如何编程实现windows用户无法进入安全模式

如题
不要求代码
能给提示也行
谢谢各位大虾！

估计要修改NTLTD吧。当然这只是我的推测。

注册表safeboot项下面是安全模式下要启动的服务和驱动，写个程序，系统启动时检测safeboot下的一个变量，可以知道是不是安全模式

两种模式下观察一下safeboot项就很清楚了

谢谢回复 不过有个问题我还是想问一下
hongdou
你认为那种在系统启动之前，就能检测注册表的程序应该怎么写
写一个服务程序还是驱动程序？
我要用的这个程序可是在系统启动大部分服务和驱动程序之前运行！
盼望大虾们的回复！

关注

高手呀，你快点出来呀

extern PULONG InitSafeBootMode;
...........
if(*InitSafeBootMode > 0)
{
    KeBugCheck(0);
}

extern PULONG InitSafeBootMode;
...........
if(*InitSafeBootMode > 0)
{
    KeBugCheck(0);
}
 

似乎很明白，理所当然，但该怎么用，用在哪里，晕！！

[quote]extern PULONG InitSafeBootMode;
...........
if(*InitSafeBootMode > 0)
{
    KeBugCheck(0);
}
 

似乎很明白，理所当然，但该怎么用，用在哪里，晕！！ [/quote]

DriverEntry


But with this code, nobody can enter safe-mode and there is always a blue-screen or reboot when it's booting into safe-mode :D

Check your design carefully to avoid this

对于斑竹大人的敬仰有如滔滔江水，连绵不绝
黄河泛滥，一发不可收拾！
受小弟一拜

How to determine whether the system is running in Safe Mode from a device driver
SUMMARY
This article describes how to determine whether the system is running in Safe Mode from a device driver.
MORE INFORMATION
The Windows OS kernel exports a pointer to a ULONG variable that is named InitSafeBootMode. This variable contains the Safe Mode settings.

A device driver can determine whether the system is running in Safe Mode by the value of the InitSafeBootMode variable. A value of 0 means that the system is not running in Safe Mode.

The following table lists the modes for other values.Value  Mode
1  SAFEBOOT_MINIMAL
2  SAFEBOOT_NETWORK
3*  SAFEBOOT_DSREPAIR
*Note The value of 3 applies to Windows domain controllers only.

You must declare the following in your driver. extern PULONG InitSafeBootMode;

You must check the value of InitSafeBootMode to determine whether the system is running in Safe Mode.if (*InitSafeBootMode > 0){

     // The system is in Safe Mode.
     // Take appropriate action.
     //
}
For example, to prevent a driver from working in Safe Mode, use one of the following methods: • Function drivers

If your function driver has a service start type of SERVICE_BOOT_START, check the value of the InitSafeBootMode variable in the AddDevice routine and return failure.

Note You must never return failure from the DriverEntry routine.
• Filter drivers

If your filter driver starts during boot time, check the value of the InitSafeBootMode variable in the AddDevice routine. Do not attach to the device stack. Return success from the AddDevice routine.
• Other drivers

For drivers that are not mentioned earlier, check the value of the InitSafeBootMode variable in the DriverEntry routine. Return failure if the system is in Safe Mode.  

老大都说了，也没什么好说的了 :D

对按rayyang2000 的方法判断是不是安全模式，如果是就可以锁定或退出系统，这样不就OK了

How to determine whether the system is running in Safe Mode from a device driver
SUMMARY
This article describes how to determine whether the system is running in Safe Mode from a device driver.
MORE INFORMATION
The Windows OS kernel exports a pointer to a ULONG variable that is named InitSafeBootMode. This variable contains the Safe Mode settings.

A device driver can determine whether the system is running in Safe Mode by the value of the InitSafeBootMode variable. A value of 0 means that the system is not running in Safe Mode.

The following table lists the modes for other values.Value  Mode
1  SAFEBOOT_MINIMAL
2  SAFEBOOT_NETWORK
3*  SAFEBOOT_DSREPAIR
*Note The value of 3 applies to Windows domain controllers only.

You must declare the following in your driver. extern PULONG InitSafeBootMode;

You must check the value of InitSafeBootMode to determine whether the system is running in Safe Mode.if (*InitSafeBootMode > 0){

     // The system is in Safe Mode.
     // Take appropriate action.
     //
}
For example, to prevent a driver from working in Safe Mode, use one of the following methods: • Function drivers

If your function driver has a service start type of SERVICE_BOOT_START, check the value of the InitSafeBootMode variable in the AddDevice routine and return failure.

Note You must never return failure from the DriverEntry routine.
• Filter drivers

If your filter driver starts during boot time, check the value of the InitSafeBootMode variable in the AddDevice routine. Do not attach to the device stack. Return success from the AddDevice routine.
• Other drivers

For drivers that are not mentioned earlier, check the value of the InitSafeBootMode variable in the DriverEntry routine. Return failure if the system is in Safe Mode.  
 

up

这个帖子很深刻啊！