Iris : WinDbg Extension To Display Windows Process Mitigations

Iris WinDbg extension performs detection of common Windows process mitigations (32 and 64 bits).

The checks implemented, as can be seen in the screenshots above, are:

for the current process

  • DEP Policy
    • DEP ATL Thunk Emulation Disabled
    • Permanent DEP Enabled
  • ASLR Policy
    • Bottom Up Randomization Enabled
    • Force Relocate Images Enabled
    • High Entropy Enabled
    • Stripped Images Disallowed
  • Arbitrary Code Guard (ACG) Policy
    • Dynamic Code Prohibited
    • Allow Threads to Opt Out of the restrictions on ACG
    • Allow Non-AppContainer Processes to Modify all of the ACG settings for the calling process
  • System Calls Policy
    • Win32k System Calls Disallowed
  • Control Flow Guard Policy
    • Control Flow Guard Enabled
    • Exported Functions Treated as Invalid Indirect Call Targets
    • Strict Mode
  • Image Load Signature Policy
    • Microsoft Signed Only
    • Store Signed Only
    • Prevent Image Loading not signed by MS, Store, or WHQL
  • Process Fonts Policy
    • Prevent the Process from Loading Non-System Fonts
    • Log ETW event when the Process Attempts to Load a Non-System Font
  • Process Image Load Policy
    • Prevent Loading Images from a Remote Device
    • Prevent Loading Images Written by Low Integrity Level
    • Prefer for Images to Load in System32 subfolder
  • Mitigation Options
    • Enable SEH overwrite protection (SEHOP)
    • Heap terminate on corruption Enabled
    • Win32k System Calls Disallowed Always On

for the loaded modules

  • DynamicBase
  • ASLR
  • DEP
  • SEH
  • SafeSEH
  • CFG
  • RFG
  • GS
  • AppContainer

If you don’t know the meaning of some of the keywords above use google, you’ll find better explanations than the ones I could give you.

Also Read – Docker Security Playground : A Microservices-Based Framework For The Study Of Network Security & Penetration Test Techniques

Setup

To “install”, copy either x86\iris.dll or x64\iris.dll into the winext folder for WinDbg (for x86 and x64).

WinDbg 10.0.xxxxx

Unless you installed the debug tools in a non standard path you’ll find the winext folder at:

C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\winext

Or, for 32 bits:

C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\winext

WinDbg Preview

Unless you installed copied WinDbg preview install folder into a non standard location you’ll have it in a folder with a name close to the one below (depending on the installed version):

C:\Program Files\WindowsApps\Microsoft.WinDbg_1.1906.12001.0_neutral__9wekib2d8acwe

For 64 bits copy x64\iris.dll into amd64\winext or x86\iris.dll into x86\winext for 32 bits.

Load the extension

After the steps above, just load the extension with .load iris and run !iris.help to see the available command(s).

0:014> .load iris
[+] Iris WinDbg Extension Loaded
0:014> !iris.help

IRIS WinDbg Extension (rui@deniable.org). Available commands:
help = Shows this help
modules = Display process mitigations for all loaded modules.
mitigations = Display current process mitigation policy.

Running

As shown in the screenshot above, just run: !iris.modules or simply !modules, and !iris.mitigations or simply !mitigations.

R K

Recent Posts

WhatsMyName App – Find Anyone Across 640+ Platforms

Overview WhatsMyName is a free, community-driven OSINT tool designed to identify where a username exists…

3 days ago

Analyzing Directory Size Linux Tools Explained

Managing disk usage is a crucial task for Linux users and administrators alike. Understanding which…

3 days ago

Understanding Disk Usage with du Command

Efficient disk space management is vital in Linux, especially for system administrators who manage servers…

3 days ago

How to Check Directory Size in Linux

Knowing how to check directory sizes in Linux is essential for managing disk space and…

3 days ago

Essential Commands for Linux User Listing

Managing user accounts is a core responsibility for any Linux administrator. Whether you’re securing a…

3 days ago

Command-Line Techniques for Listing Linux Users

Linux offers powerful command-line tools for system administrators to view and manage user accounts. Knowing…

4 days ago