2

I have read it is possible to check ring level with bit 3 of CS register.

Is there another register which really contains ring value (2 bits)

Thanks

  • The Current Privilege Level can be found in bits 1 and 0 of CS. – Ian Cook Apr 12 at 11:46
0

are you looking for this ?

0:002> dx (( ntdll!_KTHREAD *) @$thread)->PreviousMode
(( ntdll!_KTHREAD *) @$thread)->PreviousMode : 0 [Type: char]
0:002> ?? (( ntdll!_KTHREAD *) @$thread)->PreviousMode
char 0n0 ''

or in kmode

0: kd> dq gs:[188] l1
002b:00000000`00000188  ffff8889`d75ce080
0: kd> ? @$thread
Evaluate expression: -131349371625344 = ffff8889`d75ce080
0: kd> dx @$thread->Tcb.PreviousMode
@$thread->Tcb.PreviousMode : 1 [Type: char]
0: kd> uf nt!ExGetPreviousMode
nt!ExGetPreviousMode:
fffff804`41c45f00 65488b042588010000 mov   rax,qword ptr gs:[188h]
fffff804`41c45f09 0fb68032020000  movzx   eax,byte ptr [rax+232h]
fffff804`41c45f10 c3              ret
0: kd> ?? #FIELD_OFFSET(nt!_KTHREAD , PreviousMode)
long 0n562
0: kd> ? 0n562
Evaluate expression: 562 = 00000000`00000232
| improve this answer | |
  • Yes, how do you print this information ? with qemu ? – Bob5421 Apr 16 at 5:57
  • not sure if I understand you if you wanted to know how I printed this --- it is with windbg --- if you are asking how to print it with Qemu by programming I don't know--- all I know is you can start a kernel debugging session attaching to a Qemu instance with windbg – blabb Apr 16 at 14:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.