Configuration.c File Reference

Configuration interface for hypervisor events. More...

#include "pch.h"

Functions
VOID	ConfigureEnableMovToCr3ExitingOnAllProcessors ()
	routines for debugging threads (enable mov-to-cr3 exiting)
BOOLEAN	ConfigureInitializeExecTrapOnAllProcessors ()
	routines for initializing user-mode, kernel-mode exec trap
VOID	ConfigureUninitializeExecTrapOnAllProcessors ()
	routines for uninitializing user-mode, kernel-mode exec trap
BOOLEAN	ConfigureExecTrapAddProcessToWatchingList (UINT32 ProcessId)
	Add the target process to the watching list.
BOOLEAN	ConfigureExecTrapRemoveProcessFromWatchingList (UINT32 ProcessId)
	Remove the target process from the watching list.
VOID	ConfigureModeBasedExecHookUninitializeOnAllProcessors ()
	routines for initializing Mode-based execution hooks
VOID	ConfigureDirtyLoggingInitializeOnAllProcessors ()
	routines for initializing dirty logging mechanism
VOID	ConfigureDirtyLoggingUninitializeOnAllProcessors ()
	routines for uninitializing dirty logging mechanism
VOID	ConfigureDisableMovToCr3ExitingOnAllProcessors ()
	routines for debugging threads (disable mov-to-cr3 exiting)
VOID	ConfigureEnableEferSyscallEventsOnAllProcessors ()
	routines for enabling syscall hooks on all cores
VOID	ConfigureDisableEferSyscallEventsOnAllProcessors ()
	routines for disabling syscall hooks on all cores
BOOLEAN	ConfigureEptHookUnHookAllByHookingTag (UINT64 HookingTag)
	Remove all hooks from the hooked pages list using Hooking Tag.
BOOLEAN	ConfigureEptHookUnHookSingleHookByHookingTagFromVmxRoot (UINT64 HookingTag, EPT_SINGLE_HOOK_UNHOOKING_DETAILS *TargetUnhookingDetails)
	Remove single hook from the hooked pages by the given hooking tag.
BOOLEAN	ConfigureEptHookUnHookSingleAddress (UINT64 VirtualAddress, UINT64 PhysAddress, UINT32 ProcessId)
	Remove single hook from the hooked pages list and invalidate TLB.
BOOLEAN	ConfigureEptHookUnHookSingleAddressFromVmxRoot (UINT64 VirtualAddress, UINT64 PhysAddress, EPT_SINGLE_HOOK_UNHOOKING_DETAILS *TargetUnhookingDetails)
	Remove single hook from the hooked pages list and invalidate TLB.
VOID	ConfigureEptHookAllocateExtraHookingPagesForMemoryMonitorsAndExecEptHooks (UINT32 Count)
	Allocate (reserve) extra pages for storing details of page hooks for memory monitor and regular hidden breakpoit exec EPT hooks.
VOID	ConfigureEptHookReservePreallocatedPoolsForEptHooks (UINT32 Count)
	Allocate (reserve) pages for storing EPT hooks page hooks.
BOOLEAN	ConfigureEptHook (PVOID TargetAddress, UINT32 ProcessId)
	This function invokes a VMCALL to set the hook and broadcast the exiting for the breakpoints on exception bitmap.
BOOLEAN	ConfigureEptHookFromVmxRoot (PVOID TargetAddress)
	This function invokes a direct VMCALL to setup the hook.
BOOLEAN	ConfigureEptHook2 (UINT32 CoreId, PVOID TargetAddress, PVOID HookFunction, UINT32 ProcessId)
	This function allocates a buffer in VMX Non Root Mode and then invokes a VMCALL to set the hook (inline)
BOOLEAN	ConfigureEptHookMonitor (UINT32 CoreId, EPT_HOOKS_ADDRESS_DETAILS_FOR_MEMORY_MONITOR *HookingDetails, UINT32 ProcessId)
	This function allocates a buffer in VMX Non Root Mode and then invokes a VMCALL to set the hook.
BOOLEAN	ConfigureEptHook2FromVmxRoot (UINT32 CoreId, PVOID TargetAddress, PVOID HookFunction)
	This function allocates a buffer in VMX Non Root Mode and then invokes a VMCALL to set the hook (inline EPT hook)
BOOLEAN	ConfigureEptHookMonitorFromVmxRoot (UINT32 CoreId, EPT_HOOKS_ADDRESS_DETAILS_FOR_MEMORY_MONITOR *MemoryAddressDetails)
	This function allocates a buffer in VMX Non Root Mode and then invokes a VMCALL to set the hook.
BOOLEAN	ConfigureEptHookModifyInstructionFetchState (UINT32 CoreId, PVOID PhysicalAddress, BOOLEAN IsUnset)
	Change PML EPT state for execution (execute) @detail should be called from VMX-root.
BOOLEAN	ConfigureEptHookModifyPageReadState (UINT32 CoreId, PVOID PhysicalAddress, BOOLEAN IsUnset)
	Change PML EPT state for read @detail should be called from VMX-root.
BOOLEAN	ConfigureEptHookModifyPageWriteState (UINT32 CoreId, PVOID PhysicalAddress, BOOLEAN IsUnset)
	Change PML EPT state for write @detail should be called from VMX-root.
VOID	ConfigureEnableEferSyscallHookOnSingleCore (UINT32 TargetCoreId)
	routines for enabling EFER syscall hooks on a single core
VOID	ConfigureSetEferSyscallOrSysretHookType (DEBUGGER_EVENT_SYSCALL_SYSRET_TYPE SyscallHookType)
	routines for setting EFER syscall or sysret hooks type
VOID	ConfigureSetExternalInterruptExitingOnSingleCore (UINT32 TargetCoreId)
	set external interrupt exiting on a single core
VOID	ConfigureEnableRdtscExitingOnSingleCore (UINT32 TargetCoreId)
	enable RDTSC exiting on a single core
VOID	ConfigureEnableRdpmcExitingOnSingleCore (UINT32 TargetCoreId)
	enable RDPMC exiting on a single core
VOID	ConfigureEnableMovToDebugRegistersExitingOnSingleCore (UINT32 TargetCoreId)
	enable mov 2 debug register exiting on a single core
VOID	ConfigureSetExceptionBitmapOnSingleCore (UINT32 TargetCoreId, UINT32 BitMask)
	set exception bitmap on a single core
VOID	ConfigureEnableMovToControlRegisterExitingOnSingleCore (UINT32 TargetCoreId, DEBUGGER_EVENT_OPTIONS *BroadcastingOption)
	enable mov 2 control register on a single core
VOID	ConfigureChangeMsrBitmapWriteOnSingleCore (UINT32 TargetCoreId, UINT64 MsrMask)
	change the mask of msr bitmaps for write on a single core
VOID	ConfigureChangeMsrBitmapReadOnSingleCore (UINT32 TargetCoreId, UINT64 MsrMask)
	change the mask of msr bitmaps for read on a single core
VOID	ConfigureChangeIoBitmapOnSingleCore (UINT32 TargetCoreId, UINT64 Port)
	change I/O port bitmap on a single core

Detailed Description

Configuration interface for hypervisor events.

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.2

Date

2023-01-26

Copyright

This project is released under the GNU Public License v3.

Function Documentation

ConfigureChangeIoBitmapOnSingleCore()

VOID ConfigureChangeIoBitmapOnSingleCore	(	UINT32	TargetCoreId,
		UINT64	Port )

change I/O port bitmap on a single core

Parameters

TargetCoreId	The target core's ID (to just run on this core)
Port	Target port in I/O bitmap

Returns

VOID

{
    DpcRoutineRunTaskOnSingleCore(TargetCoreId, (PVOID)DpcRoutinePerformChangeIoBitmapOnSingleCore, (PVOID)Port);
}

ConfigureChangeMsrBitmapReadOnSingleCore()

VOID ConfigureChangeMsrBitmapReadOnSingleCore	(	UINT32	TargetCoreId,
		UINT64	MsrMask )

change the mask of msr bitmaps for read on a single core

Parameters

TargetCoreId	The target core's ID (to just run on this core)
MsrMask	The ECX in MSR (mask)

Returns

VOID

{
    DpcRoutineRunTaskOnSingleCore(TargetCoreId, (PVOID)DpcRoutinePerformChangeMsrBitmapReadOnSingleCore, (PVOID)MsrMask);
}

ConfigureChangeMsrBitmapWriteOnSingleCore()

VOID ConfigureChangeMsrBitmapWriteOnSingleCore	(	UINT32	TargetCoreId,
		UINT64	MsrMask )

change the mask of msr bitmaps for write on a single core

Parameters

TargetCoreId	The target core's ID (to just run on this core)
MsrMask	The ECX in MSR (mask)

Returns

VOID

{
    DpcRoutineRunTaskOnSingleCore(TargetCoreId, (PVOID)DpcRoutinePerformChangeMsrBitmapWriteOnSingleCore, (PVOID)MsrMask);
}

ConfigureDirtyLoggingInitializeOnAllProcessors()

VOID ConfigureDirtyLoggingInitializeOnAllProcessors

(

)

routines for initializing dirty logging mechanism

Returns

VOID

{
    DirtyLoggingInitialize();
}

ConfigureDirtyLoggingUninitializeOnAllProcessors()

VOID ConfigureDirtyLoggingUninitializeOnAllProcessors

(

)

routines for uninitializing dirty logging mechanism

Returns

VOID

{
    DirtyLoggingUninitialize();
}

ConfigureDisableEferSyscallEventsOnAllProcessors()

VOID ConfigureDisableEferSyscallEventsOnAllProcessors

(

)

routines for disabling syscall hooks on all cores

Returns

VOID

{
    BroadcastDisableEferSyscallEventsOnAllProcessors();
}

ConfigureDisableMovToCr3ExitingOnAllProcessors()

VOID ConfigureDisableMovToCr3ExitingOnAllProcessors

(

)

routines for debugging threads (disable mov-to-cr3 exiting)

Returns

VOID

{
    //
    // Indicate that the future #PFs should or should not be checked with user debugger
    //
    g_CheckPageFaultsAndMov2Cr3VmexitsWithUserDebugger = FALSE;
 
    BroadcastDisableMovToCr3ExitingOnAllProcessors();
}

ConfigureEnableEferSyscallEventsOnAllProcessors()

VOID ConfigureEnableEferSyscallEventsOnAllProcessors

(

)

routines for enabling syscall hooks on all cores

Returns

VOID

{
    BroadcastEnableEferSyscallEventsOnAllProcessors();
}

ConfigureEnableEferSyscallHookOnSingleCore()

VOID ConfigureEnableEferSyscallHookOnSingleCore

(

UINT32

TargetCoreId

)

routines for enabling EFER syscall hooks on a single core

Parameters

TargetCoreId

The target core's ID (to just run on this core)

Returns

VOID

{
    DpcRoutineRunTaskOnSingleCore(TargetCoreId, (PVOID)DpcRoutinePerformEnableEferSyscallHookOnSingleCore, NULL);
}

ConfigureEnableMovToControlRegisterExitingOnSingleCore()

VOID ConfigureEnableMovToControlRegisterExitingOnSingleCore	(	UINT32	TargetCoreId,
		DEBUGGER_EVENT_OPTIONS *	BroadcastingOption )

enable mov 2 control register on a single core

Parameters

TargetCoreId	The target core's ID (to just run on this core)
BroadcastingOption	The optional broadcasting fields

Returns

VOID

{
    DpcRoutineRunTaskOnSingleCore(TargetCoreId, (PVOID)DpcRoutinePerformEnableMovToControlRegisterExiting, &BroadcastingOption);
}

ConfigureEnableMovToCr3ExitingOnAllProcessors()

VOID ConfigureEnableMovToCr3ExitingOnAllProcessors

(

)

routines for debugging threads (enable mov-to-cr3 exiting)

Returns

VOID

{
    //
    // Indicate that the future #PFs should or should not be checked with user debugger
    //
    g_CheckPageFaultsAndMov2Cr3VmexitsWithUserDebugger = TRUE;
 
    BroadcastEnableMovToCr3ExitingOnAllProcessors();
}

ConfigureEnableMovToDebugRegistersExitingOnSingleCore()

VOID ConfigureEnableMovToDebugRegistersExitingOnSingleCore

(

UINT32

TargetCoreId

)

enable mov 2 debug register exiting on a single core

Parameters

TargetCoreId

The target core's ID (to just run on this core)

Returns

VOID

{
    DpcRoutineRunTaskOnSingleCore(TargetCoreId, (PVOID)DpcRoutinePerformEnableMovToDebugRegistersExiting, NULL);
}

ConfigureEnableRdpmcExitingOnSingleCore()

VOID ConfigureEnableRdpmcExitingOnSingleCore

(

UINT32

TargetCoreId

)

enable RDPMC exiting on a single core

Parameters

TargetCoreId

The target core's ID (to just run on this core)

Returns

VOID

{
    DpcRoutineRunTaskOnSingleCore(TargetCoreId, (PVOID)DpcRoutinePerformEnableRdpmcExitingOnSingleCore, NULL);
}

ConfigureEnableRdtscExitingOnSingleCore()

VOID ConfigureEnableRdtscExitingOnSingleCore

(

UINT32

TargetCoreId

)

enable RDTSC exiting on a single core

Parameters

TargetCoreId

The target core's ID (to just run on this core)

Returns

VOID

{
    DpcRoutineRunTaskOnSingleCore(TargetCoreId, (PVOID)DpcRoutinePerformEnableRdtscExitingOnSingleCore, NULL);
}

ConfigureEptHook()

BOOLEAN ConfigureEptHook	(	PVOID	TargetAddress,
		UINT32	ProcessId )

This function invokes a VMCALL to set the hook and broadcast the exiting for the breakpoints on exception bitmap.

this command uses hidden breakpoints (0xcc) to hook, THIS FUNCTION SHOULD BE CALLED WHEN THE VMLAUNCH ALREADY EXECUTED, it is because, broadcasting to enable exception bitmap for breakpoint is not clear here, if we want to broadcast to enable exception bitmaps on all cores when vmlaunch is not executed then that's ok but a user might call this function when we didn't configure the vmcs, it's a problem! we can solve it by giving a hint to vmcs configure function to make it ok for future configuration but that sounds stupid, I think it's better to not support this feature. Btw, debugger won't use this function in the above mentioned method, so we won't have any problem with this :)

Parameters

TargetAddress	The address of function or memory address to be hooked
ProcessId	The process id to translate based on that process's cr3

Returns

BOOLEAN Returns true if the hook was successful or false if there was an error

{
    return EptHook(TargetAddress, ProcessId);
}

ConfigureEptHook2()

BOOLEAN ConfigureEptHook2	(	UINT32	CoreId,
		PVOID	TargetAddress,
		PVOID	HookFunction,
		UINT32	ProcessId )

This function allocates a buffer in VMX Non Root Mode and then invokes a VMCALL to set the hook (inline)

this command uses hidden detours, this NOT be called from vmx-root mode

Parameters

CoreId	ID of the target core
TargetAddress	The address of function or memory address to be hooked
HookFunction	The function that will be called when hook triggered
ProcessId	The process id to translate based on that process's cr3

Returns

BOOLEAN Returns true if the hook was successful or false if there was an error

{
    return EptHookInlineHook(&g_GuestState[CoreId],
                             TargetAddress,
                             HookFunction,
                             ProcessId);
}

ConfigureEptHook2FromVmxRoot()

BOOLEAN ConfigureEptHook2FromVmxRoot	(	UINT32	CoreId,
		PVOID	TargetAddress,
		PVOID	HookFunction )

This function allocates a buffer in VMX Non Root Mode and then invokes a VMCALL to set the hook (inline EPT hook)

this command uses hidden detours, this should be called from vmx-root mode

Parameters

CoreId	ID of the target core
TargetAddress	The address of function or memory address to be hooked
HookFunction	The function that will be called when hook triggered

Returns

BOOLEAN Returns true if the hook was successful or false if there was an error

{
    return EptHookInlineHookFromVmxRoot(&g_GuestState[CoreId],
                                        TargetAddress,
                                        HookFunction);
}

ConfigureEptHookAllocateExtraHookingPagesForMemoryMonitorsAndExecEptHooks()

VOID ConfigureEptHookAllocateExtraHookingPagesForMemoryMonitorsAndExecEptHooks

(

UINT32

Count

)

Allocate (reserve) extra pages for storing details of page hooks for memory monitor and regular hidden breakpoit exec EPT hooks.

Parameters

Count

Returns

VOID

{
    EptHookAllocateExtraHookingPagesForMemoryMonitorsAndExecEptHooks(Count);
}

ConfigureEptHookFromVmxRoot()

BOOLEAN ConfigureEptHookFromVmxRoot

(

PVOID

TargetAddress

)

This function invokes a direct VMCALL to setup the hook.

the caller of this function should make sure to 1) broadcast to all cores to intercept breakpoints (#BPs) and after calling this function 2) the caller should broadcast to all cores to invalidate their EPTPs

Parameters

TargetAddress

The address of function or memory address to be hooked

Returns

BOOLEAN Returns true if the hook was successful or false if there was an error

{
    return EptHookFromVmxRoot(TargetAddress);
}

ConfigureEptHookModifyInstructionFetchState()

BOOLEAN ConfigureEptHookModifyInstructionFetchState	(	UINT32	CoreId,
		PVOID	PhysicalAddress,
		BOOLEAN	IsUnset )

Change PML EPT state for execution (execute) @detail should be called from VMX-root.

Parameters

CoreId	Current Core ID
PhysicalAddress	Target physical address
IsUnset	Is unsetting bit or setting bit

Returns

BOOLEAN

{
    return EptHookModifyInstructionFetchState(&g_GuestState[CoreId], PhysicalAddress, IsUnset);
}

ConfigureEptHookModifyPageReadState()

BOOLEAN ConfigureEptHookModifyPageReadState	(	UINT32	CoreId,
		PVOID	PhysicalAddress,
		BOOLEAN	IsUnset )

Change PML EPT state for read @detail should be called from VMX-root.

Parameters

VCpu	The virtual processor's state
PhysicalAddress	Target physical address
IsUnset	Is unsetting bit or setting bit

Returns

BOOLEAN

{
    return EptHookModifyPageReadState(&g_GuestState[CoreId], PhysicalAddress, IsUnset);
}

ConfigureEptHookModifyPageWriteState()

BOOLEAN ConfigureEptHookModifyPageWriteState	(	UINT32	CoreId,
		PVOID	PhysicalAddress,
		BOOLEAN	IsUnset )

Change PML EPT state for write @detail should be called from VMX-root.

Parameters

VCpu	The virtual processor's state
PhysicalAddress	Target physical address
IsUnset	Is unsetting bit or setting bit

Returns

BOOLEAN

{
    return EptHookModifyPageWriteState(&g_GuestState[CoreId], PhysicalAddress, IsUnset);
}

ConfigureEptHookMonitor()

BOOLEAN ConfigureEptHookMonitor	(	UINT32	CoreId,
		EPT_HOOKS_ADDRESS_DETAILS_FOR_MEMORY_MONITOR *	HookingDetails,
		UINT32	ProcessId )

This function allocates a buffer in VMX Non Root Mode and then invokes a VMCALL to set the hook.

this command uses hidden detours, this NOT be called from vmx-root mode

Parameters

CoreId	ID of the target core
HookingDetails	Monitor hooking detail
ProcessId	The process id to translate based on that process's cr3

Returns

BOOLEAN Returns true if the hook was successful or false if there was an error

{
    return EptHookMonitorHook(&g_GuestState[CoreId],
                              HookingDetails,
                              ProcessId);
}

ConfigureEptHookMonitorFromVmxRoot()

BOOLEAN ConfigureEptHookMonitorFromVmxRoot	(	UINT32	CoreId,
		EPT_HOOKS_ADDRESS_DETAILS_FOR_MEMORY_MONITOR *	MemoryAddressDetails )

This function allocates a buffer in VMX Non Root Mode and then invokes a VMCALL to set the hook.

this command uses hidden detours, this should be called from vmx-root mode

Parameters

CoreId	ID of the target core
MemoryAddressDetails	Monitor hooking details

Returns

BOOLEAN Returns true if the hook was successful or false if there was an error

{
    return EptHookMonitorFromVmxRoot(&g_GuestState[CoreId], MemoryAddressDetails);
}

ConfigureEptHookReservePreallocatedPoolsForEptHooks()

VOID ConfigureEptHookReservePreallocatedPoolsForEptHooks

(

UINT32

Count

)

Allocate (reserve) pages for storing EPT hooks page hooks.

Parameters

Count

Returns

VOID

{
    EptHookReservePreallocatedPoolsForEptHooks(Count);
}

ConfigureEptHookUnHookAllByHookingTag()

BOOLEAN ConfigureEptHookUnHookAllByHookingTag

(

UINT64

HookingTag

)

Remove all hooks from the hooked pages list using Hooking Tag.

Should be called from vmx non-root

Parameters

HookingTag

The hooking tag to remove all hooks

Returns

BOOLEAN If unhook was successful it returns true or if it was not successful returns false

{
    return EptHookUnHookAllByHookingTag(HookingTag);
}

ConfigureEptHookUnHookSingleAddress()

BOOLEAN ConfigureEptHookUnHookSingleAddress	(	UINT64	VirtualAddress,
		UINT64	PhysAddress,
		UINT32	ProcessId )

Remove single hook from the hooked pages list and invalidate TLB.

Should be called from vmx non-root

Parameters

VirtualAddress	Virtual address to unhook
PhysAddress	Physical address to unhook (optional)
ProcessId	The process id of target process

in unhooking for some hooks only physical address is availables

Returns

BOOLEAN If unhook was successful it returns true or if it was not successful returns false

{
    return EptHookUnHookSingleAddress(VirtualAddress, PhysAddress, ProcessId);
}

ConfigureEptHookUnHookSingleAddressFromVmxRoot()

BOOLEAN ConfigureEptHookUnHookSingleAddressFromVmxRoot	(	UINT64	VirtualAddress,
		UINT64	PhysAddress,
		EPT_SINGLE_HOOK_UNHOOKING_DETAILS *	TargetUnhookingDetails )

Remove single hook from the hooked pages list and invalidate TLB.

Should be called from vmx root-mode and it's the responsibility of caller to broadcast to all cores to remove the target physical address and invalidate EPT and modify exception bitmap (#BPs) if needed

Parameters

VirtualAddress	Virtual address to unhook
PhysAddress	Physical address to unhook (optional)
TargetUnhookingDetails	Target data for the caller to restore EPT entry and invalidate EPT caches. Only when applied in VMX-root mode directly

Returns

BOOLEAN If unhook was successful it returns true or if it was not successful returns false

{
    return EptHookUnHookSingleAddressFromVmxRoot(VirtualAddress,
                                                 PhysAddress,
                                                 TargetUnhookingDetails);
}

ConfigureEptHookUnHookSingleHookByHookingTagFromVmxRoot()

BOOLEAN ConfigureEptHookUnHookSingleHookByHookingTagFromVmxRoot	(	UINT64	HookingTag,
		EPT_SINGLE_HOOK_UNHOOKING_DETAILS *	TargetUnhookingDetails )

Remove single hook from the hooked pages by the given hooking tag.

Should be called from Vmx root-mode

Parameters

HookingTag

The hooking tag to unhook

Returns

BOOLEAN If unhook was successful it returns true or if it was not successful returns false

{
    return EptHookUnHookSingleHookByHookingTagFromVmxRoot(HookingTag, TargetUnhookingDetails);
}

ConfigureExecTrapAddProcessToWatchingList()

BOOLEAN ConfigureExecTrapAddProcessToWatchingList

(

UINT32

ProcessId

)

Add the target process to the watching list.

Parameters

ProcessId

Returns

BOOLEAN

{
    return ExecTrapAddProcessToWatchingList(ProcessId);
}

ConfigureExecTrapRemoveProcessFromWatchingList()

BOOLEAN ConfigureExecTrapRemoveProcessFromWatchingList

(

UINT32

ProcessId

)

Remove the target process from the watching list.

Parameters

ProcessId

Returns

BOOLEAN

{
    return ExecTrapRemoveProcessFromWatchingList(ProcessId);
}

ConfigureInitializeExecTrapOnAllProcessors()

BOOLEAN ConfigureInitializeExecTrapOnAllProcessors

(

)

routines for initializing user-mode, kernel-mode exec trap

Returns

BOOLEAN

{
    return ExecTrapInitialize();
}

ConfigureModeBasedExecHookUninitializeOnAllProcessors()

VOID ConfigureModeBasedExecHookUninitializeOnAllProcessors

(

)

routines for initializing Mode-based execution hooks

Returns

VOID

{
    ModeBasedExecHookUninitialize();
}

ConfigureSetEferSyscallOrSysretHookType()

VOID ConfigureSetEferSyscallOrSysretHookType

(

DEBUGGER_EVENT_SYSCALL_SYSRET_TYPE

SyscallHookType

)

routines for setting EFER syscall or sysret hooks type

Parameters

SyscallHookType

Type of hook

Returns

VOID

{
    if (SyscallHookType == DEBUGGER_EVENT_SYSCALL_SYSRET_HANDLE_ALL_UD)
    {
        g_IsUnsafeSyscallOrSysretHandling = TRUE;
    }
    else if (SyscallHookType == DEBUGGER_EVENT_SYSCALL_SYSRET_SAFE_ACCESS_MEMORY)
    {
        g_IsUnsafeSyscallOrSysretHandling = FALSE;
    }
}

ConfigureSetExceptionBitmapOnSingleCore()

VOID ConfigureSetExceptionBitmapOnSingleCore	(	UINT32	TargetCoreId,
		UINT32	BitMask )

set exception bitmap on a single core

Parameters

TargetCoreId	The target core's ID (to just run on this core)
BitMask	The bit mask of exception bitmap

Returns

VOID

{
    DpcRoutineRunTaskOnSingleCore(TargetCoreId, (PVOID)DpcRoutinePerformSetExceptionBitmapOnSingleCore, (PVOID)BitMask);
}

ConfigureSetExternalInterruptExitingOnSingleCore()

VOID ConfigureSetExternalInterruptExitingOnSingleCore

(

UINT32

TargetCoreId

)

set external interrupt exiting on a single core

Parameters

TargetCoreId

The target core's ID (to just run on this core)

Returns

VOID

{
    DpcRoutineRunTaskOnSingleCore(TargetCoreId, (PVOID)DpcRoutinePerformSetExternalInterruptExitingOnSingleCore, NULL);
}

ConfigureUninitializeExecTrapOnAllProcessors()

VOID ConfigureUninitializeExecTrapOnAllProcessors

(

)

routines for uninitializing user-mode, kernel-mode exec trap

Returns

VOID

{
    ExecTrapUninitialize();
}