Thread: How can a program get ring0 privilege easily?

  1. #1
    Registered User
    Join Date
    Feb 2008
    Location
    China
    Posts
    28

    How can a program get ring0 privilege easily?

    Hi friends, I would like to get PCI configuration address under Win32(XP or 2003).
    The sample code shows process to get offset via port cf8h and cfch. But I found the program need to get ring0 privilege to run the command. How can the program get the ring0 privilege easily? Thanks a lot for any help.
    Code:
    #...
    void get_offset(void)
    {
    	unsigned long config_address;
    	__asm
    	{
    	    pushf
    	    mov eax,0x8000fa24
    	    mov dx,0xcf8
    	    out dx,eax
    	    mov dx,0xcfc
    	    in eax,dx
    	    push eax
    	    lea ebx,config_address
                        pop ebx
    	    popf
    	}
    cout<<config_address<<endl;
    }

  2. #2
    Deathray Engineer MacGyver's Avatar
    Join Date
    Mar 2007
    Posts
    3,210
    "Ring 0" and "easy".... somehow I'm not sure they go together.

  3. #3
    Registered User
    Join Date
    Feb 2008
    Location
    China
    Posts
    28
    I found some methods by changing GDT/IDT which can get ring0 by assembling codes.
    But I would like to know how to use driver to load a program in ring0 privilege:
    The program contains driver and can load itself in ring0 privilege...How to get such a program??

  4. #4
    Registered User
    Join Date
    Jul 2008
    Posts
    3
    Quote Originally Posted by chenayang View Post
    I found some methods by changing GDT/IDT which can get ring0 by assembling codes.
    But I would like to know how to use driver to load a program in ring0 privilege:
    The program contains driver and can load itself in ring0 privilege...How to get such a program??
    In the Windows DDK (which you should have if you are creating anything that resides in kernel mode), you can use a tool called DevCon (http://msdn.microsoft.com/en-us/library/ms792824.aspx) to load drivers.

    Alternatively, you can use TDriver (http://www.codeproject.com/KB/system/tdriver.aspx).
    Last edited by Cawk-Love; 07-21-2008 at 08:51 PM.

  5. #5
    Registered User
    Join Date
    Apr 2008
    Posts
    890
    None of this has anything to do with C++.

  6. #6
    and the hat of int overfl Salem's Avatar
    Join Date
    Aug 2001
    Location
    The edge of the known universe
    Posts
    39,656
    Moved.
    If you dance barefoot on the broken glass of undefined behaviour, you've got to expect the occasional cut.
    If at first you don't succeed, try writing your phone number on the exam paper.

  7. #7
    Kernel hacker
    Join Date
    Jul 2007
    Location
    Farncombe, Surrey, England
    Posts
    15,677
    Quote Originally Posted by chenayang View Post
    I found some methods by changing GDT/IDT which can get ring0 by assembling codes.
    But I would like to know how to use driver to load a program in ring0 privilege:
    The program contains driver and can load itself in ring0 privilege...How to get such a program??
    But you can't change GDT/IDT unless you are in RING0 - which is a good thing, because although people complain about Windows security, at least it's only small holes, not ones that an entire army of tanks can drive through all at once without anyone noticing. If you could just trivially modify the GDT then you don't have any security at all -that's zero, nada, none (not sure why you mention IDT, as that's not particularly meaningful for gaining Ring 0 access - at least not without also being able to introduce another piece of Ring0 code).

    My other comment would be: Why would you want to read the PCI config space? There's very little you can do with PCI-devices without a driver. To write a driver, you need the DDK, and if you have a driver, you are in Ring0.

    --
    Mats
    Compilers can produce warnings - make the compiler programmers happy: Use them!
    Please don't PM me for help - and no, I don't do help over instant messengers.

Popular pages Recent additions subscribe to a feed

Similar Threads

  1. Need help with a program, theres something in it for you
    By engstudent363 in forum C Programming
    Replies: 1
    Last Post: 02-29-2008, 01:41 PM
  2. Replies: 4
    Last Post: 02-21-2008, 10:39 AM
  3. Using variables in system()
    By Afro in forum C Programming
    Replies: 8
    Last Post: 07-03-2007, 12:27 PM
  4. My program, anyhelp
    By @licomb in forum C Programming
    Replies: 14
    Last Post: 08-14-2001, 10:04 PM