New
#350
Go to Specucheck which is actually https://github.com/ionescu007/SpecuCheck/releases
There you will see a list of Assets thus:
Assuming you want the 64-Bit version, click on SpecuCheck.exe and when prompted, SAVE it somewhere helpful (I use my Downloads Folder)
Then COPY SpecuCheck.exe to C:\ (You may need to provide administrator permission)
Run Command Prompt (Admin)
That will open the Command prompt screen thus:
(Excuse my colour scheme!)
The CD C:\ command sets you to the root of C:\ (It stands for Change Directory)
The DIR command shows you what files are IN the root of C:\
One of them is SpecuCheck.exe, so the last line in my screenshot is awaiting an "Enter"
Voila!
One of the good things about growing up with DOS (and VMS) is I once had to use command lines to do EVERYTHING! You young people with your GUIs don't even realise you've got it made...
A word of warning - it is NOT a good idea to get into the habit of putting executables in the root of your system drive. ONLY do it in cases like these, when you know that the file is safe and there is no other way to run it. In this case it could probably be run from a Users folder but that makes the command lines more tricky.
The executable is free from malware. I check all my downloads with VirusTotal. So, don't worry about it.
You can copy the executable (.exe file) that you extract from the .zip file to C:\ so it's easily accessible from the Command Prompt.
Also, from the Motivation and Caveats sections of the page I linked in my previous post, note that the author of the utility recommends that you rather use the PowerShell Cmdlet Module provided by Microsoft:
"Since then, Microsoft has done great work to expose that data from the kernel-mode in a concise matter, which succinctly indicates the kernel’s support and usage of the various mitigating technologies and hardware features, and released a PowerShell CmdLet Module to retrieve that data. SpecuCheck, therefore, remains only as a research tool and is not recommended – please use the Microsoft-approved PowerShell Module instead."
"SpecuCheck relies on undocumented system calls and information classes which are subject to change. Additionally, SpecuCheck only returns the information that the Windows Kernel is storing about the state of the mitigations and hardware features – based on policy settings (registry, boot parameters) or other compatibility flags, the Windows Kernel’s state may not match the true hardware state. The goal of this tool is to give you a Windows-specific assessment, not a hardware assessment that is OS-agnostic.
SpecuCheck is only a research tool and is not recommended for general or commercial use – please use the Microsoft-approved PowerShell Module instead."
For more on the PowerShell script, see
https://betanews.com/2018/01/05/micr...pectre-script/
Thanks a lot!. Very well explained. I finally did it, and here is the result from SpecuCheck:
Attachment 212706
![]()
![]()
Last edited by IronZorg89; 17 Nov 2018 at 16:37.
As @PrivacyFreak said - no thanks required. Do read his caveats above though - this is a useful tool but with limitations.
Also, here's a link to a guide from @Brink
Windows Client Guidance against speculative execution vulnerabilities