mirror of
https://github.com/winterknife/EVENSTAR
synced 2026-06-21 14:13:51 +00:00
added capability to display CR4 flags
This commit is contained in:
winterknife
@@ -49,6 +49,38 @@ typedef union _CR0_FLAGS {
|
||||
};
|
||||
QWORD Value;
|
||||
} CR0_FLAGS, *PCR0_FLAGS;
|
||||
|
||||
typedef union _CR4_FLAGS {
|
||||
struct {
|
||||
QWORD VME : 1; // Virtual-8086 Mode Extensions
|
||||
QWORD PVI : 1; // Protected-Mode Virtual Interrupts
|
||||
QWORD TSD : 1; // Time Stamp Disable
|
||||
QWORD DE : 1; // Debugging Extensions
|
||||
QWORD PSE : 1; // Page Size Extensions
|
||||
QWORD PAE : 1; // Physical Address Extension
|
||||
QWORD MCE : 1; // Machine-Check Enable
|
||||
QWORD PGE : 1; // Page Global Enable
|
||||
QWORD PCE : 1; // Performance-Monitoring Counter Enable
|
||||
QWORD OSFXSR : 1; // Operating System Support for FXSAVE and FXRSTOR instructions
|
||||
QWORD OSXMMEXCPT : 1; // Operating System Support for Unmasked SIMD Floating-Point Exceptions
|
||||
QWORD UMIP : 1; // User-Mode Instruction Prevention
|
||||
QWORD LA57 : 1; // 57-bit linear addresses
|
||||
QWORD VMXE : 1; // VMX-Enable Bit
|
||||
QWORD SMXE : 1; // SMX-Enable Bit
|
||||
QWORD Reserved1 : 1; // Reserved
|
||||
QWORD FSGSBASE : 1; // FSGSBASE-Enable Bit
|
||||
QWORD PCIDE : 1; // PCID-Enable Bit
|
||||
QWORD OSXSAVE : 1; // XSAVE and Processor Extended States-Enable Bit
|
||||
QWORD KL : 1; // Key-Locker-Enable Bit
|
||||
QWORD SMEP : 1; // SMEP-Enable Bit
|
||||
QWORD SMAP : 1; // SMAP-Enable Bit
|
||||
QWORD PKE : 1; // Enable protection keys for user-mode pages
|
||||
QWORD CET : 1; // Control-flow Enforcement Technology
|
||||
QWORD PKS : 1; // Enable protection keys for supervisor-mode pages
|
||||
QWORD UINTR : 1; // User Interrupts Enable Bit
|
||||
};
|
||||
QWORD Value;
|
||||
} CR4_FLAGS, *PCR4_FLAGS;
|
||||
#pragma warning(pop)
|
||||
|
||||
#pragma endregion
|
||||
@@ -89,4 +121,19 @@ extern "C" __declspec(dllexport) VOID __stdcall readcr0(
|
||||
_In_ PCSTR strArgs
|
||||
);
|
||||
|
||||
/// @brief Built-in command to display Control Register 4 (CR4) flags
|
||||
/// @param hCurrentProcess Handle for the current process
|
||||
/// @param hCurrentThread Handle for the current thread
|
||||
/// @param qwCurrentPc Program counter
|
||||
/// @param dwProcessor Current processor
|
||||
/// @param strArgs Command line arguments
|
||||
/// @return None
|
||||
extern "C" __declspec(dllexport) VOID __stdcall readcr4(
|
||||
_In_ HANDLE hCurrentProcess,
|
||||
_In_ HANDLE hCurrentThread,
|
||||
_In_ QWORD qwCurrentPc,
|
||||
_In_ DWORD dwProcessor,
|
||||
_In_ PCSTR strArgs
|
||||
);
|
||||
|
||||
#pragma endregion
|
||||
@@ -41,6 +41,7 @@ VOID __stdcall help(
|
||||
"Help for debugger extension DLL ReadCRDbgExt.dll\n"
|
||||
" help - Show help menu\n"
|
||||
" readcr0 - Display CR0 flags\n"
|
||||
" readcr4 - Display CR4 flags\n"
|
||||
);
|
||||
}
|
||||
|
||||
@@ -80,7 +81,7 @@ VOID __stdcall readcr0(
|
||||
// Display CR0 flags
|
||||
dprintf(
|
||||
" |-----|------|--------|\n"
|
||||
" | %-3s | %-3s | %-6s |\n"
|
||||
" | %-3s | %-4s | %-6s |\n"
|
||||
" |-----|------|--------|\n",
|
||||
"Bit", "Flag", "Status"
|
||||
);
|
||||
@@ -160,4 +161,204 @@ cleanup:
|
||||
return;
|
||||
}
|
||||
|
||||
VOID __stdcall readcr4(
|
||||
_In_ HANDLE hCurrentProcess,
|
||||
_In_ HANDLE hCurrentThread,
|
||||
_In_ QWORD qwCurrentPc,
|
||||
_In_ DWORD dwProcessor,
|
||||
_In_ PCSTR strArgs
|
||||
) {
|
||||
UNREFERENCED_PARAMETER(hCurrentProcess);
|
||||
UNREFERENCED_PARAMETER(hCurrentThread);
|
||||
UNREFERENCED_PARAMETER(qwCurrentPc);
|
||||
UNREFERENCED_PARAMETER(strArgs);
|
||||
|
||||
dprintf("[!] Current processor number = %d\n", dwProcessor);
|
||||
|
||||
// Init local variables
|
||||
BOOLEAN bEvaluated = FALSE;
|
||||
QWORD qwCR4 = 0;
|
||||
CR4_FLAGS cr4Flags; ZERO_MEMORY(&cr4Flags, sizeof(CR4_FLAGS));
|
||||
|
||||
// Determine if the target uses 64-bit pointers
|
||||
if (!IsPtr64()) {
|
||||
dprintf("[-] IA-32 target is not supported by this extension!\n");
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
// Read CR4 value
|
||||
bEvaluated = (BOOLEAN)GetExpressionEx("@cr4", &qwCR4, NULL);
|
||||
if (!bEvaluated) {
|
||||
dprintf("[-] Error evaluating MASM expression!\n");
|
||||
goto cleanup;
|
||||
}
|
||||
dprintf("[+] CR4 = 0x%I64X\n", qwCR4);
|
||||
|
||||
// Display CR4 flags
|
||||
dprintf(
|
||||
" |-----|------------|--------|\n"
|
||||
" | %-3s | %-10s | %-6s |\n"
|
||||
" |-----|------------|--------|\n",
|
||||
"Bit", "Flag", "Status"
|
||||
);
|
||||
|
||||
cr4Flags.Value = qwCR4;
|
||||
|
||||
dprintf(
|
||||
" | %3d | %10s | %6d |\n",
|
||||
0,
|
||||
"VME",
|
||||
cr4Flags.VME
|
||||
);
|
||||
dprintf(
|
||||
" | %3d | %10s | %6d |\n",
|
||||
1,
|
||||
"PVI",
|
||||
cr4Flags.PVI
|
||||
);
|
||||
dprintf(
|
||||
" | %3d | %10s | %6d |\n",
|
||||
2,
|
||||
"TSD",
|
||||
cr4Flags.TSD
|
||||
);
|
||||
dprintf(
|
||||
" | %3d | %10s | %6d |\n",
|
||||
3,
|
||||
"DE",
|
||||
cr4Flags.DE
|
||||
);
|
||||
dprintf(
|
||||
" | %3d | %10s | %6d |\n",
|
||||
4,
|
||||
"PSE",
|
||||
cr4Flags.PSE
|
||||
);
|
||||
dprintf(
|
||||
" | %3d | %10s | %6d |\n",
|
||||
5,
|
||||
"PAE",
|
||||
cr4Flags.PAE
|
||||
);
|
||||
dprintf(
|
||||
" | %3d | %10s | %6d |\n",
|
||||
6,
|
||||
"MCE",
|
||||
cr4Flags.MCE
|
||||
);
|
||||
dprintf(
|
||||
" | %3d | %10s | %6d |\n",
|
||||
7,
|
||||
"PGE",
|
||||
cr4Flags.PGE
|
||||
);
|
||||
dprintf(
|
||||
" | %3d | %10s | %6d |\n",
|
||||
8,
|
||||
"PCE",
|
||||
cr4Flags.PCE
|
||||
);
|
||||
dprintf(
|
||||
" | %3d | %10s | %6d |\n",
|
||||
9,
|
||||
"OSFXSR",
|
||||
cr4Flags.OSFXSR
|
||||
);
|
||||
dprintf(
|
||||
" | %3d | %10s | %6d |\n",
|
||||
10,
|
||||
"OSXMMEXCPT",
|
||||
cr4Flags.OSXMMEXCPT
|
||||
);
|
||||
dprintf(
|
||||
" | %3d | %10s | %6d |\n",
|
||||
11,
|
||||
"UMIP",
|
||||
cr4Flags.UMIP
|
||||
);
|
||||
dprintf(
|
||||
" | %3d | %10s | %6d |\n",
|
||||
12,
|
||||
"LA57",
|
||||
cr4Flags.LA57
|
||||
);
|
||||
dprintf(
|
||||
" | %3d | %10s | %6d |\n",
|
||||
13,
|
||||
"VMXE",
|
||||
cr4Flags.VMXE
|
||||
);
|
||||
dprintf(
|
||||
" | %3d | %10s | %6d |\n",
|
||||
14,
|
||||
"SMXE",
|
||||
cr4Flags.SMXE
|
||||
);
|
||||
dprintf(
|
||||
" | %3d | %10s | %6d |\n",
|
||||
16,
|
||||
"FSGSBASE",
|
||||
cr4Flags.FSGSBASE
|
||||
);
|
||||
dprintf(
|
||||
" | %3d | %10s | %6d |\n",
|
||||
17,
|
||||
"PCIDE",
|
||||
cr4Flags.PCIDE
|
||||
);
|
||||
dprintf(
|
||||
" | %3d | %10s | %6d |\n",
|
||||
18,
|
||||
"OSXSAVE",
|
||||
cr4Flags.OSXSAVE
|
||||
);
|
||||
dprintf(
|
||||
" | %3d | %10s | %6d |\n",
|
||||
19,
|
||||
"KL",
|
||||
cr4Flags.KL
|
||||
);
|
||||
dprintf(
|
||||
" | %3d | %10s | %6d |\n",
|
||||
20,
|
||||
"SMEP",
|
||||
cr4Flags.SMEP
|
||||
);
|
||||
dprintf(
|
||||
" | %3d | %10s | %6d |\n",
|
||||
21,
|
||||
"SMAP",
|
||||
cr4Flags.SMAP
|
||||
);
|
||||
dprintf(
|
||||
" | %3d | %10s | %6d |\n",
|
||||
22,
|
||||
"PKE",
|
||||
cr4Flags.PKE
|
||||
);
|
||||
dprintf(
|
||||
" | %3d | %10s | %6d |\n",
|
||||
23,
|
||||
"CET",
|
||||
cr4Flags.CET
|
||||
);
|
||||
dprintf(
|
||||
" | %3d | %10s | %6d |\n",
|
||||
24,
|
||||
"PKS",
|
||||
cr4Flags.PKS
|
||||
);
|
||||
dprintf(
|
||||
" | %3d | %10s | %6d |\n",
|
||||
25,
|
||||
"UINTR",
|
||||
cr4Flags.UINTR
|
||||
);
|
||||
|
||||
dprintf(" |-----|------------|--------|\n");
|
||||
|
||||
cleanup:
|
||||
return;
|
||||
}
|
||||
|
||||
#pragma endregion
|
||||
Reference in New Issue
Block a user