Me, myself & IT

Meltdown, Spectre, Spectre-NG and Foreshadow Update Check Utility

Purpose

Background Information

Operation

Implementation and Build Details

Authenticity and Integrity

Makefile and Build Instructions

Purpose

Note: the status of the mitigations for the vulnerabilities CVE-2017-5753 alias Bounds Check Bypass and CVE-2018-3693 alias Bounds Check Bypass Store can’t be shown: every sequence of machine code which is susceptible to these vulnerabilities needs to be fixed individually!

Background Information

The MSKB articles 4090007, 4091663, 4091664, 4091666, 4093836, 4100347, 4346084, 4346085, 4346086, 4346087, 4346088 and 4465065 provide information about the microcode updates distributed through the Microsoft Update Catalog.

The posts Mitigating speculative execution side channel hardware vulnerabilities, KVA Shadow: Mitigating Meltdown on Windows, Analysis and mitigation of speculative store bypass (CVE-2018-3639) and Analysis and mitigation of L1 Terminal Fault (L1TF) on Microsoft’s Security Research and Defense Blog give additional information.

The article series Deep Dive: Introduction to Speculative Execution Side Channel Methods, Deep Dive: Analyzing Potential Bounds Check Bypass Vulnerabilities, Deep Dive: Intel Analysis of Speculative Behavior of SWAPGS and Segment Registers, Deep Dive: Indirect Branch Restricted Speculation, Deep Dive: Single Thread Indirect Branch Predictors, Deep Dive: Indirect Branch Predictor Barrier, Deep Dive: Retpoline: A Branch Target Injection Mitigation, Deep Dive: Managed Runtime Speculative Execution Side Channel Mitigations, Deep Dive: Intel Analysis of Microarchitectural Data Sampling, Deep Dive: Intel Analysis of L1 Terminal Fault, Deep Dive: Snoop-assisted L1 Data Sampling, Deep Dive: Intel^® Transactional Synchronization Extensions (Intel^® TSX) Asynchronous Abort, Deep Dive: Load Value Injection and Deep Dive: CPUID Enumeration and Architectural MSRs, plus More information on SWAPGS and Speculative only Segment Loads, An Optimized Mitigation Approach for Load Value Injection and Refined Speculative Execution Terminology give more details, while Processors Affected: Speculative Behavior of SWAPGS and Segment Registers, Processors Affected: Microarchitectural Data Sampling, Processors Affected: L1 Terminal Fault, Processors Affected: L1D Eviction Sampling, Processors Affected: Vector Register Sampling, Processors Affected: Snoop-assisted L1 Data Sampling and Processors Affected: Load Value Injection list the affected Intel processors.

Operation

With security update installed, BTI_RDCL.EXE displays two message boxes like those shown below.

Implementation and Build Details

Authenticity and Integrity

Serial number of the certificate

73780985

0x0465CEF9

Fingerprint of the certificate

MD5: 33 33 6e 1d 26 18 a7 c2 be 87 11 68 05 2c 70 09

SHA-1: 8c 5b 75 21 40 41 77 ac 54 13 13 02 06 6b b0 69 10 2e 83 0e

-----BEGIN RSA PUBLIC KEY-----
MIIBCgKCAQEA6ipnm9vAs63w+TM+9UcG1yQ8CRIxMz/tTXry9MCbeHpkiM/qdPaRWlwVTW2j
PhC81xwIPZXgE1FE4DgE1eImb33DG2YfEBY/ARpMaGUnme+85WmExWWc/YMUAaHOMYQ3TQDX
0V/7yuhfa9Uc29ljtQ2AB0MjhXTJvGguvZZTI5A3rcN4+AKwmETdYH+8OQKMU2s+2H9CVfaD
waX0aj9CeibGNooLTgDchzCBIC5J47qHned/3ZqnMDjYCv3Yc1HNgcbM+ZKzPoD8jShb/ptI
wWPo9s00KEs9ti68RsmejqKovAmdLSzFLGARbue2uiqs4piJkxI0LS5+NTTPyZjsSwIDAQAB
-----END RSA PUBLIC KEY-----

Note: due to its counter signature alias timestamp the digital signature remains valid past the X.509 certificates expiration date!

Makefile and Build Instructions

1. Download the makefile BTI_RDCL.MAK and save it in an arbitrary, preferable empty directory.

   Note: the makefile contains the sources as inline files.

2. Download the Meltdown icon and save it as MELTDOWN.ICO in the directory used in step 1.

3. Download the Spectre icon and save it as SPECTRE.ICO in the directory used in step 1.

4. Run the following command line to build BTI_RDCL.EXE:

   NMAKE.EXE /R /F BTI_RDCL.MAK

   Note: if necessary, see the MSDN article Use the Microsoft C++ toolset from the command line for an introduction.

   Microsoft (R) Program Maintenance Utility Version 10.00.40219.01
   Copyright (C) Microsoft Corporation.  All rights reserved.
   
   	RC.EXE /DUNICODE /FoBTI_RDCL.RES /L 0 /N /R /V nm2A7.tmp
   Microsoft (R) Windows (R) Resource Compiler Version 6.1.7600.16385
   Copyright (C) Microsoft Corporation.  All rights reserved.
   
   Using codepage 1252 as default
   Creating BTI_RDCL.RES
   C:\Program Files\Microsoft Visual Studio 10.0\VC\Include\string.h(54) : warning RC4011: identifier truncated to '_CRT_SECURE_CPP_OVERLOAD_STANDA'
   C:\Program Files\Microsoft Visual Studio 10.0\VC\Include\string.h(76) : warning RC4011: identifier truncated to '_CRT_SECURE_CPP_OVERLOAD_SECURE'
   
   nm2A7.tmp.
   Writing ICON:1, lang:0x0,       size 9640
   Writing ICON:2, lang:0x0,       size 4264
   Writing ICON:3, lang:0x0,       size 1128
   Writing GROUP_ICON:1,   lang:0x0,       size 48.
   Writing ICON:4, lang:0x0,       size 9640
   Writing ICON:5, lang:0x0,       size 4264
   Writing ICON:6, lang:0x0,       size 1128
   Writing GROUP_ICON:2,   lang:0x0,       size 48.
   Writing 24:1,   lang:0x0,       size 1308.
   Writing VERSION:1,      lang:0x0,       size 1720
   	CL.EXE /c /FoBTI_RDCL.OBJ /GA /GF /GS- /Gy /nologo /O1 /Os /Tcnm2A8.tmp /W4 /we4013 /Zl
   nm2A8.tmp
   	CL.EXE /c /FoBTI_RDCL.TMP /nologo /Tcnm2A9.tmp /W4 /wd4100 /Zl
   nm2A9.tmp
   	LINK.EXE /LIB /DEF /EXPORT:NtQuerySystemInformation /EXPORT:RtlNtStatusToDosError /NAME:NTDLL /NODEFAULTLIB /NOLOGO /OUT:BTI_RDCL.LIB BTI_RDCL.TMP
      Creating library BTI_RDCL.LIB and object BTI_RDCL.exp
   	CERTUTIL.EXE /DecodeHex /F /V nm2AA.tmp BTI_RDCL.DOS
   Input Length = 730
   Output Length = 160
   CertUtil: -decodehex command completed successfully.
   	LINK.EXE /LINK /DYNAMICBASE /ENTRY:wWinMainCRTStartup /FIXED:NO /IGNORE:4060 /LARGEADDRESSAWARE /NODEFAULTLIB /NOLOGO /NXCOMPAT /OPT:REF /OSVERSION:5.0 /OUT:BTI_RDCL.EXE /RELEASE /STUB:BTI_RDCL.DOS /SUBSYSTEM:WINDOWS /SWAPRUN:CD,NET /VERSION:1.0 BTI_RDCL.OBJ BTI_RDCL.RES BTI_RDCL.LIB KERNEL32.LIB USER32.LIB
   	".\BTI_RDCL.EXE"

Contact

Note: email in weird format and without a proper sender name is likely to be discarded!

I dislike HTML (and even weirder formats too) in email, I prefer to receive plain text.
I also expect to see your full (real) name as sender, not your nickname.
I abhor top posts and expect inline quotes in replies.

Terms and Conditions

• The software and the documentation on this site are provided as is without any warranty, neither express nor implied.
  In no event will the author be held liable for any damage(s) arising from the use of the software or the documentation.
• Permission is granted to use the current version of the software and the current version of the documentation solely for personal private and non-commercial purposes.
  An individuals use of the software or the documentation in his or her capacity or function as an agent, (independent) contractor, employee, member or officer of a business, corporation or organisation (commercial or non-commercial) does not qualify as personal private and non-commercial purpose.
• Without written approval from the author the software or the documentation must not be used for a business, for commercial, corporate, governmental, military or organisational purposes of any kind, or in a commercial, corporate, governmental, military or organisational environment of any kind.
• Redistribution of the software and the documentation is allowed only in unmodified form of its current version and free of charge.

Data Protection Declaration

The web service is operated and provided by

The web service provider stores a session cookie in the web browser and records every visit of this web site with the following data in an access log on their server(s):

• the (pseudonymised) IP address;
• the date and time of the request;
• the URL of the requested web page or file;
• the Referer and User-Agent HTTP headers sent by the web browser;
• the result (success or failure) of the request;
• the amount of data received and sent.