flat assembler
Message board for the users of flat assembler.

Index > Windows > IsProcessorFeaturePresent or CPUID?

Goto page 1, 2  Next
Author
Thread Post new topic Reply to topic
Mat Quasar



Joined: 15 Dec 2024
Posts: 54
Mat Quasar 26 Dec 2024, 08:23
Hi, since I am learning Windows GUI programming, I want to do a Windows dialog that shows basic CPU info, including like presence of AVX, SSE....

But I found IsProcessorFeaturePresent Win32 API. Should I use CPUID to detect or that API function?
(https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-isprocessorfeaturepresent)

According to my understanding, even if CPUID detect presence of a processor feature, it might not be supported by the OS, so I am thinking IsProcessorFeaturePresent can detect support of processor feature by both CPU and Windows.

Any advice?


Description: FASM code for CLI program that retrieve 64-byte processor features from KUSER_SHARED_DATA
Download
Filename: features.ASM
Filesize: 7.15 KB
Downloaded: 30 Time(s)



Last edited by Mat Quasar on 29 Dec 2024, 10:39; edited 3 times in total
Post 26 Dec 2024, 08:23
View user's profile Send private message Reply with quote
macomics



Joined: 26 Jan 2021
Posts: 1041
Location: Russia
macomics 26 Dec 2024, 09:23
IsProcessorFeaturePresent this function is just an analog of the CPUID instruction for high level languages.

To verify this, you can take a debugger and examine the code of this API function.
In any case, the OS takes all the information through the CPUID instruction.
Post 26 Dec 2024, 09:23
View user's profile Send private message Reply with quote
Mat Quasar



Joined: 15 Dec 2024
Posts: 54
Mat Quasar 26 Dec 2024, 10:27
macomics wrote:
IsProcessorFeaturePresent this function is just an analog of the CPUID instruction for high level languages.

To verify this, you can take a debugger and examine the code of this API function.
In any case, the OS takes all the information through the CPUID instruction.


Thanks. I think I will use this API function, much easier.

Maybe I will trace the API code after I start doing it.
Post 26 Dec 2024, 10:27
View user's profile Send private message Reply with quote
Core i7



Joined: 14 Nov 2024
Posts: 28
Location: Socket in motherboard
Core i7 26 Dec 2024, 10:46
Mat Quasar wrote:
Thanks. I think I will use this API function, much easier.
Maybe I will trace the API code after I start doing it.

Code:
0:000> uf IsProcessorFeaturePresent
kernel32!IsProcessorFeaturePresent:
00000000`77bbcb30 83f903          cmp     ecx,3
00000000`77bbcb33 7414            je      kernel32!IsProcessorFeaturePresent+0x19 (00000000`77bbcb49)

kernel32!IsProcessorFeaturePresent+0x5:
00000000`77bbcb35 83f907          cmp     ecx,7
00000000`77bbcb38 740f            je      kernel32!IsProcessorFeaturePresent+0x19 (00000000`77bbcb49)

kernel32!IsProcessorFeaturePresent+0xa:
00000000`77bbcb3a 83f940          cmp     ecx,40h
00000000`77bbcb3d 730a            jae     kernel32!IsProcessorFeaturePresent+0x19 (00000000`77bbcb49)

kernel32!IsProcessorFeaturePresent+0xf:
00000000`77bbcb3f 8bc1            mov     eax,ecx
00000000`77bbcb41 0fb6807402fe7f  movzx   eax,byte ptr SharedUserData+0x274 (00000000`7ffe0274)[rax]
00000000`77bbcb48 c3              ret

kernel32!IsProcessorFeaturePresent+0x19:
00000000`77bbcb49 33c0            xor     eax,eax
00000000`77bbcb4b c3              ret
    
Post 26 Dec 2024, 10:46
View user's profile Send private message Reply with quote
Core i7



Joined: 14 Nov 2024
Posts: 28
Location: Socket in motherboard
Core i7 26 Dec 2024, 11:44
The IsProcessorFeaturePresent() function is not suitable for collecting information about the processor, because it returns one thing that you specify as a parameter in the RCX register (x64 system). That is, to check all the capabilities of the CPU, you will need to call it 32 times, and each time it will read 1 byte from the KUSER_SHARED_DATA structure. Therefore, it is better to use the CPUID instruction, which returns a 32-bit mask with all the characteristics at once - you just have to move the bits through shr, checking them for 1.


Description:
Filesize: 10.12 KB
Viewed: 1124 Time(s)

x64Dbg.png


Description:
Download
Filename: CPUID_Intel-AMD.zip
Filesize: 824.49 KB
Downloaded: 37 Time(s)

Post 26 Dec 2024, 11:44
View user's profile Send private message Reply with quote
Mat Quasar



Joined: 15 Dec 2024
Posts: 54
Mat Quasar 26 Dec 2024, 12:44
Core i7 wrote:
...That is, to check all the capabilities of the CPU, you will need to call it 32 times, and each time it will read 1 byte from the KUSER_SHARED_DATA structure. Therefore, it is better to use the CPUID instruction, which returns a 32-bit mask with all the characteristics at once.


You have a valid point here. I will use CPUID then.

And how lovely you are, you gave me the CPUID manual for both Intel and AMD! Thank you so much. I checked, 32-bit mask that you mentioned is in Table 5.5 (Intel manual).

Very Happy

EDIT: Oops, maybe 2 x 32-bit masks, in Table 5.5 and Table 5.6.
Post 26 Dec 2024, 12:44
View user's profile Send private message Reply with quote
Core i7



Joined: 14 Nov 2024
Posts: 28
Location: Socket in motherboard
Core i7 26 Dec 2024, 13:02
Mat Quasar wrote:
EDIT: Oops, maybe 2 x 32-bit masks, in Table 5.5 and Table 5.6.

Yes, that's right.
I once wrote a similar program with a call CPUID, only I displayed the result on the console. You can see an example here:
https://codeby.net/threads/cpuid-identifikacija-processora.78279/
Post 26 Dec 2024, 13:02
View user's profile Send private message Reply with quote
Mat Quasar



Joined: 15 Dec 2024
Posts: 54
Mat Quasar 26 Dec 2024, 13:25
Core i7 wrote:
Mat Quasar wrote:
EDIT: Oops, maybe 2 x 32-bit masks, in Table 5.5 and Table 5.6.

Yes, that's right.
I once wrote a similar program with a call CPUID, only I displayed the result on the console. You can see an example here:
https://codeby.net/threads/cpuid-identifikacija-processora.78279/


Nice! Can I use your code for the following functions?

Quote:

Function EAX=4. (Deterministic Cache Parameters)
Function EAX=8000_0001h (Extended Feature Bits)
Function EAX=8000_0006h (Extended L2 Cache Features)
Function EAX=8000_0008h (Virtual & Physical Address Sizes)


I can do myself for the rest. It is best if you have code for calculating TSC frequency.

My translation reads:
Quote:
The experiments above showed that CPUID is initially unable to return some information. For example, it does not contain data such as: core code name, operating voltage threshold, socket type, power consumption, and manufacturing process technology value. Apparently, software like CPU-Z stores all this in its tables, which programmers meticulously collect manually. Databases of this kind are written based on the "Family/Model/Stepping" values ​​provided to us by the functionCPUID.EAX=1.


So CPU-Z keeps a comprehensive database based on results returned by EAX register for EAX=1 CPUID instruction.

ADD: Your CPUID example hangs on my AMD PC maybe because your program is targeted for Intel only.

I read this paragraph just now:
Quote:
Moreover, the presented table is valid only for Intel processors, since AMD has a completely different numbering of functions.


Description: CPUID program hangs when reading EAX=2 CPUID instruction
Filesize: 17.17 KB
Viewed: 1086 Time(s)

icore7.PNG


Post 26 Dec 2024, 13:25
View user's profile Send private message Reply with quote
Mat Quasar



Joined: 15 Dec 2024
Posts: 54
Mat Quasar 26 Dec 2024, 13:53
Looks like https://codeby.net/ (InfoSec) is a very technical forum for Russians.

I like to see the atmosphere there. In comparision, my country's coding forum is less technical.


Description: Local coding forum which I visited has low traffic, and it isn't as technical
Filesize: 14.72 KB
Viewed: 1080 Time(s)

codemaster.PNG


Post 26 Dec 2024, 13:53
View user's profile Send private message Reply with quote
Core i7



Joined: 14 Nov 2024
Posts: 28
Location: Socket in motherboard
Core i7 26 Dec 2024, 15:02
Mat Quasar wrote:
Can I use your code for the following functions?

No problem! since there is nothing secret and everything is elementary.
Yes, it freezes because the code is for Intel processors.
To calculate the TSC value, you need to measure the clocks for 1 second, like this:
Code:
     mov    ecx,2        ; cycle
@@:  push   rcx
     xor    eax,eax 
     cpuid               ; clear cpu pipeline
     rdtsc 
     push   rax 
     invoke Sleep,1000   ; wait 1-sec..
     rdtsc 
     pop    rbx 
     sub    rax,rbx      ; difference
     pop    rcx
     dec    rcx 
     jnz    @b           ; RAX = tsc value    
Post 26 Dec 2024, 15:02
View user's profile Send private message Reply with quote
Mat Quasar



Joined: 15 Dec 2024
Posts: 54
Mat Quasar 26 Dec 2024, 15:17
Thank you for your permission.

About the code to get TSC value, it is different from the CPUID table that I saw. I will confirm after I start doing it.
Post 26 Dec 2024, 15:17
View user's profile Send private message Reply with quote
Core i7



Joined: 14 Nov 2024
Posts: 28
Location: Socket in motherboard
Core i7 26 Dec 2024, 15:17
Mat Quasar wrote:
So CPU-Z keeps a comprehensive database based on results returned by EAX register for EAX=1 CPUID instruction.

Аn example of searching for a kernel code name is here, but also for Intel processors:
https://codeby.net/threads/sistemnye-tajmery-chast-6-osnovy-profilirovanija-koda.74153/
Post 26 Dec 2024, 15:17
View user's profile Send private message Reply with quote
Core i7



Joined: 14 Nov 2024
Posts: 28
Location: Socket in motherboard
Core i7 26 Dec 2024, 15:43
If you want to write a universal identification code for Intel/AMD processors, you will need to create 2 separate CPUID procedures. Then at the entrance you will need to find out the manufacturer on the current machine. Previously, there was such a method for detecting the vendor Intel/AMD - I wonder if it works on new processors now, or AMD corrected the error based on the ZF flag?
Code:
format   pe console
include 'win32ax.inc'
entry    start
;//-----------
.data
intel   db  10,' Intel',0
amd     db  10,' AMD',0
;//-----------
.code
start:  xor      edx,edx
        mov      eax,5
        mov      ebx,2
        div      ebx

        mov      eax,intel
        jz       @prn
        mov      eax,amd
@prn:   cinvoke  printf,eax

@exit:  cinvoke  _getch
        cinvoke  exit, 0
;//-----------
section '.idata' import data readable
library  msvcrt,'msvcrt.dll'
import   msvcrt,printf,'printf',exit,'exit',_getch,'_getch'    
Post 26 Dec 2024, 15:43
View user's profile Send private message Reply with quote
bitRAKE



Joined: 21 Jul 2003
Posts: 4073
Location: vpcmpistri
bitRAKE 26 Dec 2024, 17:08
Mat Quasar wrote:
According to my understanding, even if CPUID detect presence of a processor feature, it might not be supported by the OS, so I am thinking IsProcessorFeaturePresent can detect support of processor feature by both CPU and Windows.
KUSER_SHARED_DATA.ProcessorFeatures is mapped into every processes address space - there is no need to use IsProcessorFeaturePresent. Here is the complete list of features I've gathered. There are cases where both would be needed. So, I recommend being familiar with using CPUID as the OS is only concerned with features that change how it works.

There are features like fastfail that have nothing to do with CPUID:
Code:
calminstruction __fastfail value* ; program state unknown, end process, does not return
        asm     mov ecx,value
        asm     int 0x29
end calminstruction    

_________________
¯\(°_o)/¯ “languages are not safe - uses can be” Bjarne Stroustrup
Post 26 Dec 2024, 17:08
View user's profile Send private message Visit poster's website Reply with quote
Mat Quasar



Joined: 15 Dec 2024
Posts: 54
Mat Quasar 27 Dec 2024, 05:14
Very informative, bitRAKE.
Post 27 Dec 2024, 05:14
View user's profile Send private message Reply with quote
Mat Quasar



Joined: 15 Dec 2024
Posts: 54
Mat Quasar 27 Dec 2024, 06:04
After taking into recommendation by you guys, I plan to do both CPUID instruction and IsProcessorFeaturePresent function.
(As seen in screenshot below)

The KUSER_SHARED_DATA address maybe can get from TEB or PEB? I haven't fully read it. Nice to know.


Description: Concept
Filesize: 7.32 KB
Viewed: 939 Time(s)

cpuy.PNG


Post 27 Dec 2024, 06:04
View user's profile Send private message Reply with quote
Mat Quasar



Joined: 15 Dec 2024
Posts: 54
Mat Quasar 27 Dec 2024, 06:08
Core i7 wrote:
Previously, there was such a method for detecting the vendor Intel/AMD - I wonder if it works on new processors now, or AMD corrected the error based on the ZF flag?


I don't know how reliable it is, but can't we get CPU brand string from EAX = 0 CPUID instruction?

AuthenticAMD" or "GenuineIntel".

But it is good to know we need two different procedures for each AMD and Intel.
Post 27 Dec 2024, 06:08
View user's profile Send private message Reply with quote
macomics



Joined: 26 Jan 2021
Posts: 1041
Location: Russia
macomics 27 Dec 2024, 06:27
Mat Quasar wrote:
I don't know how reliable it is, but can't we get CPU brand string from EAX = 0 CPUID instruction?
It's reliable. But there are more processors than just Intel and AMD. Now only they remain on the market as manufacturers of processors for universal PCs, but there have been before and there may be new manufacturers in the future.
Post 27 Dec 2024, 06:27
View user's profile Send private message Reply with quote
Core i7



Joined: 14 Nov 2024
Posts: 28
Location: Socket in motherboard
Core i7 27 Dec 2024, 06:46
Mat Quasar wrote:
The KUSER_SHARED_DATA address maybe can get from TEB or PEB?

This address is the same for x64/32 and is equal to 0x7FFE0000
Post 27 Dec 2024, 06:46
View user's profile Send private message Reply with quote
Core i7



Joined: 14 Nov 2024
Posts: 28
Location: Socket in motherboard
Core i7 27 Dec 2024, 07:13
In the x64dbg debugger, you can view structures.
To do this, you need to create a *.txt script file, and select the structure name from it, specify the address.
Here is my script, and the sequence of actions with the right mouse button.
This way you can output many structures in a convenient form, including PEB/TEB and many others:


Description:
Filesize: 33.97 KB
Viewed: 909 Time(s)

x64dbg_script.png


Description:
Download
Filename: x64Dbg_Scripts.zip
Filesize: 4.77 KB
Downloaded: 33 Time(s)

Post 27 Dec 2024, 07:13
View user's profile Send private message Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  
Goto page 1, 2  Next

< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2025, Tomasz Grysztar. Also on GitHub, YouTube.

Website powered by rwasa.