{"id":4884,"date":"2018-02-05T01:27:00","date_gmt":"2018-02-05T00:27:00","guid":{"rendered":"http:\/\/159.69.82.204\/win\/?p=4884"},"modified":"2024-10-05T19:01:28","modified_gmt":"2024-10-05T17:01:28","slug":"meltdown-spectre-test-tools-overview","status":"publish","type":"post","link":"https:\/\/borncity.com\/win\/2018\/02\/05\/meltdown-spectre-test-tools-overview\/","title":{"rendered":"Meltdown\/Spectre Test Tools Overview"},"content":{"rendered":"

[German<\/a>]What about test tools for Meltdown and Spectre mitigations under Windows at February 2018? Within this blog post I take a look at several test tools for Windows and introduce two more test tools from Germany.<\/p>\n

<\/p>\n

\"\"It is now a month since the Spectre and Meltdown attack methods became public. These vulnerabilities allow attacks to access information from the systems.<\/p>\n

\"Meltdown\/Spectre\"<\/p>\n

While Meltdown refers (mostly) to Intel CPUs, the Spectre 1 and Spectre 2 attack methods work with a wide range of CPUs from various manufacturers, including AMD, ARM, IBM, Intel, MIPS, etc. There are no known attacks so far, but it's a question of time, until we see the first malware using these attack methods (see my blog post Malware using Meltdown and Spectre attacks under develoment \u2013 Windows Defender quarantines PoC tools<\/a>).<\/p>\n

However, Microsoft and its partners have rolled out updates for Windows, BIOS and browsers. This raise the question: What about the tools for testing the system on mitigations for Spectre and Meltdown? Here is a short overview of what I know so far.<\/p>\n

Test with PowerShell<\/h2>\n

Microsoft has provided a PowerShell extension for Windows that allows you to check whether actions need to be taken. In the blog post Meltdown and Spectre: What Windows users need to know<\/a>, I've outlined a solution from Microsoft using PowerShell. Here is a command line output.<\/p>\n

\"Speculation-Control-Settings<\/p>\n

But this solution is just for cracks – and I can't get the extension loaded on my Windows 7 SP1 platform. Something is missing in the PowerShell environment. The outputted values are also quite cryptic, although the PowerShell provides hints what to do in the results.<\/p>\n

Side note: The PowerShell extension shows missing updates on all systems, that does not support the\u00a0new \"system information classes\". Otherwise it shows\u00a0the status of the mitigations.<\/p><\/blockquote>\n

The Ashampoo Spectre Meltdown CPU Checker<\/h2>\n

Manufacturer Ashampoo released the Spectre Meltdown CPU Checker at the beginning of January 2018. The tool can be run under Windows, and provides information on whether the system is vulnerable (see screenshot below).<\/p>\n

\"Ashampo<\/p>\n

I've introduced this tool within my blog post Tool tip: Ashampo Spectre Meltdown CPU-Checker<\/a>. Many people commented within my German blog, that the tool isn't reliable, and it caused also issues (refused to run on several systems). A reader noted, that he got this messages:<\/p>\n

\"Fehler<\/p>\n

After updating the Management Framework 5.1, he got the following message:<\/p>\n

<\/p>\n

He wasn't able to run the checker, so in this case the tool is useless.<\/p>\n

Test tool InSpectre<\/h2>\n

Then Gibson Research Corporation, founded by Steve Gibson, has launched the InSpectre tool. I introduced this tool within the blog post InSpectre: Test your machine against Meltdown\/Spectre flaw<\/a>. When the initial blog post was made, I had uploaded the tool to Virustotal and received a message from many virus scanners that it contained a Trojan horse. Although I assumed a false alarm, I warned against its use for the time being. Meanwhile, Steve Gibson has reworked the tool and Virustotal considers it safe.<\/p>\n

\"Inspectre-Ergebnis\"<\/p>\n

The InSpectre tool is available for Windows for free download on this website<\/a>. The program is only 160 KByte in size and does not need to be installed. If you only want to have the results displayed, you can run the tool without administrator rights (see above picture). I think it's great that you can disable protection against meltdown and spectre, if available, if the tool runs with administrator privileges.<\/p>\n

\"Inspectre-Status\"<\/p>\n

And the Show System Summary <\/em>command within the system menu (see the figure above) can now be used to display technical details.<\/p>\n

SpecuCheck from Alex Inonescu<\/h2>\n

Alex Ionescu<\/a> has created a small tool called SpecuCheck, that's available with source code at Github<\/a>.<\/p>\n

\"SpecuCheck<\/p>\n

The screenshot above shows a result of such a test, which appears in the command prompt windows and is somewhat cryptic for my taste.<\/p>\n

Meltdown-\/Spectre check by Stefan Kanthak<\/h2>\n

A few days ago, German security specialist Stefan Kanthak<\/a> (Microsoft enlists<\/a> him in the Top 100 MSRC 2017<\/a> ) sent me a mail. Stefan had linked a tool for me, that he has developed and which runs with normal user privileges and performed a check. He wrote: 'the used functions of the Win32-API are available from NT 3.1 upward, i. e. the program can run on ALL versions of NT!'.<\/p>\n

After discussing the first version of his program, Stefan modified it slightly, including some suggestions I pointed out. There are now two tools Meltdown<\/a> and Spectre<\/a> available for download. Here are the dialog boxes with test results.<\/p>\n

\"Meltdown-Check<\/p>\n

\"Spectre-Check<\/p>\n

The tools indicating whether a protection against meltdown and spectre has been found. The programs also provide detailed information on what flags are supported by the CPU in Speculation Control. This means for the normal user: At first glance he sees whether a protection against the attacks is installed. If he need more detailed information, he may take a look at the values for KVAShadowFlags<\/em> and SpeculationControlFlags<\/em>. The values 1 or 0 indicate whether the flag in question (in the status word returned by Windows) is set or not.<\/p>\n

If you are interested in the flags or CPU options, you may want to check this Intel document<\/a> or the source code of the tools mentioned below. Stefan wrote in a mail:<\/p>\n

Alex Ionescus SpecuCheck. exe also runs without administrator rights,\u00a0but it's bigger than my 4 KB or 6,5 KB small programs. Unfortunately, he uses the[MSV]CRT-function swprintf () instead of the Win32-function wsprintf () and thus the MSVCRT, which I avoid in all my programs or replace with my own NOMSVCRT (see<\/a>).<\/p><\/blockquote>\n

Stefan Kanthak states that the two test programs linked above do not access the Win32 API, i. e. they don't have references to KERNEL32.DLL and USER32.DLL. He uses only the (undocumented) NT-API alias \"native\" API, whose NtQuerySystemInformation ()<\/em> is the sole source for the required information, and still don't need administrator privileges.\u00a0 Stefan Kanthak also offers the following:<\/p>\n

If you want to rebuild it yourself as well, get the \"makefile\" (here<\/a>), plus the two icons (meltdownattack.com<\/a> icon, spectreattack.com<\/a> icon) which he called MELTDOWN. ICO and SPECTRE.ICO. Put them in the same directory as GIMMICK.MAK. Then open the command prompt window of a Windows development environment (for example, the \"Platform SDK<\/a>\") and executes NMAKE. exe \/F GIMMICK.MAK.<\/p>\n

Stefan provides also a program on this web page<\/a>, which performs both tests on Meltdown and Spectre and displays the results in two separate dialog boxes. It uses the Win32 API and displays the appropriate icon in the dialog boxes. If you intend to build your own version of BTI_RDCL. EXE there is the file BTI_RDCL.MAK<\/a>.<\/p><\/blockquote>\n

At this point I would like to thank Stefan Kanthak for the two tools and the additional explanations. Maybe the tools will help some admin or blog readers who want to get deeper into the topic.<\/p>\n

All in all, however, the article shows that the whole situation is very confusing. We have almost a handful of tools, and some of them have a lot of fun. Regarding the updates for Meltdown and Spectre it doesn't look much better.<\/p>\n

Similar articles
\n<\/strong>Design flaw in Intel CPUs set operating systems at risk<\/a>
\nMeltdown and Spectre: What Windows users need to know<\/a>
\nHow to mitigate Spectre in Google Chrome<\/a>
\nTool tip: Ashampo Spectre Meltdown CPU-Checker<\/a>
\nTest: Is my browser vulnerable for Spectre attacks?<\/a>
\nInSpectre: Test your machine against Meltdown\/Spectre flaw<\/a><\/p>\n

Malware using Meltdown and Spectre attacks under develoment \u2013 Windows Defender quarantines PoC tools<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

[German]What about test tools for Meltdown and Spectre mitigations under Windows at February 2018? Within this blog post I take a look at several test tools for Windows and introduce two more test tools from Germany.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[71,580],"tags":[69],"class_list":["post-4884","post","type-post","status-publish","format-standard","hentry","category-computer","category-security","tag-security"],"_links":{"self":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/4884","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/comments?post=4884"}],"version-history":[{"count":1,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/4884\/revisions"}],"predecessor-version":[{"id":35716,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/4884\/revisions\/35716"}],"wp:attachment":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/media?parent=4884"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/categories?post=4884"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/tags?post=4884"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}