DirectVmcall.c File Reference

Direct VMCALL routines. More...

#include "pch.h"

Functions
NTSTATUS	DirectVmcallTest (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for test direct VMCALL
NTSTATUS	DirectVmcallPerformVmcall (UINT32 CoreId, UINT64 VmcallNumber, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for performing a direct VMCALL
NTSTATUS	DirectVmcallChangeMsrBitmapRead (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for changing MSR Bitmap (Read)
NTSTATUS	DirectVmcallChangeMsrBitmapWrite (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for changing MSR Bitmap (Write)
NTSTATUS	DirectVmcallChangeIoBitmap (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for changing IO Bitmap
NTSTATUS	DirectVmcallEnableRdpmcExiting (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for enabling rdpmc exiting
NTSTATUS	DirectVmcallEnableRdtscpExiting (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for enabling rdtsc/rdtscp exiting
NTSTATUS	DirectVmcallEnableMov2DebugRegsExiting (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for enabling mov to debug registers exiting
NTSTATUS	DirectVmcallSetExceptionBitmap (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for setting exception bitmap
NTSTATUS	DirectVmcallEnableExternalInterruptExiting (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for enabling external interrupt exiting
NTSTATUS	DirectVmcallEnableMovToCrExiting (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for enabling mov to CR exiting
NTSTATUS	DirectVmcallEnableEferSyscall (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for enabling syscall hook using EFER SCE bit
NTSTATUS	DirectVmcallSetHiddenBreakpointHook (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for putting hidden breakpoints (using EPT)
NTSTATUS	DirectVmcallInvalidateEptAllContexts (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for invalidating EPT (All Contexts)
NTSTATUS	DirectVmcallInvalidateSingleContext (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for invalidating EPT (A Single Context)
NTSTATUS	DirectVmcallUnsetExceptionBitmap (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for unsetting exception bitmap on VMCS
NTSTATUS	DirectVmcallUnhookSinglePage (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for restoring a single EPT entry and invalidating EPT cache
NTSTATUS	DirectVmcallSetDisableExternalInterruptExitingOnlyOnClearingInterruptEvents (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for disabling external interrupt exiting only to clear !interrupt commands
NTSTATUS	DirectVmcallResetMsrBitmapRead (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for resetting MSR Bitmap Read
NTSTATUS	DirectVmcallResetMsrBitmapWrite (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for resetting MSR Bitmap Write
NTSTATUS	DirectVmcallResetExceptionBitmapOnlyOnClearingExceptionEvents (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for resetting exception bitmap on VMCS
NTSTATUS	DirectVmcallResetIoBitmap (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for resetting I/O Bitmaps (A & B)
NTSTATUS	DirectVmcallDisableRdtscExitingForClearingTscEvents (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for clearing rdtsc exiting bit ONLY in the case of disabling the events for !tsc command
NTSTATUS	DirectVmcallDisableRdpmcExiting (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for disabling rdpmc exiting in primary cpu-based controls
NTSTATUS	DirectVmcallDisableEferSyscallEvents (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for disabling syscall hook using EFER SCE bit
NTSTATUS	DirectVmcallDisableMov2DrExitingForClearingDrEvents (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for clearing mov 2 hw dr exiting bit ONLY in the case of disabling the events for !dr command
NTSTATUS	DirectVmcallDisableMov2CrExitingForClearingCrEvents (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for clearing mov 2 cr exiting bit ONLY in the case of disabling the events for !crwrite command

Detailed Description

Direct VMCALL routines.

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.7

Date

2023-10-19

Copyright

This project is released under the GNU Public License v3.

Function Documentation

DirectVmcallChangeIoBitmap()

NTSTATUS DirectVmcallChangeIoBitmap	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for changing IO Bitmap

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_CHANGE_IO_BITMAP, DirectVmcallOptions);
}

DirectVmcallChangeMsrBitmapRead()

NTSTATUS DirectVmcallChangeMsrBitmapRead	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for changing MSR Bitmap (Read)

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_CHANGE_MSR_BITMAP_READ, DirectVmcallOptions);
}

DirectVmcallChangeMsrBitmapWrite()

NTSTATUS DirectVmcallChangeMsrBitmapWrite	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for changing MSR Bitmap (Write)

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_CHANGE_MSR_BITMAP_WRITE, DirectVmcallOptions);
}

DirectVmcallDisableEferSyscallEvents()

NTSTATUS DirectVmcallDisableEferSyscallEvents	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for disabling syscall hook using EFER SCE bit

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_DISABLE_SYSCALL_HOOK_EFER, DirectVmcallOptions);
}

DirectVmcallDisableMov2CrExitingForClearingCrEvents()

NTSTATUS DirectVmcallDisableMov2CrExitingForClearingCrEvents	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for clearing mov 2 cr exiting bit ONLY in the case of disabling the events for !crwrite command

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_DISABLE_MOV_TO_CR_EXITING_ONLY_FOR_CR_EVENTS, DirectVmcallOptions);
}

DirectVmcallDisableMov2DrExitingForClearingDrEvents()

NTSTATUS DirectVmcallDisableMov2DrExitingForClearingDrEvents	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for clearing mov 2 hw dr exiting bit ONLY in the case of disabling the events for !dr command

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_DISABLE_MOV_TO_HW_DR_EXITING_ONLY_FOR_DR_EVENTS, DirectVmcallOptions);
}

DirectVmcallDisableRdpmcExiting()

NTSTATUS DirectVmcallDisableRdpmcExiting	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for disabling rdpmc exiting in primary cpu-based controls

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_UNSET_RDPMC_EXITING, DirectVmcallOptions);
}

DirectVmcallDisableRdtscExitingForClearingTscEvents()

NTSTATUS DirectVmcallDisableRdtscExitingForClearingTscEvents	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for clearing rdtsc exiting bit ONLY in the case of disabling the events for !tsc command

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_DISABLE_RDTSC_EXITING_ONLY_FOR_TSC_EVENTS, DirectVmcallOptions);
}

DirectVmcallEnableEferSyscall()

NTSTATUS DirectVmcallEnableEferSyscall	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for enabling syscall hook using EFER SCE bit

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_ENABLE_SYSCALL_HOOK_EFER, DirectVmcallOptions);
}

DirectVmcallEnableExternalInterruptExiting()

NTSTATUS DirectVmcallEnableExternalInterruptExiting	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for enabling external interrupt exiting

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_ENABLE_EXTERNAL_INTERRUPT_EXITING, DirectVmcallOptions);
}

DirectVmcallEnableMov2DebugRegsExiting()

NTSTATUS DirectVmcallEnableMov2DebugRegsExiting	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for enabling mov to debug registers exiting

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_ENABLE_MOV_TO_DEBUG_REGS_EXITING, DirectVmcallOptions);
}

DirectVmcallEnableMovToCrExiting()

NTSTATUS DirectVmcallEnableMovToCrExiting	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for enabling mov to CR exiting

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_ENABLE_MOV_TO_CONTROL_REGS_EXITING, DirectVmcallOptions);
}

DirectVmcallEnableRdpmcExiting()

NTSTATUS DirectVmcallEnableRdpmcExiting	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for enabling rdpmc exiting

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_SET_RDPMC_EXITING, DirectVmcallOptions);
}

DirectVmcallEnableRdtscpExiting()

NTSTATUS DirectVmcallEnableRdtscpExiting	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for enabling rdtsc/rdtscp exiting

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_SET_RDTSC_EXITING, DirectVmcallOptions);
}

DirectVmcallInvalidateEptAllContexts()

NTSTATUS DirectVmcallInvalidateEptAllContexts	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for invalidating EPT (All Contexts)

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_INVEPT_ALL_CONTEXTS, DirectVmcallOptions);
}

DirectVmcallInvalidateSingleContext()

NTSTATUS DirectVmcallInvalidateSingleContext	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for invalidating EPT (A Single Context)

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_INVEPT_SINGLE_CONTEXT, DirectVmcallOptions);
}

DirectVmcallPerformVmcall()

NTSTATUS DirectVmcallPerformVmcall	(	UINT32	CoreId,
		UINT64	VmcallNumber,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for performing a direct VMCALL

Should be called from VMX root-mode

Parameters

CoreId
VmcallNumber
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VmcallNumber, DirectVmcallOptions);
}

DirectVmcallResetExceptionBitmapOnlyOnClearingExceptionEvents()

NTSTATUS DirectVmcallResetExceptionBitmapOnlyOnClearingExceptionEvents	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for resetting exception bitmap on VMCS

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_RESET_EXCEPTION_BITMAP_ONLY_ON_CLEARING_EXCEPTION_EVENTS, DirectVmcallOptions);
}

DirectVmcallResetIoBitmap()

NTSTATUS DirectVmcallResetIoBitmap	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for resetting I/O Bitmaps (A & B)

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_RESET_IO_BITMAP, DirectVmcallOptions);
}

DirectVmcallResetMsrBitmapRead()

NTSTATUS DirectVmcallResetMsrBitmapRead	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for resetting MSR Bitmap Read

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_RESET_MSR_BITMAP_READ, DirectVmcallOptions);
}

DirectVmcallResetMsrBitmapWrite()

NTSTATUS DirectVmcallResetMsrBitmapWrite	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for resetting MSR Bitmap Write

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_RESET_MSR_BITMAP_WRITE, DirectVmcallOptions);
}

DirectVmcallSetDisableExternalInterruptExitingOnlyOnClearingInterruptEvents()

NTSTATUS DirectVmcallSetDisableExternalInterruptExitingOnlyOnClearingInterruptEvents	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for disabling external interrupt exiting only to clear !interrupt commands

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_DISABLE_EXTERNAL_INTERRUPT_EXITING_ONLY_TO_CLEAR_INTERRUPT_COMMANDS, DirectVmcallOptions);
}

DirectVmcallSetExceptionBitmap()

NTSTATUS DirectVmcallSetExceptionBitmap	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for setting exception bitmap

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_SET_EXCEPTION_BITMAP, DirectVmcallOptions);
}

DirectVmcallSetHiddenBreakpointHook()

NTSTATUS DirectVmcallSetHiddenBreakpointHook	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for putting hidden breakpoints (using EPT)

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_SET_HIDDEN_CC_BREAKPOINT, DirectVmcallOptions);
}

DirectVmcallTest()

NTSTATUS DirectVmcallTest	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for test direct VMCALL

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_TEST, DirectVmcallOptions);
}

DirectVmcallUnhookSinglePage()

NTSTATUS DirectVmcallUnhookSinglePage	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for restoring a single EPT entry and invalidating EPT cache

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_UNHOOK_SINGLE_PAGE, DirectVmcallOptions);
}

DirectVmcallUnsetExceptionBitmap()

NTSTATUS DirectVmcallUnsetExceptionBitmap	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for unsetting exception bitmap on VMCS

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_UNSET_EXCEPTION_BITMAP, DirectVmcallOptions);
}