Files
2025-07-14 12:30:34 -04:00
..
2025-07-14 12:30:34 -04:00

EVENSTAR - GetCPL

Version

  • v1.0.0

Brief

  • ISA: x86
  • Mode: Real, Protected, Compatibility, Long
  • Bitness: 16-bit, 32-bit, 64-bit
  • CPL: 0, 3
  • OS: Windows
  • Language: C
  • Sample code that demonstrates the usage of the SMSW instruction to fetch the Machine Status Word (bits 0 through 15 of control register CR0) and check the processor's Current Privilege Level (CPL) if the processor is running in Protected mode

Usage

  • There aren't a lot of useful bits in the MSW
  • One notable exception: PE (Protection Enable) bit (0)
  • This flag enables Segmentation
  • The processor maintains an internal state called CPL which is defined as the privilege level of the currently executing code
  • CPL is used to determine whether certain operations are permitted or not
  • CPL is given by CS.RPL (bits 0 and 1)
C:\pub\bld\DriverRun>GetCPL.exe
[*] GetCPL Built Jun 16 2025 18:13:39
Press any key to continue . . .
[DBG]: user-mode
Press any key to continue . . .

[DBG]: +++ GetCPL.sys Loaded +++
[DBG]: GetCPL.sys Built Jun 17 2025 07:12:51
[DBG]: GetCPL: DriverObject = FFFFC486721BDAF0
[DBG]: GetCPL: RegistryPath = \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\GetCPL
[DBG]: supervisor-mode
[DBG]: --- GetCPL.sys Unloaded ---

Tested OS Versions

  • Windows 11 21H2 Build 22000 Revision 675 64-bit

References

  1. SMSW — Store Machine Status Word
  2. The Segmented Memory Model and How It Works in Windows x64