From fa2dc955025b1e98eb115cf62d8407181a668e39 Mon Sep 17 00:00:00 2001 From: _xeroxz Date: Wed, 24 Feb 2021 05:55:55 +0000 Subject: [PATCH] Update README.md --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 9167a66..b85ed2a 100644 --- a/README.md +++ b/README.md @@ -122,7 +122,7 @@ ret ### SFMASK - If a bit in this is set, the corresponding bit in rFLAGS is cleared. -On Win10 this MSR is set to `0x4700` or `0100 0111 0000 0000`, as you can see bit 18 is not set, which means the AC flag is not cleared when syscall is execute. This means you can disable SMAP from usermode... credits to [@drew](https://twitter.com/drewbervisor) for pointing this out. I think Microsoft is unaware that you can set AC from usermode. +On Win10 this MSR is set to `0x4700` or `0100 0111 0000 0000`, as you can see bit 18 is not set, which means the AC flag is not cleared when syscall is execute. This means you can disable SMAP from usermode... credits to [@drew](https://twitter.com/drewbervisor) for pointing this out. I think Microsoft is unaware that you can set AC from usermode. (I was also...) # Credit - Special Thanks