调用门提权测试(二)

直接上代码, 能看懂就理解了

记录一下

#include <windows.h>
#include <stdio.h>

BYTE GDT[6]={0};
DWORD dwH2GValue;

void __declspec(naked) GetRegister()
{
	__asm{
		pushad
		pushfd
			
			mov eax,0x8003f00c	//读取高2G内存
			mov ebx,[eax]
			mov dwH2GValue,ebx
			sgdt GDT;	//读取GDT

		popfd
		popad

		retf	//注意返回，不能是ret
	}
}


void PrintRegister()
{
		DWORD GDT_ADDR = *(PDWORD)(&GDT[2]);
		WORD GDT_LIMIT = *(PWORD)(&GDT[0]);

		printf("%x %x %x \n",dwH2GValue,GDT_ADDR,GDT_LIMIT);
}

int main(int argc, char* argv[])
{
	__asm
	{
		mov ebx,ebx
		mov ebx,ebx
	}

	char buff[6];
	
	*(DWORD*)&buff[0] = 0x12345678;
	*(WORD*)&buff[4] = 0x48;

	__asm
	{
		call fword ptr[buff]
	}

	PrintRegister();
	getchar();

	return 0;
	//return 0;
}