Skip to content

Commit

Permalink
Update README.md
Browse files Browse the repository at this point in the history
  • Loading branch information
gmh5225 authored Nov 10, 2023
1 parent 34ea5fa commit 12f5ef3
Showing 1 changed file with 25 additions and 1 deletion.
26 changes: 25 additions & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -11,13 +11,37 @@ libwindrv is a windows driver library for testing the llvm-msvc compiler when tu
- [ARM64 Kits](https://learn.microsoft.com/en-us/windows-hardware/drivers/develop/building-arm64-drivers)
- [llvm-msvc](https://github.com/backengineering/llvm-msvc/releases)

## How to enable Kernel CET?
## How to enable KCET?
```
reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity /v Enabled /t REG_DWORD /d 1 /f
reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\KernelShadowStacks /v Enabled /t REG_DWORD /d 1 /f
reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\KernelShadowStacks /v AuditModeEnabled /t REG_DWORD /d 1 /f
```

## How can I tell if KCET has been successfully enabled?
```C++
// If the following code causes a BSOD, it means that KCET has been successfully activated.
DECLSPEC_NOINLINE
EXTERN_C
void
KCETBSOD()
{
#ifndef _ARM64_
__try
{
_asm
{
int 0x2D
}
}
__except (EXCEPTION_EXECUTE_HANDLER)
{
printf("except in KCETBSOD\n");
}
#endif
}
```

## What does dump look like?
```
KERNEL_SECURITY_CHECK_FAILURE (139)
Expand Down

0 comments on commit 12f5ef3

Please sign in to comment.