Skip to content

Instantly share code, notes, and snippets.

@OsandaMalith
Last active September 25, 2017 14:12
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save OsandaMalith/81df09ade4e89d9d1cfd9b3558f54158 to your computer and use it in GitHub Desktop.
Save OsandaMalith/81df09ade4e89d9d1cfd9b3558f54158 to your computer and use it in GitHub Desktop.
Few tricks that I found out when I had a look at the segment registers in Windows.
#include <Windows.h>
#include <wchar.h>
/*
* Author: Osanda Malith Jayathissa - @OsandaMalith
* Website: https://osandamalith.com
* Description: Few tricks that you can use to detect the architecture in Windows
* Link : http://osandamalith.com/2017/09/24/detecting-architecture-in-windows/
*/
BOOL detectArch_ES() {
#if defined(_MSC_VER)
_asm {
xor eax, eax
mov ax, es
ror ax, 0x3
and eax, 0x1
}
#elif defined(__GNUC__)
asm(
".intel_syntax noprefix;"
"xor eax, eax;"
"mov ax, es;"
"ror ax, 0x3;"
"and eax, 0x1;"
);
#endif
}
BOOL detectArch_GS() {
#if defined(_MSC_VER)
_asm {
xor eax, eax
mov ax, gs
}
#elif defined(__GNUC__)
asm(
".intel_syntax noprefix;"
"xor eax, eax;"
"mov ax, gs;"
);
#endif
}
BOOL detectArch_TEB() {
#if defined(_MSC_VER)
_asm {
xor eax, eax
mov eax, fs:[0xc0]
}
#elif defined(__GNUC__)
asm(
".intel_syntax noprefix;"
"xor eax, eax;"
"mov eax, fs:[0xc0];"
);
#endif
}
int main(int argc, char* argv[]) {
wprintf(
!detectArch_ES() ?
L"You are Running 32-bit\n" :
L"You are Running 64-bit\n"
);
wprintf(
!detectArch_GS() ?
L"You are Running 32-bit\n" :
L"You are Running 64-bit\n"
);
wprintf(
!detectArch_TEB() ?
L"You are Running 32-bit\n" :
L"You are Running 64-bit\n"
);
return 1337;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment