Broadcast.c File Reference

Broadcast debugger function to all logical cores. More...

#include "pch.h"

Functions
VOID	BroadcastVmxVirtualizationAllCores ()
	routines to broadcast virtualization and vmx initialization on all cores
VOID	BroadcastEnableDbAndBpExitingAllCores ()
	routines to set vm-exit on all #DBs and #BP on all cores
VOID	BroadcastDisableDbAndBpExitingAllCores ()
	routines to unset vm-exit on all #DBs and #BP on all cores
VOID	BroadcastEnableBreakpointExitingOnExceptionBitmapAllCores ()
	routines to enable vm-exit for breakpoints (exception bitmap)
VOID	BroadcastDisableBreakpointExitingOnExceptionBitmapAllCores ()
	routines to disable vm-exit for breakpoints (exception bitmap)
VOID	BroadcastEnableNmiExitingAllCores ()
	routines to set vm-exit on all NMIs on all cores
VOID	BroadcastDisableNmiExitingAllCores ()
	routines to set vm-exit on all NMIs on all cores
VOID	BroadcastNotifyAllToInvalidateEptAllCores ()
	routines to notify to invalidate their ept on all cores
VOID	BroadcastEnableRdtscExitingAllCores ()
	a broadcast that causes vm-exit on all execution of rdtsc/rdtscp
VOID	BroadcastDisableRdtscExitingAllCores ()
	a broadcast that causes for disabling rdtsc/p exiting
VOID	BroadcastChangeAllMsrBitmapReadAllCores (UINT64 BitmapMask)
	routines for !msrread command which
VOID	BroadcastResetChangeAllMsrBitmapReadAllCores ()
	routines for disable (reset) !msrread command
VOID	BroadcastChangeAllMsrBitmapWriteAllCores (UINT64 BitmapMask)
	routines for !msrwrite command which
VOID	BroadcastResetAllMsrBitmapWriteAllCores ()
	routines for reset !msrwrite command which
VOID	BroadcastDisableRdtscExitingForClearingEventsAllCores ()
	routines ONLY for disabling !tsc command
VOID	BroadcastDisableMov2ControlRegsExitingForClearingEventsAllCores (PDEBUGGER_EVENT_OPTIONS BroadcastingOption)
	routines ONLY for disabling !crwrite command
VOID	BroadcastDisableMov2DebugRegsExitingForClearingEventsAllCores ()
	routines ONLY for disabling !dr command
VOID	BroadcastEnableRdpmcExitingAllCores ()
	routines for !pmc
VOID	BroadcastDisableRdpmcExitingAllCores ()
	routines for disabling !pmc
VOID	BroadcastSetExceptionBitmapAllCores (UINT64 ExceptionIndex)
	routines for !exception command which
VOID	BroadcastUnsetExceptionBitmapAllCores (UINT64 ExceptionIndex)
	routines for disabling exception bitmap
VOID	BroadcastResetExceptionBitmapAllCores ()
	routines for reset !exception command
VOID	BroadcastEnableMovControlRegisterExitingAllCores (PDEBUGGER_EVENT_OPTIONS BroadcastingOption)
	routines for !crwrite
VOID	BroadcastDisableMovToControlRegistersExitingAllCores (PDEBUGGER_EVENT_OPTIONS BroadcastingOption)
	routines for disabling !crwrite
VOID	BroadcastEnableMovDebugRegistersExitingAllCores ()
	routines for !dr
VOID	BroadcastDisableMovDebugRegistersExitingAllCores ()
	routines for disabling !dr
VOID	BroadcastSetExternalInterruptExitingAllCores ()
	routines for !interrupt command which
VOID	BroadcastUnsetExternalInterruptExitingOnlyOnClearingInterruptEventsAllCores ()
	routines for ONLY terminate !interrupt command
VOID	BroadcastIoBitmapChangeAllCores (UINT64 Port)
	routines for !ioin and !ioout command which
VOID	BroadcastIoBitmapResetAllCores ()
	routines for reset !ioin and !ioout command
VOID	BroadcastEnableMovToCr3ExitingOnAllProcessors ()
	routines for debugging threads (enable mov-to-cr3 exiting)
VOID	BroadcastChangeToMbecSupportedEptpOnAllProcessors ()
	routines for changing EPTP to an MBEC supported EPTP
VOID	BroadcastRestoreToNormalEptpOnAllProcessors ()
	routines for restoring EPTP to normal EPTP
VOID	BroadcasDisableMbecOnAllProcessors ()
	routines for disabling MBEC
VOID	BroadcasEnableMbecOnAllProcessors ()
	routines for enabling MBEC
VOID	BroadcastDisableMovToCr3ExitingOnAllProcessors ()
	routines for debugging threads (disable mov-to-cr3 exiting)
VOID	BroadcastEnableEferSyscallEventsOnAllProcessors ()
	routines for enabling syscall hooks on all cores
VOID	BroadcastDisableEferSyscallEventsOnAllProcessors ()
	routines for disabling syscall hooks on all cores
VOID	BroadcastEnablePmlOnAllProcessors ()
	routines for enabling PML on all cores
VOID	BroadcastDisablePmlOnAllProcessors ()
	routines for disabling PML on all cores

Detailed Description

Broadcast debugger function to all logical cores.

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

This file uses DPC to run its functions on all logical cores

Version

0.1

Date

2020-04-10

Copyright

This project is released under the GNU Public License v3.

Function Documentation

BroadcasDisableMbecOnAllProcessors()

VOID BroadcasDisableMbecOnAllProcessors

(

)

routines for disabling MBEC

Returns

VOID

{
    KeGenericCallDpc(DpcRoutineEnableOrDisableMbec, 0x0);
}

BroadcasEnableMbecOnAllProcessors()

VOID BroadcasEnableMbecOnAllProcessors

(

)

routines for enabling MBEC

Returns

VOID

{
    KeGenericCallDpc(DpcRoutineEnableOrDisableMbec, (PVOID)0x1);
}

BroadcastChangeAllMsrBitmapReadAllCores()

VOID BroadcastChangeAllMsrBitmapReadAllCores

(

UINT64

BitmapMask

)

routines for !msrread command which

causes vm-exit on all msr reads

Parameters

BitmapMask

Bit mask of msr to put on msr bitmap

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineChangeMsrBitmapReadOnAllCores, (PVOID)BitmapMask);
}

BroadcastChangeAllMsrBitmapWriteAllCores()

VOID BroadcastChangeAllMsrBitmapWriteAllCores

(

UINT64

BitmapMask

)

routines for !msrwrite command which

causes vm-exit on all msr writes

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineChangeMsrBitmapWriteOnAllCores, (PVOID)BitmapMask);
}

BroadcastChangeToMbecSupportedEptpOnAllProcessors()

VOID BroadcastChangeToMbecSupportedEptpOnAllProcessors

(

)

routines for changing EPTP to an MBEC supported EPTP

Returns

VOID

{
    KeGenericCallDpc(DpcRoutineChangeToMbecSupportedEptp, 0x0);
}

BroadcastDisableBreakpointExitingOnExceptionBitmapAllCores()

VOID BroadcastDisableBreakpointExitingOnExceptionBitmapAllCores

(

)

routines to disable vm-exit for breakpoints (exception bitmap)

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineDisableBreakpointOnExceptionBitmapOnAllCores, NULL);
}

BroadcastDisableDbAndBpExitingAllCores()

VOID BroadcastDisableDbAndBpExitingAllCores

(

)

routines to unset vm-exit on all #DBs and #BP on all cores

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineDisableDbAndBpExitingOnAllCores, NULL);
}

BroadcastDisableEferSyscallEventsOnAllProcessors()

VOID BroadcastDisableEferSyscallEventsOnAllProcessors

(

)

routines for disabling syscall hooks on all cores

Returns

VOID

{
    KeGenericCallDpc(DpcRoutineDisableEferSyscallEvents, 0x0);
}

BroadcastDisableMov2ControlRegsExitingForClearingEventsAllCores()

VOID BroadcastDisableMov2ControlRegsExitingForClearingEventsAllCores

(

PDEBUGGER_EVENT_OPTIONS

BroadcastingOption

)

routines ONLY for disabling !crwrite command

Parameters

Event

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineDisableMov2CrExitingForClearingCrEventsAllCores, BroadcastingOption);
}

BroadcastDisableMov2DebugRegsExitingForClearingEventsAllCores()

VOID BroadcastDisableMov2DebugRegsExitingForClearingEventsAllCores

(

)

routines ONLY for disabling !dr command

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineDisableMov2DrExitingForClearingDrEventsAllCores, NULL);
}

BroadcastDisableMovDebugRegistersExitingAllCores()

VOID BroadcastDisableMovDebugRegistersExitingAllCores

(

)

routines for disabling !dr

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineDisableMovDebigRegisterExitingAllCores, NULL);
}

BroadcastDisableMovToControlRegistersExitingAllCores()

VOID BroadcastDisableMovToControlRegistersExitingAllCores

(

PDEBUGGER_EVENT_OPTIONS

BroadcastingOption

)

routines for disabling !crwrite

Parameters

Event

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineDisableMovControlRegisterExitingAllCores, BroadcastingOption);
}

BroadcastDisableMovToCr3ExitingOnAllProcessors()

VOID BroadcastDisableMovToCr3ExitingOnAllProcessors

(

)

routines for debugging threads (disable mov-to-cr3 exiting)

Returns

VOID

{
    KeGenericCallDpc(DpcRoutineDisableMovToCr3Exiting, 0x0);
}

BroadcastDisableNmiExitingAllCores()

VOID BroadcastDisableNmiExitingAllCores

(

)

routines to set vm-exit on all NMIs on all cores

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineDisableNmiVmexitOnAllCores, NULL);
}

BroadcastDisablePmlOnAllProcessors()

VOID BroadcastDisablePmlOnAllProcessors

(

)

routines for disabling PML on all cores

Returns

VOID

{
    KeGenericCallDpc(DpcRoutineDisablePml, 0x0);
}

BroadcastDisableRdpmcExitingAllCores()

VOID BroadcastDisableRdpmcExitingAllCores

(

)

routines for disabling !pmc

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineDisableRdpmcExitingAllCores, NULL);
}

BroadcastDisableRdtscExitingAllCores()

VOID BroadcastDisableRdtscExitingAllCores

(

)

a broadcast that causes for disabling rdtsc/p exiting

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineDisableRdtscExitingAllCores, NULL);
}

BroadcastDisableRdtscExitingForClearingEventsAllCores()

VOID BroadcastDisableRdtscExitingForClearingEventsAllCores

(

)

routines ONLY for disabling !tsc command

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineDisableRdtscExitingForClearingTscEventsAllCores, NULL);
}

BroadcastEnableBreakpointExitingOnExceptionBitmapAllCores()

VOID BroadcastEnableBreakpointExitingOnExceptionBitmapAllCores

(

)

routines to enable vm-exit for breakpoints (exception bitmap)

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineEnableBreakpointOnExceptionBitmapOnAllCores, NULL);
}

BroadcastEnableDbAndBpExitingAllCores()

VOID BroadcastEnableDbAndBpExitingAllCores

(

)

routines to set vm-exit on all #DBs and #BP on all cores

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineEnableDbAndBpExitingOnAllCores, NULL);
}

BroadcastEnableEferSyscallEventsOnAllProcessors()

VOID BroadcastEnableEferSyscallEventsOnAllProcessors

(

)

routines for enabling syscall hooks on all cores

Returns

VOID

{
    KeGenericCallDpc(DpcRoutineEnableEferSyscallEvents, 0x0);
}

BroadcastEnableMovControlRegisterExitingAllCores()

VOID BroadcastEnableMovControlRegisterExitingAllCores

(

PDEBUGGER_EVENT_OPTIONS

BroadcastingOption

)

routines for !crwrite

causes vm-exit on all accesses to debug registers

Parameters

Event

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineEnableMovControlRegisterExitingAllCores, BroadcastingOption);
}

BroadcastEnableMovDebugRegistersExitingAllCores()

VOID BroadcastEnableMovDebugRegistersExitingAllCores

(

)

routines for !dr

causes vm-exit on all accesses to debug registers

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineEnableMovDebigRegisterExitingAllCores, NULL);
}

BroadcastEnableMovToCr3ExitingOnAllProcessors()

VOID BroadcastEnableMovToCr3ExitingOnAllProcessors

(

)

routines for debugging threads (enable mov-to-cr3 exiting)

Returns

VOID

{
    KeGenericCallDpc(DpcRoutineEnableMovToCr3Exiting, 0x0);
}

BroadcastEnableNmiExitingAllCores()

VOID BroadcastEnableNmiExitingAllCores

(

)

routines to set vm-exit on all NMIs on all cores

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineEnableNmiVmexitOnAllCores, NULL);
}

BroadcastEnablePmlOnAllProcessors()

VOID BroadcastEnablePmlOnAllProcessors

(

)

routines for enabling PML on all cores

Returns

VOID

{
    KeGenericCallDpc(DpcRoutineEnablePml, 0x0);
}

BroadcastEnableRdpmcExitingAllCores()

VOID BroadcastEnableRdpmcExitingAllCores

(

)

routines for !pmc

causes vm-exit on all execution of rdpmc

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineEnableRdpmcExitingAllCores, NULL);
}

BroadcastEnableRdtscExitingAllCores()

VOID BroadcastEnableRdtscExitingAllCores

(

)

a broadcast that causes vm-exit on all execution of rdtsc/rdtscp

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineEnableRdtscExitingAllCores, NULL);
}

BroadcastIoBitmapChangeAllCores()

VOID BroadcastIoBitmapChangeAllCores

(

UINT64

Port

)

routines for !ioin and !ioout command which

causes vm-exit on all i/o instructions or one port

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineChangeIoBitmapOnAllCores, (PVOID)Port);
}

BroadcastIoBitmapResetAllCores()

VOID BroadcastIoBitmapResetAllCores

(

)

routines for reset !ioin and !ioout command

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineResetIoBitmapOnAllCores, NULL);
}

BroadcastNotifyAllToInvalidateEptAllCores()

VOID BroadcastNotifyAllToInvalidateEptAllCores

(

)

routines to notify to invalidate their ept on all cores

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineInvalidateEptOnAllCores, (PVOID)TRUE);
}

BroadcastResetAllMsrBitmapWriteAllCores()

VOID BroadcastResetAllMsrBitmapWriteAllCores

(

)

routines for reset !msrwrite command which

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineResetMsrBitmapWriteOnAllCores, NULL);
}

BroadcastResetChangeAllMsrBitmapReadAllCores()

VOID BroadcastResetChangeAllMsrBitmapReadAllCores

(

)

routines for disable (reset) !msrread command

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineResetMsrBitmapReadOnAllCores, NULL);
}

BroadcastResetExceptionBitmapAllCores()

VOID BroadcastResetExceptionBitmapAllCores

(

)

routines for reset !exception command

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineResetExceptionBitmapOnlyOnClearingExceptionEventsOnAllCores, NULL);
}

BroadcastRestoreToNormalEptpOnAllProcessors()

VOID BroadcastRestoreToNormalEptpOnAllProcessors

(

)

routines for restoring EPTP to normal EPTP

Returns

VOID

{
    KeGenericCallDpc(DpcRoutineRestoreToNormalEptp, 0x0);
}

BroadcastSetExceptionBitmapAllCores()

VOID BroadcastSetExceptionBitmapAllCores

(

UINT64

ExceptionIndex

)

routines for !exception command which

causes vm-exit when exception occurred

Parameters

ExceptionIndex

index of exception on IDT

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineSetExceptionBitmapOnAllCores, (PVOID)ExceptionIndex);
}

BroadcastSetExternalInterruptExitingAllCores()

VOID BroadcastSetExternalInterruptExitingAllCores

(

)

routines for !interrupt command which

causes vm-exit when external interrupt occurs

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineSetEnableExternalInterruptExitingOnAllCores, NULL);
}

BroadcastUnsetExceptionBitmapAllCores()

VOID BroadcastUnsetExceptionBitmapAllCores

(

UINT64

ExceptionIndex

)

routines for disabling exception bitmap

removes vm-exit when exception occurred

Parameters

ExceptionIndex

index of exception on IDT

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineUnsetExceptionBitmapOnAllCores, (PVOID)ExceptionIndex);
}

BroadcastUnsetExternalInterruptExitingOnlyOnClearingInterruptEventsAllCores()

VOID BroadcastUnsetExternalInterruptExitingOnlyOnClearingInterruptEventsAllCores

(

)

routines for ONLY terminate !interrupt command

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineSetDisableExternalInterruptExitingOnlyOnClearingInterruptEventsOnAllCores, NULL);
}

BroadcastVmxVirtualizationAllCores()

VOID BroadcastVmxVirtualizationAllCores

(

)

routines to broadcast virtualization and vmx initialization on all cores

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutinePerformVirtualization, NULL);
}