79363135

Date: 2025-01-16 21:51:41
Score: 1
Natty:
Report link

There is an undocumented Win32 API call named NtRaiseHardError which can be called using P/Invoke and ntdll. This is actually the way that the Memz trojan triggers a BSOD without requiring administrator rights. https://github.com/peewpw/Invoke-BSOD/blob/master/Program.cs http://undocumented.ntinternals.net/index.html?page=UserMode%2FUndocumented%20Functions%2FError%2FNtRaiseHardError.html

using System;
using System.Runtime.InteropServices;

namespace App
{
    class Program
    {
        [DllImport("ntdll.dll")]
        public static extern uint RtlAdjustPrivilege(int Privilege, bool bEnablePrivilege, bool IsThreadPrivilege, out bool PreviousValue);

        [DllImport("ntdll.dll")]
        public static extern uint NtRaiseHardError(uint ErrorStatus, uint NumberOfParameters, uint UnicodeStringParameterMask, IntPtr Parameters, uint ValidResponseOption, out uint Response);

        static unsafe void Main(string[] args)
        {
            Boolean t1;
            uint t2;
            RtlAdjustPrivilege(19, true, false, out t1);
            NtRaiseHardError(0xc0000022, 0, 0, IntPtr.Zero, 6, out t2);
        }
    }
}
Reasons:
  • Probably link only (1):
  • Long answer (-0.5):
  • Has code block (-0.5):
  • Low reputation (1):
Posted by: Jamie Howell