diff --git a/ReadCRDbgExt/Inc/ReadControlRegisters.h b/ReadCRDbgExt/Inc/ReadControlRegisters.h index c4ede35..538073f 100644 --- a/ReadCRDbgExt/Inc/ReadControlRegisters.h +++ b/ReadCRDbgExt/Inc/ReadControlRegisters.h @@ -49,6 +49,38 @@ typedef union _CR0_FLAGS { }; QWORD Value; } CR0_FLAGS, *PCR0_FLAGS; + +typedef union _CR4_FLAGS { + struct { + QWORD VME : 1; // Virtual-8086 Mode Extensions + QWORD PVI : 1; // Protected-Mode Virtual Interrupts + QWORD TSD : 1; // Time Stamp Disable + QWORD DE : 1; // Debugging Extensions + QWORD PSE : 1; // Page Size Extensions + QWORD PAE : 1; // Physical Address Extension + QWORD MCE : 1; // Machine-Check Enable + QWORD PGE : 1; // Page Global Enable + QWORD PCE : 1; // Performance-Monitoring Counter Enable + QWORD OSFXSR : 1; // Operating System Support for FXSAVE and FXRSTOR instructions + QWORD OSXMMEXCPT : 1; // Operating System Support for Unmasked SIMD Floating-Point Exceptions + QWORD UMIP : 1; // User-Mode Instruction Prevention + QWORD LA57 : 1; // 57-bit linear addresses + QWORD VMXE : 1; // VMX-Enable Bit + QWORD SMXE : 1; // SMX-Enable Bit + QWORD Reserved1 : 1; // Reserved + QWORD FSGSBASE : 1; // FSGSBASE-Enable Bit + QWORD PCIDE : 1; // PCID-Enable Bit + QWORD OSXSAVE : 1; // XSAVE and Processor Extended States-Enable Bit + QWORD KL : 1; // Key-Locker-Enable Bit + QWORD SMEP : 1; // SMEP-Enable Bit + QWORD SMAP : 1; // SMAP-Enable Bit + QWORD PKE : 1; // Enable protection keys for user-mode pages + QWORD CET : 1; // Control-flow Enforcement Technology + QWORD PKS : 1; // Enable protection keys for supervisor-mode pages + QWORD UINTR : 1; // User Interrupts Enable Bit + }; + QWORD Value; +} CR4_FLAGS, *PCR4_FLAGS; #pragma warning(pop) #pragma endregion @@ -89,4 +121,19 @@ extern "C" __declspec(dllexport) VOID __stdcall readcr0( _In_ PCSTR strArgs ); +/// @brief Built-in command to display Control Register 4 (CR4) flags +/// @param hCurrentProcess Handle for the current process +/// @param hCurrentThread Handle for the current thread +/// @param qwCurrentPc Program counter +/// @param dwProcessor Current processor +/// @param strArgs Command line arguments +/// @return None +extern "C" __declspec(dllexport) VOID __stdcall readcr4( + _In_ HANDLE hCurrentProcess, + _In_ HANDLE hCurrentThread, + _In_ QWORD qwCurrentPc, + _In_ DWORD dwProcessor, + _In_ PCSTR strArgs +); + #pragma endregion \ No newline at end of file diff --git a/ReadCRDbgExt/Src/ReadControlRegisters.cpp b/ReadCRDbgExt/Src/ReadControlRegisters.cpp index c36874d..0bf2fbb 100644 --- a/ReadCRDbgExt/Src/ReadControlRegisters.cpp +++ b/ReadCRDbgExt/Src/ReadControlRegisters.cpp @@ -41,6 +41,7 @@ VOID __stdcall help( "Help for debugger extension DLL ReadCRDbgExt.dll\n" " help - Show help menu\n" " readcr0 - Display CR0 flags\n" + " readcr4 - Display CR4 flags\n" ); } @@ -80,7 +81,7 @@ VOID __stdcall readcr0( // Display CR0 flags dprintf( " |-----|------|--------|\n" - " | %-3s | %-3s | %-6s |\n" + " | %-3s | %-4s | %-6s |\n" " |-----|------|--------|\n", "Bit", "Flag", "Status" ); @@ -160,4 +161,204 @@ cleanup: return; } +VOID __stdcall readcr4( + _In_ HANDLE hCurrentProcess, + _In_ HANDLE hCurrentThread, + _In_ QWORD qwCurrentPc, + _In_ DWORD dwProcessor, + _In_ PCSTR strArgs +) { + UNREFERENCED_PARAMETER(hCurrentProcess); + UNREFERENCED_PARAMETER(hCurrentThread); + UNREFERENCED_PARAMETER(qwCurrentPc); + UNREFERENCED_PARAMETER(strArgs); + + dprintf("[!] Current processor number = %d\n", dwProcessor); + + // Init local variables + BOOLEAN bEvaluated = FALSE; + QWORD qwCR4 = 0; + CR4_FLAGS cr4Flags; ZERO_MEMORY(&cr4Flags, sizeof(CR4_FLAGS)); + + // Determine if the target uses 64-bit pointers + if (!IsPtr64()) { + dprintf("[-] IA-32 target is not supported by this extension!\n"); + goto cleanup; + } + + // Read CR4 value + bEvaluated = (BOOLEAN)GetExpressionEx("@cr4", &qwCR4, NULL); + if (!bEvaluated) { + dprintf("[-] Error evaluating MASM expression!\n"); + goto cleanup; + } + dprintf("[+] CR4 = 0x%I64X\n", qwCR4); + + // Display CR4 flags + dprintf( + " |-----|------------|--------|\n" + " | %-3s | %-10s | %-6s |\n" + " |-----|------------|--------|\n", + "Bit", "Flag", "Status" + ); + + cr4Flags.Value = qwCR4; + + dprintf( + " | %3d | %10s | %6d |\n", + 0, + "VME", + cr4Flags.VME + ); + dprintf( + " | %3d | %10s | %6d |\n", + 1, + "PVI", + cr4Flags.PVI + ); + dprintf( + " | %3d | %10s | %6d |\n", + 2, + "TSD", + cr4Flags.TSD + ); + dprintf( + " | %3d | %10s | %6d |\n", + 3, + "DE", + cr4Flags.DE + ); + dprintf( + " | %3d | %10s | %6d |\n", + 4, + "PSE", + cr4Flags.PSE + ); + dprintf( + " | %3d | %10s | %6d |\n", + 5, + "PAE", + cr4Flags.PAE + ); + dprintf( + " | %3d | %10s | %6d |\n", + 6, + "MCE", + cr4Flags.MCE + ); + dprintf( + " | %3d | %10s | %6d |\n", + 7, + "PGE", + cr4Flags.PGE + ); + dprintf( + " | %3d | %10s | %6d |\n", + 8, + "PCE", + cr4Flags.PCE + ); + dprintf( + " | %3d | %10s | %6d |\n", + 9, + "OSFXSR", + cr4Flags.OSFXSR + ); + dprintf( + " | %3d | %10s | %6d |\n", + 10, + "OSXMMEXCPT", + cr4Flags.OSXMMEXCPT + ); + dprintf( + " | %3d | %10s | %6d |\n", + 11, + "UMIP", + cr4Flags.UMIP + ); + dprintf( + " | %3d | %10s | %6d |\n", + 12, + "LA57", + cr4Flags.LA57 + ); + dprintf( + " | %3d | %10s | %6d |\n", + 13, + "VMXE", + cr4Flags.VMXE + ); + dprintf( + " | %3d | %10s | %6d |\n", + 14, + "SMXE", + cr4Flags.SMXE + ); + dprintf( + " | %3d | %10s | %6d |\n", + 16, + "FSGSBASE", + cr4Flags.FSGSBASE + ); + dprintf( + " | %3d | %10s | %6d |\n", + 17, + "PCIDE", + cr4Flags.PCIDE + ); + dprintf( + " | %3d | %10s | %6d |\n", + 18, + "OSXSAVE", + cr4Flags.OSXSAVE + ); + dprintf( + " | %3d | %10s | %6d |\n", + 19, + "KL", + cr4Flags.KL + ); + dprintf( + " | %3d | %10s | %6d |\n", + 20, + "SMEP", + cr4Flags.SMEP + ); + dprintf( + " | %3d | %10s | %6d |\n", + 21, + "SMAP", + cr4Flags.SMAP + ); + dprintf( + " | %3d | %10s | %6d |\n", + 22, + "PKE", + cr4Flags.PKE + ); + dprintf( + " | %3d | %10s | %6d |\n", + 23, + "CET", + cr4Flags.CET + ); + dprintf( + " | %3d | %10s | %6d |\n", + 24, + "PKS", + cr4Flags.PKS + ); + dprintf( + " | %3d | %10s | %6d |\n", + 25, + "UINTR", + cr4Flags.UINTR + ); + + dprintf(" |-----|------------|--------|\n"); + +cleanup: + return; +} + #pragma endregion \ No newline at end of file