Here we put global variables that are used more or less in all part of our hypervisor (not all of them) More...

Variables
COMPATIBILITY_CHECKS_STATUS	g_CompatibilityCheck
	Different attributes and compatibility checks of the current processor.

VMM_CALLBACKS	g_Callbacks
	List of callbacks.

VIRTUAL_MACHINE_STATE *	g_GuestState
	Save the state and variables related to virtualization on each to logical core.

MEMORY_MAPPER_ADDRESSES *	g_MemoryMapper
	Save the state of memory mapper.

EPT_STATE *	g_EptState
	Save the state and variables related to EPT.

TRANSPARENCY_MEASUREMENTS *	g_TransparentModeMeasurements
	holds the measurements from the user-mode and kernel-mode

LIST_ENTRY	g_EptHook2sDetourListHead
	List header of hidden hooks detour.

BOOLEAN	g_IsEptHook2sDetourListInitialized
	List header of hidden hooks detour.

BOOLEAN	g_TransparentMode
	Shows whether the debugger transparent mode is enabled (true) or not (false)

VOID *	g_ApicBase
	APIC Base.

BOOLEAN	g_NmiBroadcastingInitialized
	check for broadcasting NMI mechanism support and its initialization

PVOID	g_NmiHandlerForKeDeregisterNmiCallback
	NMI handler pointer for KeDeregisterNmiCallback.

BOOLEAN	g_IsUnsafeSyscallOrSysretHandling
	Shows whether the debuggee is waiting for an trap step or not.

UINT64 *	g_MsrBitmapInvalidMsrs
	Bitmap of MSRs that cause #GP.

BOOLEAN	g_CheckPageFaultsAndMov2Cr3VmexitsWithUserDebugger
	Whether the page-fault and cr3 vm-exits in vmx-root should check the #PFs or the PML4.Supervisor with user debugger or not.

BOOLEAN	g_ModeBasedExecutionControlState
	Enable interception of Cr3 for Mode-based Execution detection.

BOOLEAN	g_TriggerEventForVmcalls
	Showes whether the vmcall handler is allowed to trigger an event or not.

BOOLEAN	g_TriggerEventForCpuids
	Showes whether the cpuid handler is allowed to trigger an event or not.

BOOLEAN	g_ExecTrapInitialized
	Showes whether the execution trap handler is allowed to trigger an event or not.

BOOLEAN	g_ExecTrapUnInitializationStarted
	Showes whether the uninitialization of the exec trap is started or not.

USER_KERNEL_EXECUTION_TRAP_STATE	g_ExecTrapState
	State of the trap-flag.

BOOLEAN	g_IsInterceptingInstructions
	Test value for intercepting instructions.

BOOLEAN	g_WaitingForInterruptWindowToInjectPageFault
	Shows whether the the VMM is waiting to inject a page-fault or not.

UINT64	g_PageFaultInjectionAddressFrom
	The (from) address for page-fault injection.

UINT64	g_PageFaultInjectionAddressTo
	The (to) address for page-fault injection.

UINT32	g_PageFaultInjectionErrorCode
	The error code for page-fault injection.

Detailed Description

Here we put global variables that are used more or less in all part of our hypervisor (not all of them)

Author: Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Note : All the global variables are not here, just those that will be used in all project. Special use global variables are located in their corresponding headers

Version: 0.1

Date: 2020-04-11

Copyright: This project is released under the GNU Public License v3.

Variable Documentation

◆ g_ApicBase

VOID* g_ApicBase

APIC Base.

◆ g_Callbacks

VMM_CALLBACKS g_Callbacks

List of callbacks.

◆ g_CheckPageFaultsAndMov2Cr3VmexitsWithUserDebugger

BOOLEAN g_CheckPageFaultsAndMov2Cr3VmexitsWithUserDebugger

Whether the page-fault and cr3 vm-exits in vmx-root should check the #PFs or the PML4.Supervisor with user debugger or not.

◆ g_CompatibilityCheck

COMPATIBILITY_CHECKS_STATUS g_CompatibilityCheck

Different attributes and compatibility checks of the current processor.

◆ g_EptHook2sDetourListHead

LIST_ENTRY g_EptHook2sDetourListHead

List header of hidden hooks detour.

◆ g_EptState

EPT_STATE* g_EptState

Save the state and variables related to EPT.

◆ g_ExecTrapInitialized

BOOLEAN g_ExecTrapInitialized

Showes whether the execution trap handler is allowed to trigger an event or not.

◆ g_ExecTrapState

USER_KERNEL_EXECUTION_TRAP_STATE g_ExecTrapState

State of the trap-flag.

◆ g_ExecTrapUnInitializationStarted

BOOLEAN g_ExecTrapUnInitializationStarted

Showes whether the uninitialization of the exec trap is started or not.

◆ g_GuestState

VIRTUAL_MACHINE_STATE* g_GuestState

Save the state and variables related to virtualization on each to logical core.

◆ g_IsEptHook2sDetourListInitialized

BOOLEAN g_IsEptHook2sDetourListInitialized

List header of hidden hooks detour.

◆ g_IsInterceptingInstructions

BOOLEAN g_IsInterceptingInstructions

Test value for intercepting instructions.

◆ g_IsUnsafeSyscallOrSysretHandling

BOOLEAN g_IsUnsafeSyscallOrSysretHandling

Shows whether the debuggee is waiting for an trap step or not.

◆ g_MemoryMapper

MEMORY_MAPPER_ADDRESSES* g_MemoryMapper

Save the state of memory mapper.

◆ g_ModeBasedExecutionControlState

BOOLEAN g_ModeBasedExecutionControlState

Enable interception of Cr3 for Mode-based Execution detection.

◆ g_MsrBitmapInvalidMsrs

UINT64* g_MsrBitmapInvalidMsrs

Bitmap of MSRs that cause #GP.

◆ g_NmiBroadcastingInitialized

BOOLEAN g_NmiBroadcastingInitialized

check for broadcasting NMI mechanism support and its initialization

◆ g_NmiHandlerForKeDeregisterNmiCallback

PVOID g_NmiHandlerForKeDeregisterNmiCallback

NMI handler pointer for KeDeregisterNmiCallback.

◆ g_PageFaultInjectionAddressFrom

UINT64 g_PageFaultInjectionAddressFrom

The (from) address for page-fault injection.

◆ g_PageFaultInjectionAddressTo

UINT64 g_PageFaultInjectionAddressTo

The (to) address for page-fault injection.

◆ g_PageFaultInjectionErrorCode

UINT32 g_PageFaultInjectionErrorCode

The error code for page-fault injection.

◆ g_TransparentMode

BOOLEAN g_TransparentMode

Shows whether the debugger transparent mode is enabled (true) or not (false)

◆ g_TransparentModeMeasurements

TRANSPARENCY_MEASUREMENTS* g_TransparentModeMeasurements

holds the measurements from the user-mode and kernel-mode

◆ g_TriggerEventForCpuids

BOOLEAN g_TriggerEventForCpuids

Showes whether the cpuid handler is allowed to trigger an event or not.

◆ g_TriggerEventForVmcalls

BOOLEAN g_TriggerEventForVmcalls

Showes whether the vmcall handler is allowed to trigger an event or not.

◆ g_WaitingForInterruptWindowToInjectPageFault

BOOLEAN g_WaitingForInterruptWindowToInjectPageFault

Shows whether the the VMM is waiting to inject a page-fault or not.

Variables