Win32下ring0特权级保护机制安全性研究

Research on Security of Win32 Ring0Privilege Protected Mechanism

基于80386保护模式的Win32操作系统通过ring0特权级保护机制严格限制普通Win32应用程序以核心态运行。文章通过对这种保护机制的分析研究,给出了如何使普通Win32应用程序在核心态运行的思路,指出了Win32操作系统中存在的这种安全隐患及其可能带来的严重后果,最后给出了防护措施。

The Win32 OS that based on Intel 80386 protected mode restricts the common Win32 application to run in kernel mode strictly through ring0 privilege protected mechanism. This paper gives a way of how to make a common Win32 application to run in kernel mode, and then indicates the security vulnerability that existed in Win32 OS through the research of the protected mechanism and the terrible result it may brings. Finally, it shows the measure of how to guard.