I have read it is possible to check ring level with bit 3 of CS register.
Is there another register which really contains ring value (2 bits)
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.Sign up to join this community
are you looking for this ?
0:002> dx (( ntdll!_KTHREAD *) @$thread)->PreviousMode (( ntdll!_KTHREAD *) @$thread)->PreviousMode : 0 [Type: char] 0:002> ?? (( ntdll!_KTHREAD *) @$thread)->PreviousMode char 0n0 ''
or in kmode
0: kd> dq gs: l1 002b:00000000`00000188 ffff8889`d75ce080 0: kd> ? @$thread Evaluate expression: -131349371625344 = ffff8889`d75ce080 0: kd> dx @$thread->Tcb.PreviousMode @$thread->Tcb.PreviousMode : 1 [Type: char] 0: kd> uf nt!ExGetPreviousMode nt!ExGetPreviousMode: fffff804`41c45f00 65488b042588010000 mov rax,qword ptr gs:[188h] fffff804`41c45f09 0fb68032020000 movzx eax,byte ptr [rax+232h] fffff804`41c45f10 c3 ret 0: kd> ?? #FIELD_OFFSET(nt!_KTHREAD , PreviousMode) long 0n562 0: kd> ? 0n562 Evaluate expression: 562 = 00000000`00000232