WinDbg extension to display Windows process mitigations
Iris
WinDbg extension performs detection of common Windows process mitigations (32 and 64 bits).
The checks implemented, as can be seen in the screenshots above, are:
If you don't know the meaning of some of the keywords above use google, you'll find better explanations than the ones I could give you.
To "install", copy either x86\iris.dll
or x64\iris.dll
into the winext
folder for WinDbg (for x86
and x64
).
Unless you installed the debug tools in a non standard path you'll find the winext
folder at:
C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\winext
Or, for 32 bits:
C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\winext
Unless you ~installed~ copied WinDbg preview install folder into a non standard location you'll have it in a folder with a name close to the one below (depending on the installed version):
C:\Program Files\WindowsApps\Microsoft.WinDbg_1.1906.12001.0_neutral__9wekib2d8acwe
For 64 bits copy x64\iris.dll
into amd64\winext
or x86\iris.dll
into x86\winext
for 32 bits.
After the steps above, just load the extension with .load iris
and run !iris.help
to see the available command(s).
0:014> .load iris
[+] Iris WinDbg Extension Loaded
0:014> !iris.help
IRIS WinDbg Extension ([email protected]). Available commands:
help = Shows this help
modules = Display process mitigations for all loaded modules.
mitigations = Display current process mitigation policy.
As shown in the screenshot above, just run: !iris.modules
or simply !modules
, and !iris.mitigations
or simply !mitigations
.
Don't trust blindly on the results, some might not be accurate. I pretty much used as reference PE-bear parser, winchecksec, Process Hacker, narly, and checksec-win. Thank you to all of them.
I put this together in a day to save some time during a specific assignment. It worked for me but it hasn't been thoroughly tested. You have been warned, use at your own risk.
I'll be updating and maintaining this, so any issues you may find please let me know. I plan to add a few more mitigations later.
Besides the references mentioned before, if you want to write your own extension (or contribute to this one) the Advanced Windows Debugging book and the WinDbg SDK are your friends.