Entering Ring 0 using minimalistic approach

#include    <windows.h>
#include    <stdio.h>

#pragma pack(1)

struct  CALL_GATE { WORD addrlo; WORD seg; BYTE arg:5; BYTE u:3; BYTE typ:5; BYTE dpl:2; BYTE pres:1; WORD addrhi; } ;

#define Virtual(a,b,c,d) { struct VIRTUAL{void* A;void* B;DWORD C;}; VIRTUAL v={(void*)(a),b,c}; hr=NtSystemDebugControl(d,&v,sizeof(v),0,0,0); }


void Ring0( DWORD cs, char*& text ) {
    text = "Hello World from Ring 0 \n";        
    __asm mov eax,cr0
    __asm leave
    __asm retf 4
}

int main() {

    LONG (NTAPI *NtSystemDebugControl)     (int,void*,DWORD,void*,DWORD,DWORD*);
    *(DWORD*)   &NtSystemDebugControl    =(DWORD)GetProcAddress(LoadLibrary(TEXT("ntdll")),"NtSystemDebugControl");

    TOKEN_PRIVILEGES pv={1},po; pv.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED ; HANDLE t; int hr; DWORD no;
    
    // This will enable NtSystemDebugControl usage
    hr = LookupPrivilegeValue(  0, SE_DEBUG_NAME, &pv.Privileges[0].Luid );
    hr = OpenProcessToken(      GetCurrentProcess(), TOKEN_ALL_ACCESS,&t);
    hr = AdjustTokenPrivileges( t,0,&pv,sizeof(po),&po, &no);
    
    // This ensures that on multi cpu/core systems we patch the right GDT for right cpu
    hr = SetThreadAffinityMask (GetCurrentThread(),1); Sleep(100);

    // We read GDT table
    LDT_ENTRY gdt[1000]={0}; struct {WORD limit;DWORD base;} gdtr; __asm sgdt gdtr
    
    // Find free spot
    int gate;
    Virtual(gdtr.base, &gdt,gdtr.limit,8);    for(gate=1;gate<100;gate++)    { if(!gdt[gate].HighWord.Bits.Pres) break; }    
    
    // Construct Call Gate pointing to Ring0 proc and write it there
    DWORD addr=(DWORD)Ring0; CALL_GATE g={addr&0xffff,8,1,0,12,3,1,addr>>16}; Virtual(gdtr.base+gate*8, &g,8,9); 
    
    // Quite ugly way to do far call 
    WORD farcall[3]={0,0,(gate<<3)}; char* param=0,**p=¶m; long result=0; 

    // Switch from Ring 3 to Ring 0 is just normal call ;)
    __asm push p
    __asm call fword ptr [farcall]
    __asm mov  result, eax

    // Cleanup Call Gate from GDT
    __int64 c=0; Virtual(gdtr.base+gate*8, &c,8,9); 

    printf("\n %s\n  CR0 = %X ",param,result); getchar();    

    return 0;
}

#pragma pack (push, 1)
struct CALL_GATE
{
	WORD addrlo;
	WORD seg;
	BYTE arg : 5;
	BYTE u : 3;
	BYTE typ : 5;
	BYTE dpl : 2;
	BYTE pres : 1;
	WORD addrhi;
};
struct SYSDBG_VIRTUAL
{
	void* Address;
	void* Buffer;
	ULONG Length;
};
#pragma pack (pop)

struct QUERY_OBJECT_NAME_INFO
{
	PVOID Object;
	PVOID Buffer;
	ULONG Length;
	ULONG* LengthNeeded;
	NTSTATUS Result;
};

NTSTATUS NTAPI ObOpenObjectByName(IN POBJECT_ATTRIBUTES ObjectAttributes, IN struct _OBJECT_TYPE* ObjectType, IN KPROCESSOR_MODE AccessMode, IN struct _ACCESS_STATE* PassedAccessState, IN ACCESS_MASK DesiredAccess, IN OUT PVOID ParseContext, OUT PHANDLE Handle)
{
	OPEN_OBJECT_BY_NAME_INFO info = {0};
	info.ObjectAttributes = ObjectAttributes;
	info.ObjectType = ObjectType;
	info.AccessMode = AccessMode;
	info.PassedAccessState = PassedAccessState;
	info.DesiredAccess = DesiredAccess;
	info.ParseContext = ParseContext;
	info.Handle = Handle;
	NTSTATUS result = SystemCall((KERNELPROC)ObOpenObjectByNameInternal, &info);
	if (NT_SUCCESS(result)) { result = info.Result; }
	return result;
}


void NTAPI ObQueryNameStringInternal(IN OUT QUERY_OBJECT_NAME_INFO* pInfo)
{ pInfo->Result = (*pObQueryNameString)(pInfo->Object, pLocalBuffer, pInfo->Length, &lengthNeededLocal); }

//I don't know assembly to edit the call code, so I created this function so I don't use the first parameter
void Ring0Call(DWORD, SYSCALL_INFO* info)
{
	__try { (*info->Function)(info->Context); } __except (1) { }
	__asm
	{
		mov eax, cr0
			leave
			retf 4
	}
}

struct SYSCALL_INFO
{
	KERNELPROC Function;
	PVOID Context;
};

__inline NTSTATUS ReadVirtual(void* address, void* buffer, ULONG length) { SYSDBG_VIRTUAL v = { address, buffer, length }; return NtSystemDebugControl(8, &v, sizeof(v), 0, 0, 0); }
__inline NTSTATUS WriteVirtual(void* address, void* buffer, ULONG length) { SYSDBG_VIRTUAL v = { address, buffer, length }; return NtSystemDebugControl(9, &v, sizeof(v), 0, 0, 0); }
NTSTATUS SystemCall(KERNELPROC function, PVOID context)
{
	NTSTATUS status;
	THREAD_BASIC_INFORMATION threadInfo;
	ULONG retLength;
	status = NtQueryInformationThread(GetCurrentThread(), ThreadBasicInformation, &threadInfo, sizeof(threadInfo), &retLength);
	if (!NT_SUCCESS(status)) { return status; }

	LDT_ENTRY gdt[1000] = {0};
	short gate;

	SYSCALL_INFO info = { function, context };
	DWORD addr = (DWORD)Ring0Call;
	CALL_GATE callGate = { addr & 0xFFFF, 8, 1, 0, 12, 3, 1, addr >> 16 };
#pragma pack (push, 1)
	struct { WORD limit; DWORD base; } gdtr;
#pragma pack (pop)



	// This ensures that on multi cpu/core systems we patch the right GDT for right cpu
	KAFFINITY one = 1;
	status = NtSetInformationThread(GetCurrentThread(), ThreadAffinityMask, &one, sizeof(one));
	if (!NT_SUCCESS(status)) { return status; }
	__try
	{
		Sleep(100);

		int threadPriority = GetThreadPriority(GetCurrentThread());
		//Prevent interruptions between reading & writing the call gate info as much as possible
		if (threadPriority != THREAD_PRIORITY_ERROR_RETURN) { SetThreadPriority(GetCurrentThread(), THREAD_PRIORITY_TIME_CRITICAL); }
		__try
		{
			// We read GDT table
			__asm sgdt gdtr
				// Find free spot
				status = ReadVirtual((void*)gdtr.base, &gdt, gdtr.limit);

			if (!NT_SUCCESS(status)) { return status; }

			for (gate = 1; gate < 100; gate++)
			{ if (!gdt[gate].HighWord.Bits.Pres) break; }

			// Construct Call Gate pointing to Ring0 proc and write it there
			status = WriteVirtual((void*)(gdtr.base + gate * 8), &callGate, sizeof(callGate));
			if (!NT_SUCCESS(status)) { return status; }
		}
		__finally { SetThreadPriority(GetCurrentThread(), threadPriority); }
	}
	__finally { NtSetInformationThread(GetCurrentThread(), ThreadAffinityMask, &threadInfo.AffinityMask, sizeof(threadInfo.AffinityMask)); }

	__try
	{
		// Quite ugly way to do far call
		short farcall[3] = { 0, 0, gate << 3 };

		PVOID pInfo = &info;
		// Switch from Ring 3 to Ring 0 is just normal call ;)
		long result; 
		__asm
		{
			push pInfo
				call fword ptr [farcall]
			mov result, eax
		}
	}
	__finally
	{
		// Cleanup Call Gate from GDT
		__int64 c = 0;
		status = WriteVirtual((void*)(gdtr.base + gate * 8), &c, sizeof(c));
	}

	return status;
}

void mainCRTStartup()
{
	PVOID pSomeObject; //Just hard-code a pointer to an object whose address you know... use a program like ProcExp (from SysInternals) or something.
	hKernel = LoadLibrary(__TEXT("ntkrnlpa.exe"));
	pObQueryNameString = (ObQueryNameStringPointer)GetProcAddress(hKernel, "ObQueryNameString");
	char objectName[4096];
	ULONG needed;
	//I get "Unhandled exception at 0x00000000 in KernelHelper.exe: 0xC000001D: Illegal Instruction."
	NTSTATUS status = ObQueryNameString(pSomeObject, objectName, sizeof(objectName), &needed);
}