| decode.rs |
Decodes a `MitigationOptions` bitmask into a human-readable summary.
Since the register keys are pretty much undocumented, the data in this module comes from a
mixture of sources:
* The `PROCESS_CREATION_MITIGATION_POLICY*` constants in WinBase.h (not
exported to their windows-sys crates), that describes relevant but NOT identical data, as
discovered through experimentation
* Some data compiled by a stranger on the Internet:
<https://theryuu.github.io/ifeo-mitigationoptions.txt>
* Finally, what we could extract ourselves through experimentation in a Windows VM. See
`scripts/Calibrate-MitigationOptions.ps1`, which is where every offset and variant below
comes from; the table was last calibrated against Windows 11 24H2 (build 26100).
Note that the `Audit*` mitigations do not appear here at all: they are written to a
sibling `MitigationAuditOptions` registry value, which we do not read. |
9438 |
0 % |
| error.rs |
Contains the error type for this crate |
1512 |
0 % |
| lib.rs |
Crate to read the Windows process mitigation options that are configured on the
system for the current executable, both the per-application Exploit Protection
settings and the system-wide defaults. |
643 |
100 % |
| query.rs |
Queries the Windows registry for the process mitigation options that are configured on
the system, both the per-application Exploit Protection settings and the system-wide
defaults. |
13828 |
16 % |
| registry.rs |
This module contains helpers for exploring the Windows Registry |
12368 |
32 % |