Last active
September 25, 2017 14:12
-
-
Save OsandaMalith/81df09ade4e89d9d1cfd9b3558f54158 to your computer and use it in GitHub Desktop.
Few tricks that I found out when I had a look at the segment registers in Windows.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#include <Windows.h> | |
#include <wchar.h> | |
/* | |
* Author: Osanda Malith Jayathissa - @OsandaMalith | |
* Website: https://osandamalith.com | |
* Description: Few tricks that you can use to detect the architecture in Windows | |
* Link : http://osandamalith.com/2017/09/24/detecting-architecture-in-windows/ | |
*/ | |
BOOL detectArch_ES() { | |
#if defined(_MSC_VER) | |
_asm { | |
xor eax, eax | |
mov ax, es | |
ror ax, 0x3 | |
and eax, 0x1 | |
} | |
#elif defined(__GNUC__) | |
asm( | |
".intel_syntax noprefix;" | |
"xor eax, eax;" | |
"mov ax, es;" | |
"ror ax, 0x3;" | |
"and eax, 0x1;" | |
); | |
#endif | |
} | |
BOOL detectArch_GS() { | |
#if defined(_MSC_VER) | |
_asm { | |
xor eax, eax | |
mov ax, gs | |
} | |
#elif defined(__GNUC__) | |
asm( | |
".intel_syntax noprefix;" | |
"xor eax, eax;" | |
"mov ax, gs;" | |
); | |
#endif | |
} | |
BOOL detectArch_TEB() { | |
#if defined(_MSC_VER) | |
_asm { | |
xor eax, eax | |
mov eax, fs:[0xc0] | |
} | |
#elif defined(__GNUC__) | |
asm( | |
".intel_syntax noprefix;" | |
"xor eax, eax;" | |
"mov eax, fs:[0xc0];" | |
); | |
#endif | |
} | |
int main(int argc, char* argv[]) { | |
wprintf( | |
!detectArch_ES() ? | |
L"You are Running 32-bit\n" : | |
L"You are Running 64-bit\n" | |
); | |
wprintf( | |
!detectArch_GS() ? | |
L"You are Running 32-bit\n" : | |
L"You are Running 64-bit\n" | |
); | |
wprintf( | |
!detectArch_TEB() ? | |
L"You are Running 32-bit\n" : | |
L"You are Running 64-bit\n" | |
); | |
return 1337; | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment