Update README.md

README.md

@@ -1,6 +1,6 @@
 <img src="https://imgur.com/nNnOCPK.png"/>
 
-# msrexec
+# msrexec - elevate arbitrary wrmsr to kernel execution
 
 msrexec is a small project that can be used to elevate arbitrary MSR writes to kernel execution on 64 bit Windows-10 systems. This project is part of the VDM (vulnerable driver manipulation) namespace
 and can be integrated into any prior VDM projects. Although this project falls under the VDM namespace, Voyager and bluepill can be used to provide arbitrary wrmsr writes.
@@ -15,6 +15,35 @@ SYSCALL loads the CS and SS selectors with values derived from bits 47:32 of the
 
 ***The SYSCALL instruction does not save the stack pointer (RSP).*** If the OS system-call handler will change the stack pointer, it is the responsibility of software to save the previous value of the stack pointer. This might be done prior to executing SYSCALL, with software restoring the stack pointer with the instruction following SYSCALL (which will be executed after SYSRET). Alternatively, the OS system-call handler may save the stack pointer and restore it before executing SYSRET.
 
+# ROP - Return-oriented programming
+
+ROP or return-oriented programming, is a technique where an attacker gains control of the call stack to hijack program control flow and then executes carefully chosen machine instruction sequences that are already present in the machine's memory, called "gadgets". Note: ***"The SYSCALL instruction does not save the stack pointer (RSP)"***. This allows for an attacker to setup the stack with addresses of ROP gadgets are specific values. In this situation SMEP and SMAP are two cpu protections which prevent an attacker from setting IA32_LSTAR to a user controlled page.
+
+### SMEP - Supervisor Mode Execution Protection
+
+SMEP or Supervisor Mode Execution Protection, prevents a logical processor with a lower CPL from executing code mapped into virtual memory with super supervisor bit set. This is relevant to this project as one could not simply set LSTAR to a user controlled page. However, with ROP one could disable SMEP by executing the following gadgets:
+
+```
+pop rcx
+ret
+```
+
+```
+mov cr4, rcx
+ret
+```
+
+However, when the syscall instruction is executed, the address of the next instruction (the one after the syscall instruction) is placed into RCX. In order to preserve RIP, it should be placed onto the stack before any addresses of gadgets are placed onto the stack.
+
+```
+lea rax, finish
+push rax
+```
+
+changing IA32_LSTAR to a ROP chain as described above will work just fine on CPU's that done support SMAP. Windows 10 will use SMAP if your CPU supports it. This means RSP is unaccessable since it is a user controlled page. 
+
+### SMAP - Supervisor Mode Access Prevention
+
 # Lisence
 
 TL;DR: if you use this project, rehost it, put it on github, include `_xeroxz` in your release.