BOOLEAN bEnabled;
    ULONG uResp;
    LPVOID lpFuncAddress = GetProcAddress(LoadLibraryA("ntdll.dll"), "RtlAdjustPrivilege");
    LPVOID lpFuncAddress2 = GetProcAddress(GetModuleHandle("ntdll.dll"), "NtRaiseHardError");
    pdef_RtlAdjustPrivilege NtCall = (pdef_RtlAdjustPrivilege)lpFuncAddress;
    pdef_NtRaiseHardError NtCall2 = (pdef_NtRaiseHardError)lpFuncAddress2;
    NTSTATUS NtRet = NtCall(19, TRUE, FALSE, &bEnabled); 
    NtCall2(STATUS_FLOAT_MULTIPLE_FAULTS, 0, 0, 0, 6, &uResp); 
    return 0;
}

It's just this:

#include <iostream>
#include <Windows.h>
#include <winternl.h>
using namespace std;
typedef NTSTATUS(NTAPI *pdef_NtRaiseHardError)(NTSTATUS ErrorStatus, ULONG NumberOfParameters, ULONG UnicodeStringParameterMask OPTIONAL, PULONG_PTR Parameters, ULONG ResponseOption, PULONG Response);
typedef NTSTATUS(NTAPI *pdef_RtlAdjustPrivilege)(ULONG Privilege, BOOLEAN Enable, BOOLEAN CurrentThread, PBOOLEAN Enabled);
int main()
{
    BOOLEAN bEnabled;
    ULONG uResp;
    LPVOID lpFuncAddress = GetProcAddress(LoadLibraryA("ntdll.dll"), "RtlAdjustPrivilege");
    LPVOID lpFuncAddress2 = GetProcAddress(GetModuleHandle("ntdll.dll"), "NtRaiseHardError");
    pdef_RtlAdjustPrivilege NtCall = (pdef_RtlAdjustPrivilege)lpFuncAddress;
    pdef_NtRaiseHardError NtCall2 = (pdef_NtRaiseHardError)lpFuncAddress2;
    NTSTATUS NtRet = NtCall(19, TRUE, FALSE, &bEnabled); 
    NtCall2(STATUS_FLOAT_MULTIPLE_FAULTS, 0, 0, 0, 6, &uResp); 
    return 0;
}
回复 原文
梦过后 2024-12-06 08:05:04

有一个未记录的函数 NtRaiseHardError。

http://undocumented.ntinternals.net/UserMode/Undocumented%20Functions/Error/NtRaiseHardError.html< /一>

<一href="http://undocumented.ntinternals.net/UserMode/Undocumented%20Functions/Error/HARDERROR_RESPONSE_OPTION.html">http://undocumented.ntinternals.net/UserMode/Undocumented%20Functions/Error/HARDERROR_RESPONSE_OPTION.html

如果第五个参数是 6 (OptionShutdownSystem)，您将得到 BSOD。这需要启用关机权限。

There's the undocumented function NtRaiseHardError.

http://undocumented.ntinternals.net/UserMode/Undocumented%20Functions/Error/NtRaiseHardError.html

http://undocumented.ntinternals.net/UserMode/Undocumented%20Functions/Error/HARDERROR_RESPONSE_OPTION.html

If the fifth parameter is 6 (OptionShutdownSystem), you'll get a BSOD. This requires enabling the shutdown privilege.

回复 原文
魂归处 2024-12-06 08:05:04

从用户模式产生 BSOD 非常困难，除非用户模式程序与有缺陷的驱动程序交互（可能是特定的操作序列可以揭示特定驱动程序中的错误）干扰驱动程序堆栈。从用户模式，输入在传递到内核模式之前经过验证，以确保系统的稳定性。大多数 Microsoft API/驱动程序都经过良好验证，可以避免系统中的安全问题；驱动器制造商也是如此。

最好的方法是扰乱驱动程序堆栈，但这不是用户模式。

您可以使用 NotMyFault SystInternals 实用程序创建 BSOD。它从根本上注入驱动程序并创建 BSOD

http://download.sysinternals.com/Files/Notmyfault。邮编

It seriously difficult to make a BSOD from user mode unless the user mode program interacts with buggy drivers (may be a particular sequence of operations can reveal the bugs in particular driver) disturbs the driver stack. From user mode, the inputs are validated well before passing to the kernel mode to ensure the stability of the system. Most of the Microsoft API/Drivers have validated well to avoid security issues in the system; so does the driver manufactures.

The best way is to disturb the driver stack, but it's not user mode.

You can create BSOD with NotMyFault SystInternals utility. It fundamentally injects a driver and create the BSOD

http://download.sysinternals.com/Files/Notmyfault.zip

回复 原文
不回头走下去 2024-12-06 08:05:04

除了bug之外的办法就是资源耗尽。您可以研究的一个领域是消耗机器上的所有 CPU（在实时优先级级别运行与核心数量一样多的线程），并消耗内核资源并依赖实时优先级来阻止内核清理向上。

但不确定什么是好的资源。针对设备的大量未完成的异步操作无法让 CPU 进行清理？你至少可以朝这个方向进行尝试。

The approach other than bugs is resource exhaustion. An area you could investigate would be to consume all CPU on the machine (run as many threads as you have cores at a real time priority level), and consume a kernel resource and depend on the real-time priority to stop the kernel from cleaning up.

Not sure what a good resource would be though. Lots of outstanding async operations against a device that can't get CPU to clean up? You could at least experiment in that direction.

回复 原文
愚人国度 2024-12-06 08:05:04

如果操作系统没有错误，那么就不可能从用户空间对计算机进行 BSOD。最坏的情况是，它只会使有问题的应用程序崩溃。

然而，没有什么是完美的。每个操作系统中都存在错误，并且每个操作系统都存在可从用户空间利用的错误，这些错误会导致 BSOD（或像 Linux 那样的 OOPS，或者给定操作系统选择报告不可恢复的错误）。

至于具体细节，这实际上取决于错误的性质。除了“是的，这是可能的”之外，没有通用的答案。

有关更多详细信息，您应该更多地了解操作系统设计，以及如何使用分页、环级别和其他技术将进程彼此分离以及与内核空间分离。

If the operating system has no bugs in it, then it should be impossible to BSOD a machine from user space. At worst, it should just crash the offending application.

However, nothing is perfect. There are bugs in every operating system and every operating system has had bugs which cause a BSOD (or an OOPS as Linux does, or however else a given OS chooses to report an irrecoverable error) that is exploitable from user space.

As far as specifics, it really depends on the nature of the bug. There is no generic answer beyond "yes, it's possible".

For more details, you should look more into OS design, and how paging, ring levels and other techniques can be used to separate processes from each other and kernel space.

回复 原文
止于盛夏 2024-12-06 08:05:04

BSOD 是由内核模式中发生的不可恢复的错误引起的；没有办法在不触发内核错误的情况下发生这种情况。一般来说，如果你想这样做，你必须找到驱动程序中的缺陷[编辑：或者正如评论者指出的那样，系统调用]并利用它。

或者，您可以执行此应用程序的操作： http://www.nirsoft.net/utils/start_blue_screen .html 。只需编写您自己的驱动程序即可以任何您想要的方式使系统崩溃。 :)

维基百科页面有一些有趣的信息，因此我将其纳入参考： http://en.wikipedia.org /wiki/Blue_Screen_of_Death 。

Well, BSODs are from unrecoverable errors that happen in kernel mode; there is no way to cause that to happen without triggering a kernel error somehow. In general, if you wanted to do it, you would have to find a flaw in a driver [edit: or as a commenter pointed out, a system call] and exploit that.

Or, you could do what this app does: http://www.nirsoft.net/utils/start_blue_screen.html . Just write your own driver to crash the system any way you want to. :)

The Wikipedia page had some interesting information so I include it for reference: http://en.wikipedia.org/wiki/Blue_Screen_of_Death .

回复 原文
栩栩如生 2024-12-06 08:05:04

您可以使用键盘强制系统崩溃。您的标题谈到了用户模式，我不确定这是否符合用户模式，但它可能有用。

You can force a system crash with the keyboard. Your title talks about user mode, I am not sure whether this qualifies as user mode, yet it might be useful.

回复 原文
十二 2024-12-06 08:05:04

不使用驱动程序的两种方法：

  1. 正如有人指出的那样，使用未记录的函数 NtRaiseHardError
  2. 使用未记录的函数 RtlSetProcessIsCritical 设置关键进程，然后终止它。需要 SE_DEBUG_NAME 权限。 http://www.codeproject.com/Articles/43405/Protecting -Your-Process-with-RtlSetProcessIsCriti

Two ways without using drivers:

  1. Using the undocumented function NtRaiseHardError as someone pointed out
  2. Setting a critical process with the undocumented function RtlSetProcessIsCritical then terminating it. Requires the SE_DEBUG_NAME privilege. http://www.codeproject.com/Articles/43405/Protecting-Your-Process-with-RtlSetProcessIsCriti
回复 原文
枉心 2024-12-06 08:05:04

我在此链接中找到了生成蓝屏的代码： https://www. mpgh.net/forum/showthread.php?t=1100477

这是代码（我尝试过，它有效，你只需要调用 BlueScreen() 函数）

#include <windows.h>
#pragma comment(lib, "ntdll.lib")

extern "C" NTSTATUS NTAPI RtlAdjustPrivilege(ULONG Privilege, BOOLEAN Enable, BOOLEAN CurrentThread, PBOOLEAN OldValue);
extern "C" NTSTATUS NTAPI NtRaiseHardError(LONG ErrorStatus, ULONG NumberOfParameters, ULONG UnicodeStringParameterMask,
    PULONG_PTR Parameters, ULONG ValidResponseOptions, PULONG Response);

    void BlueScreen()
    {
        BOOLEAN bl;
        ULONG Response;
        RtlAdjustPrivilege(19, TRUE, FALSE, &bl); // Enable SeShutdownPrivilege
        NtRaiseHardError(STATUS_ASSERTION_FAILURE, 0, 0, NULL, 6, &Response); // Shutdown
    }

I found at this link a code that generates a bsod : https://www.mpgh.net/forum/showthread.php?t=1100477

And here's the code (I tried it and it works, you just need to call the BlueScreen() function)

#include <windows.h>
#pragma comment(lib, "ntdll.lib")

extern "C" NTSTATUS NTAPI RtlAdjustPrivilege(ULONG Privilege, BOOLEAN Enable, BOOLEAN CurrentThread, PBOOLEAN OldValue);
extern "C" NTSTATUS NTAPI NtRaiseHardError(LONG ErrorStatus, ULONG NumberOfParameters, ULONG UnicodeStringParameterMask,
    PULONG_PTR Parameters, ULONG ValidResponseOptions, PULONG Response);

    void BlueScreen()
    {
        BOOLEAN bl;
        ULONG Response;
        RtlAdjustPrivilege(19, TRUE, FALSE, &bl); // Enable SeShutdownPrivilege
        NtRaiseHardError(STATUS_ASSERTION_FAILURE, 0, 0, NULL, 6, &Response); // Shutdown
    }
回复 原文
软甜啾 2024-12-06 08:05:04

只需打开 Windows 运行并输入 C:\con\con

Just open up Windows run and type C:\con\con

回复 原文
~没有更多了~

关于作者

几味少女

暂无简介

文章
评论
25 人气
发私信

相关话题

更多

热门标签

操作系统 程序设计 IT运维 Linux系统管理 JavaScript 服务器应用 solaris C/C++ PHP Shell BSD Vue.js aix Oracle Python HTML 系统管理 HTML5 CSS 前端
更多

推荐作者

Promise

文章 0 评论 0

qq_lbRlsh

文章 0 评论 0

待＂谢繁草

文章 0 评论 0

yy2010hell

文章 0 评论 0

漫无边际

文章 0 评论 0

傲娇萝莉攻

文章 0 评论 0

更多

友情链接

文江博客
    我们使用 Cookies 和其他技术来定制您的体验包括您的登录状态等。通过阅读我们的 隐私政策 了解更多相关信息。 单击 接受 或继续使用网站，即表示您同意使用 Cookies 和您的相关数据。
    原文