Getting into Ring 0...

    
//  File: RING0.C

//=================================

#include <windows.h>
#include <stdio.h>
#include "descript.h"

DWORD far pascal GET_CR(WORD cmd);
DWORD far pascal GET_CR_RING3(WORD cmd);

typedef DWORD (FAR PASCAL * DWORD_FARPROC)(WORD);

int PASCAL WinMain( HANDLE hInstance, HANDLE hPrevInstance,
                    LPSTR lpszCmdLine, int nCmdShow )
{
    char buffer[256];
    DWORD_FARPROC GET_CR_ptr;
    unsigned long ring0CR0, ring0CR2, ring0CR3;     // GRETCHEN - New Line

    unsigned short ourCS;                           // GRETCHEN - New Line


    //

    // Call the ring 3 version of GET_CR() to show that you

    // can't access these registers from normal ring 3 code.

    // Comment the first set of sprintf()/MessageBox() calls

    // below if you want to run in standard mode or on Windows

    // 3.0.  The call to Get_CR0_At_Ring_3() will GP fault

    // unless run under Windows 3.1 in enhanced mode.

    //

    sprintf(buffer, "From ring 3, CR0 = %08lX\r\n"
                    "From ring 3, CR2 = %08lX\r\n"
                    "From ring 3, CR3 = %08lX\r\n",
                    GET_CR_RING3(0), GET_CR_RING3(2),
                    GET_CR_RING3(3) );
    MessageBox(0, buffer, "First try", MB_OK);

    //

    // Now we'll get a function pointer that uses a call gate.

    // The second parameter indicates how many WORD parameters

    // should be copied to the ring 0 stack.  If the destination

    // was a 32 bit segment, the parameter would be the number

    // of DWORDs to copy.

    //

    GET_CR_ptr = (DWORD_FARPROC)CreateCallgate( GET_CR, 1 );

   // !!!!!  GRETCHEN !!!! - THINGS ARE PRETTY CHANGED FROM HERE

   // DOWN TO THE CLOSING COMMENT BELOW!!!


    if ( GET_CR_ptr == 0 )
    {
        MessageBox(0, "ERROR!!!", "Second try", MB_OK);
        return 0;
    }

    // Pagelock the segment containing the code to be executed in

    // Ring 0.  This is a small model program, so CS is what we want.

    _asm    mov [ourCS], cs
    GlobalPageLock(ourCS);

    //

    // Use the call gate to show that at ring 0, the

    // instructions can be accessed.  We disable interrupts

    // around the 3 calls to ring 0.

    //

    _asm    cli
    ring0CR0 = GET_CR_ptr(0);
    ring0CR2 = GET_CR_ptr(2);
    ring0CR3 = GET_CR_ptr(3);
    _asm    sti

    // We don't need the segment pagelocked anymore

    GlobalPageUnlock(ourCS);

    sprintf(buffer, "From ring 0, CR0 = %08lX\r\n"
                    "From ring 0, CR2 = %08lX\r\n"
                    "From ring 0, CR3 = %08lX\r\n",
                    ring0CR0, ring0CR2, ring0CR3 );

    MessageBox(0, buffer, "Second try", MB_OK);

   // !!!!! GRETCHEN !!!!! THIS IS THE END OF THE BIG CHANGES


    //

    // Deallocate the 2 selectors we used.

    //

    FreeCallgate( (GENERIC_PROC)GET_CR_ptr );

    return 0;
}

// ring0asm.asm

;=================================
;  RING0, by Matt Pietrek, 1993
;  File: RING0ASM.ASM
;=================================
.model small
.386P
.code
public GET_CR
public GET_CR_RING3

GET_CR proc
    push    ebp
    mov     ebp, esp
    xor     eax, eax

    cmp     word ptr [ebp+8], 0
    jne     not_cr0
    mov     eax, cr0
    jmp     done

not_cr0:
    cmp     word ptr [ebp+8], 2
    jne     not_cr2
    mov     eax, cr2
    jmp     done

not_cr2:
    cmp     word ptr [ebp+8], 3
    jne     done
    mov     eax, cr3

done:
    mov     edx, eax
    shr     edx, 16
    pop     ebp
    retf    2
GET_CR endp

;
; GET_CR3_RING3 is identical in function to GET_CR.  The only
; difference is that it will be called while running on the
; 16 bit stack of the calling app, instead of on the ring 0
; stack.  You might think that the "push ebp / mov ebp,esp"
; code for GET_CR would work in either case, but there is
; some strangeness in the "mov ebp, esp" instruction that
; forces us to use to very slightly different versions.
;
GET_CR_RING3 proc
    push    bp
    mov     bp, sp
    xor     eax, eax

    cmp     word ptr [bp+6], 0
    jne     not_cr0_ring3
    mov     eax, cr0
    jmp     done_ring3

not_cr0_ring3:
    cmp     word ptr [bp+6], 2
    jne     not_cr2_ring3
    mov     eax, cr2
    jmp     done_ring3

not_cr2_ring3:
    cmp     word ptr [bp+6], 3
    jne     done_ring3
    mov     eax, cr3

done_ring3:
    mov     edx, eax
    shr     edx, 16
    pop     bp
    retf    2
GET_CR_RING3 endp

end

// descript.h

#ifndef __DESCRIPT_H
#define __DESCRIPT_H

// GRETCHEN: The comment below is new, and the #pragma is uncommented

// We need the pack directive to force MSC to byte align

#pragma pack(1)

typedef struct
{
    unsigned short  limit_0_15;
    unsigned short  base_0_15;
    unsigned char   base_16_23;

    unsigned int    accessed    : 1;
    unsigned int    readable    : 1;
    unsigned int    conforming  : 1;
    unsigned int    code_data   : 1;
    unsigned int    app_system  : 1;
    unsigned int    dpl         : 2;
    unsigned int    present     : 1;

    unsigned int    limit_16_19 : 4;
    unsigned int    unused      : 1;
    unsigned int    always_0    : 1;
    unsigned int    seg_16_32   : 1;
    unsigned int    granularity : 1;

    unsigned char   base_24_31;
} CODE_SEG_DESCRIPTOR;

typedef struct
{
    unsigned short  offset_0_15;
    unsigned short  selector;

    unsigned int    param_count : 4;
    unsigned int    some_bits   : 4;

    unsigned int    type        : 4;
    unsigned int    app_system  : 1;
    unsigned int    dpl         : 2;
    unsigned int    present     : 1;

    unsigned short  offset_16_31;
} CALLGATE_DESCRIPTOR;

unsigned short GetLDTAlias(void);

typedef void (_far _pascal * GENERIC_PROC)(void);

GENERIC_PROC CreateCallgate(void far * func_address, unsigned params);
void FreeCallgate( GENERIC_PROC callgate_ptr );

#endif

// descript.c

#include <windows.h>
#include "descript.h"

static char MS_DOS_STR[] = "MS-DOS";

//

// Return a far pointer to the LDT

//

unsigned short GetLDTAlias(void)
{
    unsigned short  LDT_alias;
    unsigned short  (far * dpmiproc)(void);

    //

    // Use INT 2Fh, fn. 168A to get the "DPMI extensions

    // entry point" function pointer

    //

    _asm     mov     si, offset MS_DOS_STR   // DS:SI = "MS-DOS"

    _asm     mov     ax, 168Ah
    _asm     int     2Fh
    _asm     cmp     al, 8Ah
    _asm     je      extensions_not_found

    //

    // The entry point is returned in ES:DI.  Save it

    //

    _asm     mov     word ptr [dpmiproc], di
    _asm     mov     word ptr [dpmiproc+2], es

    //

    // Call the extensions with AX == 0x100.  The LDT alias

    // selector is return in AX.  Carry flag is set on failure.

    //

    _asm     mov     ax, 100h
    LDT_alias = dpmiproc();
    _asm     jc      extensions_not_found;

    return  LDT_alias;

extensions_not_found:   // We get here if something failed

    return  0;
}

//

// Given a far 16:16 address, create a function pointer for it,

// and which uses a call gate.

//

GENERIC_PROC CreateCallgate(void far * func_address, unsigned params)
{
    CALLGATE_DESCRIPTOR far *callgate_desc;
    CODE_SEG_DESCRIPTOR far *ring0_desc;
    unsigned short ldt_alias;
    unsigned short ring_0_alias;
    unsigned short callgate_selector;

    if ( (ldt_alias = GetLDTAlias()) == 0 )
        return 0;

    //

    // Grab a selector from Windows that has the exact same

    // attributes as the CS portion of "func_address"

    //

    if ((ring_0_alias = AllocSelector(HIWORD(func_address)))==0)
        return 0;

    //

    // Change the DPL bits of the ring 0 alias descriptor to

    // be privilege 0.

    //

    ring0_desc = MAKELP( ldt_alias, ring_0_alias & 0xFFF8 );
    ring0_desc->dpl = 0;

    //

    // Allocate the selector that'll be used for the call gate

    //

    if ( (callgate_selector= AllocSelector(0)) == 0 )
    {
        FreeSelector( ring_0_alias );
        return 0;
    }

    //

    // Create a pointer to the call gate descriptor

    //

    callgate_desc = MAKELP( ldt_alias, callgate_selector & 0xFFF8 );

    //

    // Fill in the fields of the call gate descriptor with the

    // appropriate values for a 16 bit callgate.

    //

    callgate_desc->offset_0_15 = LOWORD( func_address );
    callgate_desc->selector = ring_0_alias;
    callgate_desc->param_count = params;
    callgate_desc->some_bits = 0;
    callgate_desc->type = 4;            // 286 call gate

    callgate_desc->app_system = 0;      // A system descriptor

    callgate_desc->dpl = 3;             // Ring 3 code can call

    callgate_desc->present = 1;
    callgate_desc->offset_16_31 = 0;

    return MAKELP( callgate_selector, 0 );
}

//

// Free a previously allocated call gate function pointer.

//

void FreeCallgate( GENERIC_PROC callgate_ptr )
{
    CALLGATE_DESCRIPTOR far *callgate_desc;
    unsigned short ldt_alias;

    if ( (ldt_alias = GetLDTAlias()) == 0 )
        return;

    //

    // Create a pointer to the call gate descriptor

    //

    callgate_desc = MAKELP( ldt_alias, HIWORD(callgate_ptr) & 0xFFF8 );

    //

    // First, free the ring 0 alias selector stored in the LDT

    // call gate descriptor, then free the call gate selector.

    //

    FreeSelector( callgate_desc->selector );
    FreeSelector( HIWORD(callgate_ptr) );
}