diff --git a/README.md b/README.md index 9a0806a..2237cf0 100644 --- a/README.md +++ b/README.md @@ -11,13 +11,37 @@ libwindrv is a windows driver library for testing the llvm-msvc compiler when tu - [ARM64 Kits](https://learn.microsoft.com/en-us/windows-hardware/drivers/develop/building-arm64-drivers) - [llvm-msvc](https://github.com/backengineering/llvm-msvc/releases) -## How to enable Kernel CET? +## How to enable KCET? ``` reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity /v Enabled /t REG_DWORD /d 1 /f reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\KernelShadowStacks /v Enabled /t REG_DWORD /d 1 /f reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\KernelShadowStacks /v AuditModeEnabled /t REG_DWORD /d 1 /f ``` +## How can I tell if KCET has been successfully enabled? +```C++ +// If the following code causes a BSOD, it means that KCET has been successfully activated. +DECLSPEC_NOINLINE +EXTERN_C +void +KCETBSOD() +{ +#ifndef _ARM64_ + __try + { + _asm + { + int 0x2D + } + } + __except (EXCEPTION_EXECUTE_HANDLER) + { + printf("except in KCETBSOD\n"); + } +#endif +} +``` + ## What does dump look like? ``` KERNEL_SECURITY_CHECK_FAILURE (139)