Batch-find Cr0.WP manipulating byte sequences using ropper
// Can likewise be used to find CR4-manipulating sequences... but you have to find the Cr0 sequences first. Cr4.cet check needs to be coupled to the Cr0.WP manipulation.
Given (from memory.dmp in KD):
ffffd28a`a9e182f5 410f20c4 mov r12,cr0 ; => mov reg, cr0. Exists with 41 prefix and without.
ffffd28a`a9e182f9 498bc4 mov rax,r12 ; => 3 bytes for a "mov reg,reg" intermezzo to save original CR0 bitmask on other reg.
ffffd28a`a9e182fc 480fbaf010 btr rax,10h ; => Compiler optimization. Might be used or not.
ffffd28a`a9e18301 0f22c0 mov cr0,rax ; => mov cr0, reg. Exists with 41 prefix and without.
Using ropper, after trying a bit and some tweaking: ?? + 0f20c? + ??????????????10 + 0f22c? . (There is still optimization potential in here.)
The first "??" is for getting optical output enhancement, for the possible 41.
> opcode ??0f20c???????????????100f22c?
0x00000001403e0c81: 410f20c4498bc4480fbaf0100f22c0;
0x00000001403ece4a: 410f20c7498bc7480fbaf0100f22c0;
0x0000000140b0af5d: 410f20c7498bc7480fbaf0100f22c0;
0x0000000140b1081d: 410f20c4498bc4480fbaf0100f22c0;
0x0000000140b313ab: 410f20c7498bc7480fbaf0100f22c0;
Looks good. By the way, that's for my Win11 VM (23H2). No Win 10 involved.
> disasm 410f20c4498bc4480fbaf0100f22c0
mov r12, cr0
mov rax, r12
btr rax, 0x10
mov cr0, rax
> disasm 410f20c7498bc7480fbaf0100f22c0
mov r15, cr0
mov rax, r15
btr rax, 0x10
mov cr0, rax
The sequence with "remove Write Protection bit from CR0" exists in two variants with r15 (3x) and r12 (2x) register use. If these five sequences do not also check CR4.CET before removing CR0.WP, they will kill all PCs with Intel CET enabled on their execution.
So, for loading all third party driver images at once in ropper and make ropper search on all:
"ropper.exe --console --all -f C:\thirdpartydrivers\driver1.sys C:\thirdpartydrivers\driver2.sys C:\thirdpartydrivers\driver3.sys"
Put as many third party driver files as you want to the invocation line. Everything you do will be done on all of them.
The opcode search is not only blazing fast (returns almost instantly), it also has wildcard/regex support and searches only on code sections, not in data sections. On ALL code sections of ALL loaded driver images. Also helpful are the support commands like asm and disasm.
Don't use the search command, a shame that it tries to find rets (why would anyone want to do that? :-DD), with no option to turn this off(?).
For people without complete x64 menomic reference in their head, the asm and disasm command could be helpful:
> asm mov rax, cr0
0f20c0
> disasm 410f20c1
mov r9, cr0
I would bet a chocolate that all 5 sequences above (on my Win11) don't check the needed CR4.CET bit when they trying to remove Write Protection globally. But I won't suffer a BSOD any time soon -- no Intel CET.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
