Iris WinDbg extension performs detection of common Windows process mitigations (32 and 64 bits).
The checks implemented, as can be seen in the screenshots above, are:
for the current process
for the loaded modules
If you don’t know the meaning of some of the keywords above use google, you’ll find better explanations than the ones I could give you.
Setup
To “install”, copy either x86\iris.dll
or x64\iris.dll
into the winext
folder for WinDbg (for x86
and x64
).
WinDbg 10.0.xxxxx
Unless you installed the debug tools in a non standard path you’ll find the winext
folder at:
C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\winext
Or, for 32 bits:
C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\winext
WinDbg Preview
Unless you installed copied WinDbg preview install folder
into a non standard location you’ll have it in a folder with a name
close to the one below (depending on the installed version):
C:\Program Files\WindowsApps\Microsoft.WinDbg_1.1906.12001.0_neutral__9wekib2d8acwe
For 64 bits copy x64\iris.dll
into amd64\winext
or x86\iris.dll
into x86\winext
for 32 bits.
Load the extension
After the steps above, just load the extension with .load iris
and run !iris.help
to see the available command(s).
0:014> .load iris
[+] Iris WinDbg Extension Loaded
0:014> !iris.help
IRIS WinDbg Extension (rui@deniable.org). Available commands:
help = Shows this help
modules = Display process mitigations for all loaded modules.
mitigations = Display current process mitigation policy.
Running
As shown in the screenshot above, just run: !iris.modules
or simply !modules
, and !iris.mitigations
or simply !mitigations
.
An innovative tool designed to revolutionize the testing, evaluation, and security of LLM applications. This…
A sophisticated tool designed for exploiting vulnerabilities in Android devices. This article dives into the…
SeamlessPass is a tool designed to obtain Microsoft 365 access tokens using on-premises Active Directory…
Comprehensive guide to the tools and resources pivotal in the world of forensic analysis. From…
An advanced Nmap script designed to detect potential vulnerabilities in network services. This article delves…
A powerful tool designed to tunnel TCP connections through a file. Ideal for circumventing firewalls…