RING3下蓝屏的方法

RING3下蓝屏的方法

一、RtlSetProcessIsCritical

VB代码如下：

Option Explicit

Public Declare Function RtlAdjustPrivilege Lib "ntdll.dll" (ByVal Privilege As Long, ByVal Enable As Boolean, ByVal Client As Boolean, WasEnabled As Long) As Long
Public Declare Function RtlSetProcessIsCritical Lib "ntdll" (Optional ByVal NewValue As Boolean, Optional ByVal Value As Boolean, Optional ByVal WinLogon As Boolean = True)

Sub Main()
    RtlAdjustPrivilege 20, True, False, 0
    RtlSetProcessIsCritical False, False, True
    End
End Sub

VC代码参见：

http://www.codeproject.com/KB/winsdk/RtlSetProcessIsCritical.aspx

二、NtRaiseHardError

VB代码如下：

Option Explicit

Public Declare Function NtRaiseHardError Lib "ntdll.dll" (ByVal ErrorStatus As Long, ByVal NumberOfParameters As Long, ByVal UnicodeStringParameterMask As Long, ByRef Parameters As Any, ByVal ValidResponseOptions As Long, ByRef Response As Long) As Long
Public Declare Function RtlAdjustPrivilege Lib "ntdll.dll" (ByVal Privilege As Long, ByVal Enable As Boolean, ByVal Client As Boolean, WasEnabled As Long) As Long
Public Declare Sub RtlInitUnicodeString Lib "ntdll.dll" (DestinationString As UNICODE_STRING, ByVal SourceString As Long)
Public Type UNICODE_STRING
    Length                As Long
    MaximumLength         As Long
    Buffer                As Long
End Type

Sub Main()
    Dim u As UNICODE_STRING, p(3) As Long
    RtlAdjustPrivilege 19, True, False, 0
    RtlInitUnicodeString u, StrPtr("Session Manager")
    p(0) = VarPtr(u)
    p(1) = u.Length
    p(2) = VarPtr(u)
    p(3) = VarPtr(u)
    NtRaiseHardError &HC000021A, 4, 1, p(0), 6, 0
   
End Sub

VC代码参见：

http://blog.csdn.net/tyk5555/article/details/6523985