ExtensionCommands.c File Reference

Implementation of Debugger Commands (Extensions). More...

#include "pch.h"

Functions
UINT32	ExtensionCommandPerformActionsForApicRequests (PDEBUGGER_APIC_REQUEST ApicRequest)
	Perform actions regarding APIC.
VOID	ExtensionCommandPerformQueryIdtEntriesRequest (PINTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS IdtQueryRequest, BOOLEAN ReadFromVmxRoot)
	Perform query for IDT entries.
VOID	ExtensionCommandVa2paAndPa2va (PDEBUGGER_VA2PA_AND_PA2VA_COMMANDS AddressDetails, BOOLEAN OperateOnVmxRoot)
	routines for !va2pa and !pa2va commands
BOOLEAN	ExtensionCommandPte (PDEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS PteDetails, BOOLEAN IsOperatingInVmxRoot)
	routines for !pte command
VOID	ExtensionCommandChangeAllMsrBitmapReadAllCores (UINT64 BitmapMask)
	routines for !msrread command which
VOID	ExtensionCommandResetChangeAllMsrBitmapReadAllCores ()
	routines for disable (reset) !msrread command
VOID	ExtensionCommandChangeAllMsrBitmapWriteAllCores (UINT64 BitmapMask)
	routines for !msrwrite command which
VOID	ExtensionCommandResetAllMsrBitmapWriteAllCores ()
	routines for reset !msrwrite command which
VOID	ExtensionCommandEnableRdtscExitingAllCores ()
	routines for !tsc command
VOID	ExtensionCommandDisableRdtscExitingAllCores ()
	routines for disabling rdtsc/p exiting
VOID	ExtensionCommandDisableRdtscExitingForClearingEventsAllCores ()
	routines ONLY for disabling !tsc command
VOID	ExtensionCommandDisableMov2ControlRegsExitingForClearingEventsAllCores (PDEBUGGER_EVENT Event)
	routines ONLY for disabling !crwrite command
VOID	ExtensionCommandDisableMov2DebugRegsExitingForClearingEventsAllCores ()
	routines ONLY for disabling !dr command
VOID	ExtensionCommandEnableRdpmcExitingAllCores ()
	routines for !pmc
VOID	ExtensionCommandDisableRdpmcExitingAllCores ()
	routines for disabling !pmc
VOID	ExtensionCommandSetExceptionBitmapAllCores (UINT64 ExceptionIndex)
	routines for !exception command which
VOID	ExtensionCommandUnsetExceptionBitmapAllCores (UINT64 ExceptionIndex)
	routines for disabling exception bitmap
VOID	ExtensionCommandResetExceptionBitmapAllCores ()
	routines for reset !exception command
VOID	ExtensionCommandEnableMovControlRegisterExitingAllCores (PDEBUGGER_EVENT Event)
	routines for !crwrite
VOID	ExtensionCommandDisableMovToControlRegistersExitingAllCores (PDEBUGGER_EVENT Event)
	routines for disabling !crwrite
VOID	ExtensionCommandEnableMovDebugRegistersExitingAllCores ()
	routines for !dr
VOID	ExtensionCommandDisableMovDebugRegistersExitingAllCores ()
	routines for disabling !dr
VOID	ExtensionCommandSetExternalInterruptExitingAllCores ()
	routines for !interrupt command which
VOID	ExtensionCommandUnsetExternalInterruptExitingOnlyOnClearingInterruptEventsAllCores ()
	routines for ONLY terminate !interrupt command
VOID	ExtensionCommandIoBitmapChangeAllCores (UINT64 Port)
	routines for !ioin and !ioout command which
VOID	ExtensionCommandIoBitmapResetAllCores ()
	routines for reset !ioin and !ioout command
VOID	ExtensionCommandPcitree (PDEBUGGEE_PCITREE_REQUEST_RESPONSE_PACKET PcitreePacket, BOOLEAN OperateOnVmxRoot)
	routines for PCIe tree
VOID	ExtensionCommandPcidevinfo (PDEBUGGEE_PCIDEVINFO_REQUEST_RESPONSE_PACKET PcidevinfoPacket, BOOLEAN OperateOnVmxRoot)
	Request PCI device info.

Detailed Description

Implementation of Debugger Commands (Extensions).

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Debugger Commands that start with "!"

Version

0.1

Date

2020-04-11

Copyright

This project is released under the GNU Public License v3.

Function Documentation

ExtensionCommandChangeAllMsrBitmapReadAllCores()

VOID ExtensionCommandChangeAllMsrBitmapReadAllCores

(

UINT64

BitmapMask

)

routines for !msrread command which

causes vm-exit on all msr reads

Parameters

BitmapMask

Bit mask of msr to put on msr bitmap

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    BroadcastChangeAllMsrBitmapReadAllCores(BitmapMask);
}

ExtensionCommandChangeAllMsrBitmapWriteAllCores()

VOID ExtensionCommandChangeAllMsrBitmapWriteAllCores

(

UINT64

BitmapMask

)

routines for !msrwrite command which

causes vm-exit on all msr writes

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    BroadcastChangeAllMsrBitmapWriteAllCores(BitmapMask);
}

ExtensionCommandDisableMov2ControlRegsExitingForClearingEventsAllCores()

VOID ExtensionCommandDisableMov2ControlRegsExitingForClearingEventsAllCores

(

PDEBUGGER_EVENT

Event

)

routines ONLY for disabling !crwrite command

Parameters

Event

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    BroadcastDisableMov2ControlRegsExitingForClearingEventsAllCores(&Event->Options);
}

ExtensionCommandDisableMov2DebugRegsExitingForClearingEventsAllCores()

VOID ExtensionCommandDisableMov2DebugRegsExitingForClearingEventsAllCores

(

)

routines ONLY for disabling !dr command

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    BroadcastDisableMov2DebugRegsExitingForClearingEventsAllCores();
}

ExtensionCommandDisableMovDebugRegistersExitingAllCores()

VOID ExtensionCommandDisableMovDebugRegistersExitingAllCores

(

)

routines for disabling !dr

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    BroadcastDisableMovDebugRegistersExitingAllCores();
}

ExtensionCommandDisableMovToControlRegistersExitingAllCores()

VOID ExtensionCommandDisableMovToControlRegistersExitingAllCores

(

PDEBUGGER_EVENT

Event

)

routines for disabling !crwrite

Parameters

Event

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    BroadcastDisableMovToControlRegistersExitingAllCores(&Event->Options);
}

ExtensionCommandDisableRdpmcExitingAllCores()

VOID ExtensionCommandDisableRdpmcExitingAllCores

(

)

routines for disabling !pmc

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    BroadcastDisableRdpmcExitingAllCores();
}

ExtensionCommandDisableRdtscExitingAllCores()

VOID ExtensionCommandDisableRdtscExitingAllCores

(

)

routines for disabling rdtsc/p exiting

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    BroadcastDisableRdtscExitingAllCores();
}

ExtensionCommandDisableRdtscExitingForClearingEventsAllCores()

VOID ExtensionCommandDisableRdtscExitingForClearingEventsAllCores

(

)

routines ONLY for disabling !tsc command

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    BroadcastDisableRdtscExitingForClearingEventsAllCores();
}

ExtensionCommandEnableMovControlRegisterExitingAllCores()

VOID ExtensionCommandEnableMovControlRegisterExitingAllCores

(

PDEBUGGER_EVENT

Event

)

routines for !crwrite

causes vm-exit on all accesses to debug registers

Parameters

Event

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    BroadcastEnableMovControlRegisterExitingAllCores(&Event->Options);
}

ExtensionCommandEnableMovDebugRegistersExitingAllCores()

VOID ExtensionCommandEnableMovDebugRegistersExitingAllCores

(

)

routines for !dr

causes vm-exit on all accesses to debug registers

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    BroadcastEnableMovDebugRegistersExitingAllCores();
}

ExtensionCommandEnableRdpmcExitingAllCores()

VOID ExtensionCommandEnableRdpmcExitingAllCores

(

)

routines for !pmc

causes vm-exit on all execution of rdpmc

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    BroadcastEnableRdpmcExitingAllCores();
}

ExtensionCommandEnableRdtscExitingAllCores()

VOID ExtensionCommandEnableRdtscExitingAllCores

(

)

routines for !tsc command

causes vm-exit on all execution of rdtsc/rdtscp

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    BroadcastEnableRdtscExitingAllCores();
}

ExtensionCommandIoBitmapChangeAllCores()

VOID ExtensionCommandIoBitmapChangeAllCores

(

UINT64

Port

)

routines for !ioin and !ioout command which

causes vm-exit on all i/o instructions or one port

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    BroadcastIoBitmapChangeAllCores(Port);
}

ExtensionCommandIoBitmapResetAllCores()

VOID ExtensionCommandIoBitmapResetAllCores

(

)

routines for reset !ioin and !ioout command

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    BroadcastIoBitmapResetAllCores();
}

ExtensionCommandPcidevinfo()

VOID ExtensionCommandPcidevinfo	(	PDEBUGGEE_PCIDEVINFO_REQUEST_RESPONSE_PACKET	PcidevinfoPacket,
		BOOLEAN	OperateOnVmxRoot )

Request PCI device info.

Parameters

PcidevinfoPacket
OperateOnVmxRoot

Returns

VOID

{
    DWORD DeviceIdVendorId = 0xFFFFFFFF;
 
    //
    // We currently don't use OperateOnVmxRoot, but we might in the future
    //
    UNREFERENCED_PARAMETER(OperateOnVmxRoot);
 
    DeviceIdVendorId = (DWORD)PciReadCam(PcidevinfoPacket->DeviceInfo.Bus, PcidevinfoPacket->DeviceInfo.Device, PcidevinfoPacket->DeviceInfo.Function, 0, 4);
    if (DeviceIdVendorId != 0xFFFFFFFF)
    {
        DWORD * cs = (DWORD *)&PcidevinfoPacket->DeviceInfo.ConfigSpace; // Overflows into .ConfigSpaceAdditional - no padding due to pack(0)
        for (UINT16 i = 0; i < CAM_CONFIG_SPACE_LENGTH; i += 4)
        {
            *cs = (DWORD)PciReadCam(PcidevinfoPacket->DeviceInfo.Bus, PcidevinfoPacket->DeviceInfo.Device, PcidevinfoPacket->DeviceInfo.Function, (BYTE)i, 4);
            cs++;
        }
 
        //
        // For endpoints, determine MMIO BAR addressable range and size (if any).
        // Do not determine BAR size if user has requested raw dump.
        //
        if ((PcidevinfoPacket->DeviceInfo.ConfigSpace.CommonHeader.HeaderType & 0x01) << 7 == 0 // Endpoint
            && !PcidevinfoPacket->PrintRaw)
        {
            for (UINT8 i = 0; i < 5; i++)
            {
                if ((PcidevinfoPacket->DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpaceEp.Bar[i] & 0x1) == 0) // Memory I/O
                {
                    if (((PcidevinfoPacket->DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpaceEp.Bar[i] & 0x6) >> 1) == 2) // 64-bit BAR
                    {
                        UINT64 BarMsb = PcidevinfoPacket->DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpaceEp.Bar[i + 1];
                        UINT64 BarLsb = PcidevinfoPacket->DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpaceEp.Bar[i];
                        UINT64 Bar64  = ((BarMsb & 0xFFFFFFFF) << 32) + (BarLsb & 0xFFFFFFF0);
 
                        PcidevinfoPacket->DeviceInfo.MmioBarInfo[i].Is64Bit = TRUE;
                        if (Bar64 == 0)
                        {
                            PcidevinfoPacket->DeviceInfo.MmioBarInfo[i].IsEnabled = FALSE;
                            continue;
                        }
 
                        PcidevinfoPacket->DeviceInfo.MmioBarInfo[i].Is64Bit   = TRUE;
                        PcidevinfoPacket->DeviceInfo.MmioBarInfo[i].IsEnabled = TRUE;
 
                        i++;
                    }
                    else // 32-bit BAR
                    {
                        UINT32 Bar32 = (PcidevinfoPacket->DeviceInfo.ConfigSpace.DeviceHeader.ConfigSpaceEp.Bar[i] & 0xFFFFFFF0);
 
                        PcidevinfoPacket->DeviceInfo.MmioBarInfo[i].Is64Bit = FALSE;
                        if (Bar32 == 0)
                        {
                            PcidevinfoPacket->DeviceInfo.MmioBarInfo[i].IsEnabled = FALSE;
                            continue;
                        }
 
                        PcidevinfoPacket->DeviceInfo.MmioBarInfo[i].Is64Bit   = FALSE;
                        PcidevinfoPacket->DeviceInfo.MmioBarInfo[i].IsEnabled = TRUE;
                    }
                }
            }
        }
 
        PcidevinfoPacket->KernelStatus = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
    }
    else
    {
        PcidevinfoPacket->DeviceInfo.ConfigSpace.CommonHeader.DeviceId = 0xFFFF;
        PcidevinfoPacket->DeviceInfo.ConfigSpace.CommonHeader.VendorId = 0xFFFF;
        PcidevinfoPacket->KernelStatus                                 = DEBUGGER_ERROR_INVALID_ADDRESS;
    }
}

ExtensionCommandPcitree()

VOID ExtensionCommandPcitree	(	PDEBUGGEE_PCITREE_REQUEST_RESPONSE_PACKET	PcitreePacket,
		BOOLEAN	OperateOnVmxRoot )

routines for PCIe tree

Parameters

PcitreePacket
OperateOnVmxRoot

Returns

VOID

{
    DWORD DeviceIdVendorId = 0xFFFFFFFF;
    DWORD ClassCode        = 0xFFFFFFFF;
    UINT8 DevNum           = 0;
 
    //
    // We currently don't use OperateOnVmxRoot, but we might in the future
    //
    UNREFERENCED_PARAMETER(OperateOnVmxRoot);
 
    for (UINT8 b = 0; b < BUS_MAX_NUM; b++)
    {
        for (UINT8 d = 0; d < DEVICE_MAX_NUM; d++)
        {
            for (UINT8 f = 0; f < FUNCTION_MAX_NUM; f++)
            {
                DeviceIdVendorId = (DWORD)PciReadCam(b, d, f, 0, sizeof(DWORD));
 
                if (DeviceIdVendorId != 0xFFFFFFFF)
                {
                    PcitreePacket->DeviceInfoList[DevNum].Bus                  = b;
                    PcitreePacket->DeviceInfoList[DevNum].Device               = d;
                    PcitreePacket->DeviceInfoList[DevNum].Function             = f;
                    PcitreePacket->DeviceInfoList[DevNum].ConfigSpace.VendorId = (UINT16)(DeviceIdVendorId & 0xFFFF);
                    PcitreePacket->DeviceInfoList[DevNum].ConfigSpace.DeviceId = (UINT16)(DeviceIdVendorId >> 16);
 
                    ClassCode                                                      = (DWORD)PciReadCam(b, d, f, 0, sizeof(DWORD));
                    PcitreePacket->DeviceInfoList[DevNum].ConfigSpace.ClassCode[0] = (UINT8)((ClassCode >> 24) & 0xFF);
                    PcitreePacket->DeviceInfoList[DevNum].ConfigSpace.ClassCode[1] = (UINT8)((ClassCode >> 16) & 0xFF);
                    PcitreePacket->DeviceInfoList[DevNum].ConfigSpace.ClassCode[2] = (UINT8)((ClassCode >> 8) & 0xFF);
 
                    DevNum++;
                    if (DevNum == DEV_MAX_NUM)
                    {
                        LogError("Reached maximum number of devices (%u) that can be stored in debuggee response packet.\n", DEV_MAX_NUM);
                        break;
                    }
                }
            }
        }
    }
    PcitreePacket->DeviceInfoListNum = DevNum;
 
    if (PcitreePacket->DeviceInfoListNum)
    {
        PcitreePacket->KernelStatus = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
    }
    else
    {
        PcitreePacket->KernelStatus = DEBUGGER_ERROR_INVALID_ADDRESS;
    }
}

ExtensionCommandPerformActionsForApicRequests()

UINT32 ExtensionCommandPerformActionsForApicRequests

(

PDEBUGGER_APIC_REQUEST

ApicRequest

)

Perform actions regarding APIC.

Parameters

ApicRequest

Returns

UINT32 Size to send to the debuggee

{
    BOOLEAN                IsUsingX2APIC       = FALSE;
    PLAPIC_PAGE            BufferToStoreLApic  = (LAPIC_PAGE *)(((CHAR *)ApicRequest) + sizeof(DEBUGGER_APIC_REQUEST));
    PIO_APIC_ENTRY_PACKETS BufferToStoreIoApic = (IO_APIC_ENTRY_PACKETS *)(((CHAR *)ApicRequest) + sizeof(DEBUGGER_APIC_REQUEST));
 
    if (ApicRequest->ApicType == DEBUGGER_APIC_REQUEST_TYPE_READ_LOCAL_APIC)
    {
        if (VmFuncApicStoreLocalApicFields(BufferToStoreLApic, &IsUsingX2APIC))
        {
            //
            // The status was okay
            //
            ApicRequest->KernelStatus  = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
            ApicRequest->IsUsingX2APIC = IsUsingX2APIC;
 
            return sizeof(DEBUGGER_APIC_REQUEST) + sizeof(LAPIC_PAGE);
        }
        else
        {
            //
            // There was an error performing the action
            //
            ApicRequest->KernelStatus = DEBUGGER_ERROR_APIC_ACTIONS_ERROR;
 
            return sizeof(DEBUGGER_APIC_REQUEST);
        }
    }
    else if (ApicRequest->ApicType == DEBUGGER_APIC_REQUEST_TYPE_READ_IO_APIC)
    {
        if (VmFuncApicStoreIoApicFields(BufferToStoreIoApic))
        {
            //
            // The status was okay
            //
            ApicRequest->KernelStatus = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
 
            return sizeof(DEBUGGER_APIC_REQUEST) + sizeof(IO_APIC_ENTRY_PACKETS);
        }
        else
        {
            //
            // There was an error performing the action
            //
            ApicRequest->KernelStatus = DEBUGGER_ERROR_APIC_ACTIONS_ERROR;
 
            return sizeof(DEBUGGER_APIC_REQUEST);
        }
    }
    else
    {
        //
        // Invalid request
        //
        ApicRequest->KernelStatus = DEBUGGER_ERROR_APIC_ACTIONS_ERROR;
 
        return sizeof(DEBUGGER_APIC_REQUEST);
    }
}

ExtensionCommandPerformQueryIdtEntriesRequest()

VOID ExtensionCommandPerformQueryIdtEntriesRequest	(	PINTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS	IdtQueryRequest,
		BOOLEAN	ReadFromVmxRoot )

Perform query for IDT entries.

Parameters

IdtQueryRequest
ReadFromVmxRoot

Returns

VOID

{
    //
    // Perform the query
    //
    VmFuncIdtQueryEntries(IdtQueryRequest, ReadFromVmxRoot);
 
    //
    // Operation was successful
    //
    IdtQueryRequest->KernelStatus = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
}

ExtensionCommandPte()

BOOLEAN ExtensionCommandPte	(	PDEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS	PteDetails,
		BOOLEAN	IsOperatingInVmxRoot )

routines for !pte command

Parameters

PteDetails
IsOperatingInVmxRoot

Returns

BOOLEAN

{
    BOOLEAN  Result     = FALSE;
    CR3_TYPE RestoreCr3 = {0};
 
    //
    // Check for validations
    //
    if (IsOperatingInVmxRoot)
    {
        if (!VirtualAddressToPhysicalAddressOnTargetProcess((PVOID)PteDetails->VirtualAddress))
        {
            //
            // Address is not valid (doesn't have Physical Address)
            //
            PteDetails->KernelStatus = DEBUGGER_ERROR_INVALID_ADDRESS;
            return FALSE;
        }
 
        //
        // Switch on running process's cr3
        //
        RestoreCr3.Flags = SwitchToCurrentProcessMemoryLayout().Flags;
    }
    else
    {
        if (PteDetails->ProcessId != HANDLE_TO_UINT32(PsGetCurrentProcessId()))
        {
            //
            // It's on another process address space
            //
 
            //
            // Check if pid is valid
            //
            if (!CommonIsProcessExist(PteDetails->ProcessId))
            {
                //
                // Process id is invalid
                //
                PteDetails->KernelStatus = DEBUGGER_ERROR_INVALID_PROCESS_ID;
                return FALSE;
            }
 
            //
            // Switch to new process's memory layout
            //
            RestoreCr3.Flags = SwitchToProcessMemoryLayout(PteDetails->ProcessId).Flags;
        }
 
        //
        // Check if address is valid
        //
        if (!VirtualAddressToPhysicalAddress((PVOID)PteDetails->VirtualAddress))
        {
            //
            // Address is not valid (doesn't have Physical Address)
            //
            PteDetails->KernelStatus = DEBUGGER_ERROR_INVALID_ADDRESS;
            Result                   = FALSE;
            goto RestoreTheState;
        }
    }
 
    //
    // Read the PML4E
    //
    PPAGE_ENTRY Pml4e = MemoryMapperGetPteVa((PVOID)PteDetails->VirtualAddress, PagingLevelPageMapLevel4);
    if (Pml4e)
    {
        PteDetails->Pml4eVirtualAddress = (UINT64)Pml4e;
        PteDetails->Pml4eValue          = Pml4e->Flags;
    }
 
    //
    // Read the PDPTE
    //
    PPAGE_ENTRY Pdpte = MemoryMapperGetPteVa((PVOID)PteDetails->VirtualAddress, PagingLevelPageDirectoryPointerTable);
    if (Pdpte)
    {
        PteDetails->PdpteVirtualAddress = (UINT64)Pdpte;
        PteDetails->PdpteValue          = Pdpte->Flags;
    }
 
    //
    // Read the PDE
    //
    PPAGE_ENTRY Pde = MemoryMapperGetPteVa((PVOID)PteDetails->VirtualAddress, PagingLevelPageDirectory);
    if (Pde)
    {
        PteDetails->PdeVirtualAddress = (UINT64)Pde;
        PteDetails->PdeValue          = Pde->Flags;
    }
 
    //
    // Read the PTE
    //
    PPAGE_ENTRY Pte = MemoryMapperGetPteVa((PVOID)PteDetails->VirtualAddress, PagingLevelPageTable);
    if (Pte)
    {
        PteDetails->PteVirtualAddress = (UINT64)Pte;
        PteDetails->PteValue          = Pte->Flags;
    }
 
    //
    // Show that the details we retrieved successfully
    //
    PteDetails->KernelStatus = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
    Result                   = TRUE;
 
RestoreTheState:
 
    //
    // Check to restore the current cr3 if it's changed
    //
    if (RestoreCr3.Flags != (UINT64)NULL)
    {
        SwitchToPreviousProcess(RestoreCr3);
    }
 
    return Result;
}

ExtensionCommandResetAllMsrBitmapWriteAllCores()

VOID ExtensionCommandResetAllMsrBitmapWriteAllCores

(

)

routines for reset !msrwrite command which

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    BroadcastResetAllMsrBitmapWriteAllCores();
}

ExtensionCommandResetChangeAllMsrBitmapReadAllCores()

VOID ExtensionCommandResetChangeAllMsrBitmapReadAllCores

(

)

routines for disable (reset) !msrread command

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    BroadcastResetChangeAllMsrBitmapReadAllCores();
}

ExtensionCommandResetExceptionBitmapAllCores()

VOID ExtensionCommandResetExceptionBitmapAllCores

(

)

routines for reset !exception command

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    BroadcastResetExceptionBitmapAllCores();
}

ExtensionCommandSetExceptionBitmapAllCores()

VOID ExtensionCommandSetExceptionBitmapAllCores

(

UINT64

ExceptionIndex

)

routines for !exception command which

causes vm-exit when exception occurred

Parameters

ExceptionIndex

index of exception on IDT

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    BroadcastSetExceptionBitmapAllCores(ExceptionIndex);
}

ExtensionCommandSetExternalInterruptExitingAllCores()

VOID ExtensionCommandSetExternalInterruptExitingAllCores

(

)

routines for !interrupt command which

causes vm-exit when external interrupt occurs

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    BroadcastSetExternalInterruptExitingAllCores();
}

ExtensionCommandUnsetExceptionBitmapAllCores()

VOID ExtensionCommandUnsetExceptionBitmapAllCores

(

UINT64

ExceptionIndex

)

routines for disabling exception bitmap

removes vm-exit when exception occurred

Parameters

ExceptionIndex

index of exception on IDT

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    BroadcastUnsetExceptionBitmapAllCores(ExceptionIndex);
}

ExtensionCommandUnsetExternalInterruptExitingOnlyOnClearingInterruptEventsAllCores()

VOID ExtensionCommandUnsetExternalInterruptExitingOnlyOnClearingInterruptEventsAllCores

(

)

routines for ONLY terminate !interrupt command

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    BroadcastUnsetExternalInterruptExitingOnlyOnClearingInterruptEventsAllCores();
}

ExtensionCommandVa2paAndPa2va()

VOID ExtensionCommandVa2paAndPa2va	(	PDEBUGGER_VA2PA_AND_PA2VA_COMMANDS	AddressDetails,
		BOOLEAN	OperateOnVmxRoot )

routines for !va2pa and !pa2va commands

Parameters

AddressDetails
OperateOnVmxRoot

Returns

VOID

{
    if (OperateOnVmxRoot)
    {
        //
        // *** !va2pa and !pa2va in Debugger Mode
        //
        if (AddressDetails->IsVirtual2Physical)
        {
            AddressDetails->PhysicalAddress = VirtualAddressToPhysicalAddressOnTargetProcess((PVOID)AddressDetails->VirtualAddress);
 
            //
            // Check if address is valid or invalid
            //
            if (AddressDetails->PhysicalAddress == (UINT64)NULL)
            {
                //
                // Invalid address
                //
                AddressDetails->KernelStatus = DEBUGGER_ERROR_INVALID_ADDRESS;
            }
            else
            {
                //
                // Operation was successful
                //
                AddressDetails->KernelStatus = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
            }
        }
        else
        {
            AddressDetails->VirtualAddress =
                PhysicalAddressToVirtualAddressOnTargetProcess((PVOID)AddressDetails->PhysicalAddress);
 
            //
            // We don't know a way for checking physical address validity
            //
            AddressDetails->KernelStatus = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
        }
    }
    else
    {
        //
        // *** regular !va2pa and !pa2va in VMI Mode
        //
 
        if (AddressDetails->ProcessId == HANDLE_TO_UINT32(PsGetCurrentProcessId()))
        {
            //
            // It's on current process address space (we process the request
            // based on system process layout (pid = 4))
            //
            if (AddressDetails->IsVirtual2Physical)
            {
                AddressDetails->PhysicalAddress = VirtualAddressToPhysicalAddress((PVOID)AddressDetails->VirtualAddress);
 
                //
                // Check if address is valid or invalid
                //
                if (AddressDetails->PhysicalAddress == (UINT64)NULL)
                {
                    //
                    // Invalid address
                    //
                    AddressDetails->KernelStatus = DEBUGGER_ERROR_INVALID_ADDRESS;
                }
                else
                {
                    //
                    // Operation was successful
                    //
                    AddressDetails->KernelStatus = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
                }
            }
            else
            {
                AddressDetails->VirtualAddress = PhysicalAddressToVirtualAddress(AddressDetails->PhysicalAddress);
 
                //
                // We don't know a way for checking physical address validity
                //
                AddressDetails->KernelStatus = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
            }
        }
        else
        {
            //
            // It's on another process address space
            //
 
            //
            // Check if pid is valid
            //
            if (!CommonIsProcessExist(AddressDetails->ProcessId))
            {
                //
                // Process id is invalid
                //
                AddressDetails->KernelStatus = DEBUGGER_ERROR_INVALID_PROCESS_ID;
                return;
            }
 
            if (AddressDetails->IsVirtual2Physical)
            {
                AddressDetails->PhysicalAddress = VirtualAddressToPhysicalAddressByProcessId((PVOID)AddressDetails->VirtualAddress, AddressDetails->ProcessId);
 
                //
                // Check if address is valid or invalid
                //
                if (AddressDetails->PhysicalAddress == (UINT64)NULL)
                {
                    //
                    // Invalid address
                    //
                    AddressDetails->KernelStatus = DEBUGGER_ERROR_INVALID_ADDRESS;
                }
                else
                {
                    //
                    // Operation was successful
                    //
                    AddressDetails->KernelStatus = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
                }
            }
            else
            {
                AddressDetails->VirtualAddress =
                    PhysicalAddressToVirtualAddressByProcessId((PVOID)AddressDetails->PhysicalAddress,
                                                               AddressDetails->ProcessId);
 
                //
                // We don't know a way for checking physical address validity
                //
                AddressDetails->KernelStatus = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
            }
        }
    }
}