ExtensionCommands.c File Reference

Implementation of Debugger Commands (Extensions) More...

#include "pch.h"

Functions
VOID	ExtensionCommandVa2paAndPa2va (PDEBUGGER_VA2PA_AND_PA2VA_COMMANDS AddressDetails, BOOLEAN OperateOnVmxRoot)
	routines for !va2pa and !pa2va commands
BOOLEAN	ExtensionCommandPte (PDEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS PteDetails, BOOLEAN IsOperatingInVmxRoot)
	routines for !pte command
VOID	ExtensionCommandChangeAllMsrBitmapReadAllCores (UINT64 BitmapMask)
	routines for !msrread command which
VOID	ExtensionCommandResetChangeAllMsrBitmapReadAllCores ()
	routines for disable (reset) !msrread command
VOID	ExtensionCommandChangeAllMsrBitmapWriteAllCores (UINT64 BitmapMask)
	routines for !msrwrite command which
VOID	ExtensionCommandResetAllMsrBitmapWriteAllCores ()
	routines for reset !msrwrite command which
VOID	ExtensionCommandEnableRdtscExitingAllCores ()
	routines for !tsc command
VOID	ExtensionCommandDisableRdtscExitingAllCores ()
	routines for disabling rdtsc/p exiting
VOID	ExtensionCommandDisableRdtscExitingForClearingEventsAllCores ()
	routines ONLY for disabling !tsc command
VOID	ExtensionCommandDisableMov2ControlRegsExitingForClearingEventsAllCores (PDEBUGGER_EVENT Event)
	routines ONLY for disabling !crwrite command
VOID	ExtensionCommandDisableMov2DebugRegsExitingForClearingEventsAllCores ()
	routines ONLY for disabling !dr command
VOID	ExtensionCommandEnableRdpmcExitingAllCores ()
	routines for !pmc
VOID	ExtensionCommandDisableRdpmcExitingAllCores ()
	routines for disabling !pmc
VOID	ExtensionCommandSetExceptionBitmapAllCores (UINT64 ExceptionIndex)
	routines for !exception command which
VOID	ExtensionCommandUnsetExceptionBitmapAllCores (UINT64 ExceptionIndex)
	routines for disabling exception bitmap
VOID	ExtensionCommandResetExceptionBitmapAllCores ()
	routines for reset !exception command
VOID	ExtensionCommandEnableMovControlRegisterExitingAllCores (PDEBUGGER_EVENT Event)
	routines for !crwrite
VOID	ExtensionCommandDisableMovToControlRegistersExitingAllCores (PDEBUGGER_EVENT Event)
	routines for disabling !crwrite
VOID	ExtensionCommandEnableMovDebugRegistersExitingAllCores ()
	routines for !dr
VOID	ExtensionCommandDisableMovDebugRegistersExitingAllCores ()
	routines for disabling !dr
VOID	ExtensionCommandSetExternalInterruptExitingAllCores ()
	routines for !interrupt command which
VOID	ExtensionCommandUnsetExternalInterruptExitingOnlyOnClearingInterruptEventsAllCores ()
	routines for ONLY terminate !interrupt command
VOID	ExtensionCommandIoBitmapChangeAllCores (UINT64 Port)
	routines for !ioin and !ioout command which
VOID	ExtensionCommandIoBitmapResetAllCores ()
	routines for reset !ioin and !ioout command

Detailed Description

Implementation of Debugger Commands (Extensions)

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Debugger Commands that start with "!"

Version

0.1

Date

2020-04-11

Copyright

This project is released under the GNU Public License v3.

Function Documentation

ExtensionCommandChangeAllMsrBitmapReadAllCores()

VOID ExtensionCommandChangeAllMsrBitmapReadAllCores

(

UINT64

BitmapMask

)

routines for !msrread command which

causes vm-exit on all msr reads

Parameters

BitmapMask

Bit mask of msr to put on msr bitmap

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    BroadcastChangeAllMsrBitmapReadAllCores(BitmapMask);
}

ExtensionCommandChangeAllMsrBitmapWriteAllCores()

VOID ExtensionCommandChangeAllMsrBitmapWriteAllCores

(

UINT64

BitmapMask

)

routines for !msrwrite command which

causes vm-exit on all msr writes

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    BroadcastChangeAllMsrBitmapWriteAllCores(BitmapMask);
}

ExtensionCommandDisableMov2ControlRegsExitingForClearingEventsAllCores()

VOID ExtensionCommandDisableMov2ControlRegsExitingForClearingEventsAllCores

(

PDEBUGGER_EVENT

Event

)

routines ONLY for disabling !crwrite command

Parameters

Event

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    BroadcastDisableMov2ControlRegsExitingForClearingEventsAllCores(&Event->Options);
}

ExtensionCommandDisableMov2DebugRegsExitingForClearingEventsAllCores()

VOID ExtensionCommandDisableMov2DebugRegsExitingForClearingEventsAllCores

(

)

routines ONLY for disabling !dr command

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    BroadcastDisableMov2DebugRegsExitingForClearingEventsAllCores();
}

ExtensionCommandDisableMovDebugRegistersExitingAllCores()

VOID ExtensionCommandDisableMovDebugRegistersExitingAllCores

(

)

routines for disabling !dr

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    BroadcastDisableMovDebugRegistersExitingAllCores();
}

ExtensionCommandDisableMovToControlRegistersExitingAllCores()

VOID ExtensionCommandDisableMovToControlRegistersExitingAllCores

(

PDEBUGGER_EVENT

Event

)

routines for disabling !crwrite

Parameters

Event

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    BroadcastDisableMovToControlRegistersExitingAllCores(&Event->Options);
}

ExtensionCommandDisableRdpmcExitingAllCores()

VOID ExtensionCommandDisableRdpmcExitingAllCores

(

)

routines for disabling !pmc

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    BroadcastDisableRdpmcExitingAllCores();
}

ExtensionCommandDisableRdtscExitingAllCores()

VOID ExtensionCommandDisableRdtscExitingAllCores

(

)

routines for disabling rdtsc/p exiting

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    BroadcastDisableRdtscExitingAllCores();
}

ExtensionCommandDisableRdtscExitingForClearingEventsAllCores()

VOID ExtensionCommandDisableRdtscExitingForClearingEventsAllCores

(

)

routines ONLY for disabling !tsc command

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    BroadcastDisableRdtscExitingForClearingEventsAllCores();
}

ExtensionCommandEnableMovControlRegisterExitingAllCores()

VOID ExtensionCommandEnableMovControlRegisterExitingAllCores

(

PDEBUGGER_EVENT

Event

)

routines for !crwrite

causes vm-exit on all accesses to debug registers

Parameters

Event

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    BroadcastEnableMovControlRegisterExitingAllCores(&Event->Options);
}

ExtensionCommandEnableMovDebugRegistersExitingAllCores()

VOID ExtensionCommandEnableMovDebugRegistersExitingAllCores

(

)

routines for !dr

causes vm-exit on all accesses to debug registers

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    BroadcastEnableMovDebugRegistersExitingAllCores();
}

ExtensionCommandEnableRdpmcExitingAllCores()

VOID ExtensionCommandEnableRdpmcExitingAllCores

(

)

routines for !pmc

causes vm-exit on all execution of rdpmc

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    BroadcastEnableRdpmcExitingAllCores();
}

ExtensionCommandEnableRdtscExitingAllCores()

VOID ExtensionCommandEnableRdtscExitingAllCores

(

)

routines for !tsc command

causes vm-exit on all execution of rdtsc/rdtscp

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    BroadcastEnableRdtscExitingAllCores();
}

ExtensionCommandIoBitmapChangeAllCores()

VOID ExtensionCommandIoBitmapChangeAllCores

(

UINT64

Port

)

routines for !ioin and !ioout command which

causes vm-exit on all i/o instructions or one port

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    BroadcastIoBitmapChangeAllCores(Port);
}

ExtensionCommandIoBitmapResetAllCores()

VOID ExtensionCommandIoBitmapResetAllCores

(

)

routines for reset !ioin and !ioout command

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    BroadcastIoBitmapResetAllCores();
}

ExtensionCommandPte()

BOOLEAN ExtensionCommandPte	(	PDEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS	PteDetails,
		BOOLEAN	IsOperatingInVmxRoot )

routines for !pte command

Parameters

PteDetails
IsOperatingInVmxRoot

Returns

BOOLEAN

{
    BOOLEAN  Result     = FALSE;
    CR3_TYPE RestoreCr3 = {0};
 
    //
    // Check for validations
    //
    if (IsOperatingInVmxRoot)
    {
        if (!VirtualAddressToPhysicalAddressOnTargetProcess((PVOID)PteDetails->VirtualAddress))
        {
            //
            // Address is not valid (doesn't have Physical Address)
            //
            PteDetails->KernelStatus = DEBUGGER_ERROR_INVALID_ADDRESS;
            return FALSE;
        }
 
        //
        // Switch on running process's cr3
        //
        RestoreCr3.Flags = SwitchToCurrentProcessMemoryLayout().Flags;
    }
    else
    {
        if (PteDetails->ProcessId != HANDLE_TO_UINT32(PsGetCurrentProcessId()))
        {
            //
            // It's on another process address space
            //
 
            //
            // Check if pid is valid
            //
            if (!CommonIsProcessExist(PteDetails->ProcessId))
            {
                //
                // Process id is invalid
                //
                PteDetails->KernelStatus = DEBUGGER_ERROR_INVALID_PROCESS_ID;
                return FALSE;
            }
 
            //
            // Switch to new process's memory layout
            //
            RestoreCr3.Flags = SwitchToProcessMemoryLayout(PteDetails->ProcessId).Flags;
        }
 
        //
        // Check if address is valid
        //
        if (!VirtualAddressToPhysicalAddress((PVOID)PteDetails->VirtualAddress))
        {
            //
            // Address is not valid (doesn't have Physical Address)
            //
            PteDetails->KernelStatus = DEBUGGER_ERROR_INVALID_ADDRESS;
            Result                   = FALSE;
            goto RestoreTheState;
        }
    }
 
    //
    // Read the PML4E
    //
    PPAGE_ENTRY Pml4e = MemoryMapperGetPteVa((PVOID)PteDetails->VirtualAddress, PagingLevelPageMapLevel4);
    if (Pml4e)
    {
        PteDetails->Pml4eVirtualAddress = (UINT64)Pml4e;
        PteDetails->Pml4eValue          = Pml4e->Flags;
    }
 
    //
    // Read the PDPTE
    //
    PPAGE_ENTRY Pdpte = MemoryMapperGetPteVa((PVOID)PteDetails->VirtualAddress, PagingLevelPageDirectoryPointerTable);
    if (Pdpte)
    {
        PteDetails->PdpteVirtualAddress = (UINT64)Pdpte;
        PteDetails->PdpteValue          = Pdpte->Flags;
    }
 
    //
    // Read the PDE
    //
    PPAGE_ENTRY Pde = MemoryMapperGetPteVa((PVOID)PteDetails->VirtualAddress, PagingLevelPageDirectory);
    if (Pde)
    {
        PteDetails->PdeVirtualAddress = (UINT64)Pde;
        PteDetails->PdeValue          = Pde->Flags;
    }
 
    //
    // Read the PTE
    //
    PPAGE_ENTRY Pte = MemoryMapperGetPteVa((PVOID)PteDetails->VirtualAddress, PagingLevelPageTable);
    if (Pte)
    {
        PteDetails->PteVirtualAddress = (UINT64)Pte;
        PteDetails->PteValue          = Pte->Flags;
    }
 
    //
    // Show that the details we retrieved successfully
    //
    PteDetails->KernelStatus = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
    Result                   = TRUE;
 
RestoreTheState:
 
    //
    // Check to restore the current cr3 if it's changed
    //
    if (RestoreCr3.Flags != (UINT64)NULL)
    {
        SwitchToPreviousProcess(RestoreCr3);
    }
 
    return Result;
}

ExtensionCommandResetAllMsrBitmapWriteAllCores()

VOID ExtensionCommandResetAllMsrBitmapWriteAllCores

(

)

routines for reset !msrwrite command which

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    BroadcastResetAllMsrBitmapWriteAllCores();
}

ExtensionCommandResetChangeAllMsrBitmapReadAllCores()

VOID ExtensionCommandResetChangeAllMsrBitmapReadAllCores

(

)

routines for disable (reset) !msrread command

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    BroadcastResetChangeAllMsrBitmapReadAllCores();
}

ExtensionCommandResetExceptionBitmapAllCores()

VOID ExtensionCommandResetExceptionBitmapAllCores

(

)

routines for reset !exception command

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    BroadcastResetExceptionBitmapAllCores();
}

ExtensionCommandSetExceptionBitmapAllCores()

VOID ExtensionCommandSetExceptionBitmapAllCores

(

UINT64

ExceptionIndex

)

routines for !exception command which

causes vm-exit when exception occurred

Parameters

ExceptionIndex

index of exception on IDT

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    BroadcastSetExceptionBitmapAllCores(ExceptionIndex);
}

ExtensionCommandSetExternalInterruptExitingAllCores()

VOID ExtensionCommandSetExternalInterruptExitingAllCores

(

)

routines for !interrupt command which

causes vm-exit when external interrupt occurs

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    BroadcastSetExternalInterruptExitingAllCores();
}

ExtensionCommandUnsetExceptionBitmapAllCores()

VOID ExtensionCommandUnsetExceptionBitmapAllCores

(

UINT64

ExceptionIndex

)

routines for disabling exception bitmap

removes vm-exit when exception occurred

Parameters

ExceptionIndex

index of exception on IDT

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    BroadcastUnsetExceptionBitmapAllCores(ExceptionIndex);
}

ExtensionCommandUnsetExternalInterruptExitingOnlyOnClearingInterruptEventsAllCores()

VOID ExtensionCommandUnsetExternalInterruptExitingOnlyOnClearingInterruptEventsAllCores

(

)

routines for ONLY terminate !interrupt command

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    BroadcastUnsetExternalInterruptExitingOnlyOnClearingInterruptEventsAllCores();
}

ExtensionCommandVa2paAndPa2va()

VOID ExtensionCommandVa2paAndPa2va	(	PDEBUGGER_VA2PA_AND_PA2VA_COMMANDS	AddressDetails,
		BOOLEAN	OperateOnVmxRoot )

routines for !va2pa and !pa2va commands

Parameters

AddressDetails
OperateOnVmxRoot

Returns

VOID

{
    if (OperateOnVmxRoot)
    {
        //
        // *** !va2pa and !pa2va in Debugger Mode
        //
        if (AddressDetails->IsVirtual2Physical)
        {
            AddressDetails->PhysicalAddress = VirtualAddressToPhysicalAddressOnTargetProcess((PVOID)AddressDetails->VirtualAddress);
 
            //
            // Check if address is valid or invalid
            //
            if (AddressDetails->PhysicalAddress == (UINT64)NULL)
            {
                //
                // Invalid address
                //
                AddressDetails->KernelStatus = DEBUGGER_ERROR_INVALID_ADDRESS;
            }
            else
            {
                //
                // Operation was successful
                //
                AddressDetails->KernelStatus = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
            }
        }
        else
        {
            AddressDetails->VirtualAddress =
                PhysicalAddressToVirtualAddressOnTargetProcess((PVOID)AddressDetails->PhysicalAddress);
 
            //
            // We don't know a way for checking physical address validity
            //
            AddressDetails->KernelStatus = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
        }
    }
    else
    {
        //
        // *** regular !va2pa and !pa2va in VMI Mode
        //
 
        if (AddressDetails->ProcessId == HANDLE_TO_UINT32(PsGetCurrentProcessId()))
        {
            //
            // It's on current process address space (we process the request
            // based on system process layout (pid = 4))
            //
            if (AddressDetails->IsVirtual2Physical)
            {
                AddressDetails->PhysicalAddress = VirtualAddressToPhysicalAddress((PVOID)AddressDetails->VirtualAddress);
 
                //
                // Check if address is valid or invalid
                //
                if (AddressDetails->PhysicalAddress == (UINT64)NULL)
                {
                    //
                    // Invalid address
                    //
                    AddressDetails->KernelStatus = DEBUGGER_ERROR_INVALID_ADDRESS;
                }
                else
                {
                    //
                    // Operation was successful
                    //
                    AddressDetails->KernelStatus = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
                }
            }
            else
            {
                AddressDetails->VirtualAddress = PhysicalAddressToVirtualAddress(AddressDetails->PhysicalAddress);
 
                //
                // We don't know a way for checking physical address validity
                //
                AddressDetails->KernelStatus = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
            }
        }
        else
        {
            //
            // It's on another process address space
            //
 
            //
            // Check if pid is valid
            //
            if (!CommonIsProcessExist(AddressDetails->ProcessId))
            {
                //
                // Process id is invalid
                //
                AddressDetails->KernelStatus = DEBUGGER_ERROR_INVALID_PROCESS_ID;
                return;
            }
 
            if (AddressDetails->IsVirtual2Physical)
            {
                AddressDetails->PhysicalAddress = VirtualAddressToPhysicalAddressByProcessId((PVOID)AddressDetails->VirtualAddress, AddressDetails->ProcessId);
 
                //
                // Check if address is valid or invalid
                //
                if (AddressDetails->PhysicalAddress == (UINT64)NULL)
                {
                    //
                    // Invalid address
                    //
                    AddressDetails->KernelStatus = DEBUGGER_ERROR_INVALID_ADDRESS;
                }
                else
                {
                    //
                    // Operation was successful
                    //
                    AddressDetails->KernelStatus = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
                }
            }
            else
            {
                AddressDetails->VirtualAddress =
                    PhysicalAddressToVirtualAddressByProcessId((PVOID)AddressDetails->PhysicalAddress,
                                                               AddressDetails->ProcessId);
 
                //
                // We don't know a way for checking physical address validity
                //
                AddressDetails->KernelStatus = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
            }
        }
    }
}