Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- //http://waleedassar.blogspot.com
- //http://www.twitter.com/waleedassar
- //Code to trigger STATUS_GUARD_PAGE_VIOLATION in a nerdy way.
- #include "stdafx.h"
- #include "windows.h"
- #include "stdio.h"
- #define ThreadBasicInformation 0x0
- struct THREAD_BASIC_INFORMATION
- {
- unsigned long ExitStatus;
- unsigned long TEBAddress;
- unsigned long shit[0x5]; //Only to preserve the structure's size
- };
- extern "C"
- {
- int __stdcall ZwQueryInformationThread(HANDLE,unsigned long,THREAD_BASIC_INFORMATION*,unsigned long,unsigned long*);
- }
- int dummy()
- {
- int x=0;
- int y=x+1;
- Sleep(INFINITE);
- return y;
- }
- int __cdecl Handler(EXCEPTION_RECORD* pRec,void* est,unsigned char* pContext,void* disp)
- {
- if(pRec->ExceptionCode==0x80000001)
- {
- MessageBox(0,"Expected","waliedassar",0);
- ExitProcess(0);
- }
- return ExceptionContinueSearch;
- }
- void main()
- {
- //--------------Install Exception Handler----------------------------
- __asm
- {
- push offset Handler
- push dword ptr fs:[0x0]
- mov dword ptr fs:[0x0],esp
- }
- //-------------Create a new thread and extract some info------------
- unsigned long tid=0;
- HANDLE h=CreateThread(0,0x1000,(LPTHREAD_START_ROUTINE)&dummy,0,0,&tid);
- if(!h) return;
- printf("Thread %x has been created.\r\n",tid);
- THREAD_BASIC_INFORMATION TBI={0};
- ZwQueryInformationThread(h,ThreadBasicInformation,&TBI,sizeof(TBI),0);
- printf("Thread TEB at %x\r\n",TBI.TEBAddress);
- char* p=(char*)(TBI.TEBAddress);
- unsigned long StackBase=*(unsigned long*)(p+0x4);
- unsigned long StackCurrPointer=*(unsigned long*)(p+0x8);
- printf("Thread Stack base: %x\r\n",StackBase);
- printf("Thread Stack Current: %x\r\n",StackCurrPointer);
- //--------------Trigger the STATUS_GUARD_VIOLATION------------------
- MEMORY_BASIC_INFORMATION MBI={0};
- if(VirtualQuery((void*)(StackCurrPointer-0x1000),&MBI,sizeof(MBI)))
- {
- printf("Protect: %x\r\n",MBI.Protect);
- unsigned long px=StackCurrPointer-0x1000;
- unsigned char x=*(unsigned char*)px;
- }
- //--------------------------------------------------------------
- ExitProcess(0);
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement