Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- $NtQSIDefinition = @'
- [DllImport("ntdll.dll")]
- public static extern int NtQuerySystemInformation(uint systemInformationClass, IntPtr systemInformation, uint systemInformationLength, IntPtr returnLength);
- '@
- $ntdll = Add-Type -MemberDefinition $NtQSIDefinition -Name 'ntdll' -Namespace 'Win32' -PassThru
- [System.IntPtr]$systemInformationPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal(4)
- [System.IntPtr]$returnLengthPtr = [System.Runtime.InteropServices.Marshal]::AllocHGlobal(4)
- $Output
- try {
- $btiHardwarePresent = $false
- $btiWindowsSupportPresent = $false
- $btiWindowsSupportEnabled = $false
- $btiDisabledBySystemPolicy = $false
- $btiDisabledByNoHardwareSupport = $false
- [System.UInt32]$systemInformationClass = 201
- [System.UInt32]$systemInformationLength = 4
- $retval = $ntdll::NtQuerySystemInformation($systemInformationClass, $systemInformationPtr, $systemInformationLength, $returnLengthPtr)
- if ($retval -eq 0xc0000003 -or $retval -eq 0xc0000002) {
- # fallthrough
- }
- elseif ($retval -ne 0) {
- throw (("Querying branch target injection information failed with error {0:X8}" -f $retval))
- }
- else {
- [System.UInt32]$scfBpbEnabled = 0x01
- [System.UInt32]$scfBpbDisabledSystemPolicy = 0x02
- [System.UInt32]$scfBpbDisabledNoHardwareSupport = 0x04
- [System.UInt32]$scfHwReg1Enumerated = 0x08
- [System.UInt32]$scfHwReg2Enumerated = 0x10
- [System.UInt32]$scfHwMode1Present = 0x20
- [System.UInt32]$scfHwMode2Present = 0x40
- [System.UInt32]$scfSmepPresent = 0x80
- [System.UInt32]$flags = [System.UInt32][System.Runtime.InteropServices.Marshal]::ReadInt32($systemInformationPtr)
- $btiHardwarePresent = ((($flags -band $scfHwReg1Enumerated) -ne 0) -or (($flags -band $scfHwReg2Enumerated)))
- $btiWindowsSupportPresent = $true
- $btiWindowsSupportEnabled = (($flags -band $scfBpbEnabled) -ne 0)
- if ($btiWindowsSupportEnabled -eq $false) {
- $btiDisabledBySystemPolicy = (($flags -band $scfBpbDisabledSystemPolicy) -ne 0)
- $btiDisabledByNoHardwareSupport = (($flags -band $scfBpbDisabledNoHardwareSupport) -ne 0)
- }
- }
- if ($btiHardwarePresent) { $Output += "BTI_HwSupported-"} else {$Output += "BTI_NoHwSupport-"}
- if ($btiWindowsSupportPresent) { $Output += "BTI_OSSupported-"} else {$Output += "BTI_NoOSSupport-"}
- if ($btiWindowsSupportEnabled) { $Output += "BTI_OSEnabled-"} else {$Output += "BTI_OSDisabled-"}
- $kvaShadowRequired = $true
- $kvaShadowPresent = $false
- $kvaShadowEnabled = $false
- $kvaShadowPcidEnabled = $false
- $cpu = Get-WmiObject Win32_Processor
- if ($cpu.Manufacturer -eq "AuthenticAMD") {
- $kvaShadowRequired = $false
- }
- elseif ($cpu.Manufacturer -eq "GenuineIntel") {
- $regex = [regex]'Family (\d+) Model (\d+) Stepping (\d+)'
- $result = $regex.Match($cpu.Description)
- if ($result.Success) {
- $family = [System.UInt32]$result.Groups[1].Value
- $model = [System.UInt32]$result.Groups[2].Value
- $stepping = [System.UInt32]$result.Groups[3].Value
- if (($family -eq 0x6) -and
- (($model -eq 0x1c) -or
- ($model -eq 0x26) -or
- ($model -eq 0x27) -or
- ($model -eq 0x36) -or
- ($model -eq 0x35))) {
- $kvaShadowRequired = $false
- }
- }
- }
- else {
- throw ("Unsupported processor manufacturer: {0}" -f $cpu.Manufacturer)
- }
- [System.UInt32]$systemInformationClass = 196
- [System.UInt32]$systemInformationLength = 4
- $retval = $ntdll::NtQuerySystemInformation($systemInformationClass, $systemInformationPtr, $systemInformationLength, $returnLengthPtr)
- if ($retval -eq 0xc0000003 -or $retval -eq 0xc0000002) {
- }
- elseif ($retval -ne 0) {
- throw (("Querying kernel VA shadow information failed with error {0:X8}" -f $retval))
- }
- else {
- [System.UInt32]$kvaShadowEnabledFlag = 0x01
- [System.UInt32]$kvaShadowUserGlobalFlag = 0x02
- [System.UInt32]$kvaShadowPcidFlag = 0x04
- [System.UInt32]$kvaShadowInvpcidFlag = 0x08
- [System.UInt32]$flags = [System.UInt32][System.Runtime.InteropServices.Marshal]::ReadInt32($systemInformationPtr)
- $kvaShadowPresent = $true
- $kvaShadowEnabled = (($flags -band $kvaShadowEnabledFlag) -ne 0)
- $kvaShadowPcidEnabled = ((($flags -band $kvaShadowPcidFlag) -ne 0) -and (($flags -band $kvaShadowInvpcidFlag) -ne 0))
- }
- if ($kvaShadowRequired) {
- if ($kvaShadowEnabled) { $Output += "ShadowEnabledOrUnnecessary"} else {$Output += "ShadowNeededNotEnabled"}
- } else {
- $Output += "ShadowEnabledOrUnnecessary"
- }
- }
- finally
- {
- if ($systemInformationPtr -ne [System.IntPtr]::Zero) {
- [System.Runtime.InteropServices.Marshal]::FreeHGlobal($systemInformationPtr)
- }
- if ($returnLengthPtr -ne [System.IntPtr]::Zero) {
- [System.Runtime.InteropServices.Marshal]::FreeHGlobal($returnLengthPtr)
- }
- }
- Write-Output $Output
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement