Introduction - If you have any usage issues, please Google them yourself
As is well known in the non-Admin user mode, is not allowed to drive the implementation of load code RING 0. This article provides a method by modifying the system, GDT, IDT to add your own CALLGATE and INTGATE this way in the system set up a backdoor. We can use this backdoor in any user mode implementation of ring 0 code. In order to ensure we add CALLGATE and INTGATE permanent. Can be installed in the first use of SERVICE API or INF file with the system set to start. But this method also has a defect is first installed CALLGATE or INTGATE still need ADMIN privileges. , Respectively, are given below to add CALLGATE with INTGATE specific code.
Packet : 11912924execring0codebyanyusermode.rar filelist
任意用户模式下执行 ring 0 代码.txt