HaltedCore.h File Reference

Header for the implementation of applying events in halted cores. More...

Go to the source code of this file.

Macros
#define	DEBUGGER_HALTED_CORE_TASK_TEST   0x00000001
	Halted core task for testing purpose.
#define	DEBUGGER_HALTED_CORE_TASK_RUN_VMCALL   0x00000002
	Halted core task for running VMCALLs.
#define	DEBUGGER_HALTED_CORE_TASK_SET_PROCESS_INTERCEPTION   0x00000003
	Halted core task for setting process interception.
#define	DEBUGGER_HALTED_CORE_TASK_SET_THREAD_INTERCEPTION   0x00000004
	Halted core task for setting thread interception.
#define	DEBUGGER_HALTED_CORE_TASK_CHANGE_MSR_BITMAP_READ   0x00000005
	Halted core task for changing MSR Bitmap Read.
#define	DEBUGGER_HALTED_CORE_TASK_CHANGE_MSR_BITMAP_WRITE   0x00000006
	Halted core task for changing MSR Bitmap Write.
#define	DEBUGGER_HALTED_CORE_TASK_CHANGE_IO_BITMAP   0x00000007
	Halted core task for changing I/O Bitmaps (A & B)
#define	DEBUGGER_HALTED_CORE_TASK_SET_RDPMC_EXITING   0x00000008
	Halted core task for enabling rdpmc exiting.
#define	DEBUGGER_HALTED_CORE_TASK_SET_RDTSC_EXITING   0x00000009
	Halted core task for enabling rdtsc/rdtscp exiting.
#define	DEBUGGER_HALTED_CORE_TASK_ENABLE_MOV_TO_DEBUG_REGS_EXITING   0x0000000a
	Halted core task for enabling mov to debug registers exiting.
#define	DEBUGGER_HALTED_CORE_TASK_SET_EXCEPTION_BITMAP   0x0000000b
	Halted core task for setting exception bitmap.
#define	DEBUGGER_HALTED_CORE_TASK_ENABLE_EXTERNAL_INTERRUPT_EXITING   0x0000000c
	Halted core task for enabling external interrupt exiting.
#define	DEBUGGER_HALTED_CORE_TASK_ENABLE_MOV_TO_CONTROL_REGS_EXITING   0x0000000d
	Halted core task for enabling mov to CR exiting.
#define	DEBUGGER_HALTED_CORE_TASK_ENABLE_SYSCALL_HOOK_EFER   0x0000000e
	Halted core task for enabling syscall hook using EFER SCE bit.
#define	DEBUGGER_HALTED_CORE_TASK_INVEPT_ALL_CONTEXTS   0x0000000f
	Halted core task for invalidating EPT (All Contexts)
#define	DEBUGGER_HALTED_CORE_TASK_INVEPT_SINGLE_CONTEXT   0x00000010
	Halted core task for invalidating EPT (A Single Context)
#define	DEBUGGER_HALTED_CORE_TASK_UNSET_EXCEPTION_BITMAP   0x00000011
	Halted core task for unsetting exception bitmap on VMCS.
#define	DEBUGGER_HALTED_CORE_TASK_UNHOOK_SINGLE_PAGE   0x00000012
	Halted core task for restoring a single EPT entry and invalidating EPT cache.
#define	DEBUGGER_HALTED_CORE_TASK_DISABLE_EXTERNAL_INTERRUPT_EXITING_ONLY_TO_CLEAR_INTERRUPT_COMMANDS   0x00000013
	Halted core task for disabling external interrupt exiting only to clear !interrupt commands.
#define	DEBUGGER_HALTED_CORE_TASK_RESET_MSR_BITMAP_READ   0x00000014
	Halted core task for resetting MSR Bitmap Read.
#define	DEBUGGER_HALTED_CORE_TASK_RESET_MSR_BITMAP_WRITE   0x00000015
	Halted core task for resetting MSR Bitmap Write.
#define	DEBUGGER_HALTED_CORE_TASK_RESET_EXCEPTION_BITMAP_ONLY_ON_CLEARING_EXCEPTION_EVENTS   0x00000016
	Halted core task for resetting exception bitmap on VMCS.
#define	DEBUGGER_HALTED_CORE_TASK_RESET_IO_BITMAP   0x00000017
	Halted core task for resetting I/O Bitmaps (A & B)
#define	DEBUGGER_HALTED_CORE_TASK_DISABLE_RDTSC_EXITING_ONLY_FOR_TSC_EVENTS   0x00000018
	Halted core task for clearing rdtsc exiting bit ONLY in the case of disabling the events for !tsc command.
#define	DEBUGGER_HALTED_CORE_TASK_UNSET_RDPMC_EXITING   0x00000019
	Halted core task for disabling rdpmc exiting in primary cpu-based controls.
#define	DEBUGGER_HALTED_CORE_TASK_DISABLE_SYSCALL_HOOK_EFER   0x0000001a
	Halted core task for disabling syscall hook using EFER SCE bit.
#define	DEBUGGER_HALTED_CORE_TASK_DISABLE_MOV_TO_HW_DR_EXITING_ONLY_FOR_DR_EVENTS   0x0000001b
	Halted core task for clearing mov 2 hw dr exiting bit ONLY in the case of disabling the events for !dr command.
#define	DEBUGGER_HALTED_CORE_TASK_DISABLE_MOV_TO_CR_EXITING_ONLY_FOR_CR_EVENTS   0x0000001c
	Halted core task for clearing mov 2 cr exiting bit ONLY in the case of disabling the events for !crwrite command.

Functions
BOOLEAN	HaltedCoreBroadcastTaskAllCores (PROCESSOR_DEBUGGING_STATE *DbgState, UINT64 TargetTask, BOOLEAN LockAgainAfterTask, BOOLEAN Synchronize, PVOID Context)
	Broadcast tasks to halted cores.
VOID	HaltedCoreRunTaskOnSingleCore (UINT32 TargetCoreId, UINT64 TargetTask, BOOLEAN LockAgainAfterTask, PVOID Context)
	Run the task on a single halted core.
VOID	HaltedCorePerformTargetTask (PROCESSOR_DEBUGGING_STATE *DbgState, UINT64 TargetTask, PVOID Context)
	Perform the task on halted core.

Detailed Description

Header for the implementation of applying events in halted cores.

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.7

Date

2023-09-30

Copyright

This project is released under the GNU Public License v3.

Macro Definition Documentation

DEBUGGER_HALTED_CORE_TASK_CHANGE_IO_BITMAP

#define DEBUGGER_HALTED_CORE_TASK_CHANGE_IO_BITMAP   0x00000007

Halted core task for changing I/O Bitmaps (A & B)

DEBUGGER_HALTED_CORE_TASK_CHANGE_MSR_BITMAP_READ

#define DEBUGGER_HALTED_CORE_TASK_CHANGE_MSR_BITMAP_READ   0x00000005

Halted core task for changing MSR Bitmap Read.

DEBUGGER_HALTED_CORE_TASK_CHANGE_MSR_BITMAP_WRITE

#define DEBUGGER_HALTED_CORE_TASK_CHANGE_MSR_BITMAP_WRITE   0x00000006

Halted core task for changing MSR Bitmap Write.

DEBUGGER_HALTED_CORE_TASK_DISABLE_EXTERNAL_INTERRUPT_EXITING_ONLY_TO_CLEAR_INTERRUPT_COMMANDS

#define DEBUGGER_HALTED_CORE_TASK_DISABLE_EXTERNAL_INTERRUPT_EXITING_ONLY_TO_CLEAR_INTERRUPT_COMMANDS   0x00000013

Halted core task for disabling external interrupt exiting only to clear !interrupt commands.

DEBUGGER_HALTED_CORE_TASK_DISABLE_MOV_TO_CR_EXITING_ONLY_FOR_CR_EVENTS

#define DEBUGGER_HALTED_CORE_TASK_DISABLE_MOV_TO_CR_EXITING_ONLY_FOR_CR_EVENTS   0x0000001c

Halted core task for clearing mov 2 cr exiting bit ONLY in the case of disabling the events for !crwrite command.

DEBUGGER_HALTED_CORE_TASK_DISABLE_MOV_TO_HW_DR_EXITING_ONLY_FOR_DR_EVENTS

#define DEBUGGER_HALTED_CORE_TASK_DISABLE_MOV_TO_HW_DR_EXITING_ONLY_FOR_DR_EVENTS   0x0000001b

Halted core task for clearing mov 2 hw dr exiting bit ONLY in the case of disabling the events for !dr command.

DEBUGGER_HALTED_CORE_TASK_DISABLE_RDTSC_EXITING_ONLY_FOR_TSC_EVENTS

#define DEBUGGER_HALTED_CORE_TASK_DISABLE_RDTSC_EXITING_ONLY_FOR_TSC_EVENTS   0x00000018

Halted core task for clearing rdtsc exiting bit ONLY in the case of disabling the events for !tsc command.

DEBUGGER_HALTED_CORE_TASK_DISABLE_SYSCALL_HOOK_EFER

#define DEBUGGER_HALTED_CORE_TASK_DISABLE_SYSCALL_HOOK_EFER   0x0000001a

Halted core task for disabling syscall hook using EFER SCE bit.

DEBUGGER_HALTED_CORE_TASK_ENABLE_EXTERNAL_INTERRUPT_EXITING

#define DEBUGGER_HALTED_CORE_TASK_ENABLE_EXTERNAL_INTERRUPT_EXITING   0x0000000c

Halted core task for enabling external interrupt exiting.

DEBUGGER_HALTED_CORE_TASK_ENABLE_MOV_TO_CONTROL_REGS_EXITING

#define DEBUGGER_HALTED_CORE_TASK_ENABLE_MOV_TO_CONTROL_REGS_EXITING   0x0000000d

Halted core task for enabling mov to CR exiting.

DEBUGGER_HALTED_CORE_TASK_ENABLE_MOV_TO_DEBUG_REGS_EXITING

#define DEBUGGER_HALTED_CORE_TASK_ENABLE_MOV_TO_DEBUG_REGS_EXITING   0x0000000a

Halted core task for enabling mov to debug registers exiting.

DEBUGGER_HALTED_CORE_TASK_ENABLE_SYSCALL_HOOK_EFER

#define DEBUGGER_HALTED_CORE_TASK_ENABLE_SYSCALL_HOOK_EFER   0x0000000e

Halted core task for enabling syscall hook using EFER SCE bit.

DEBUGGER_HALTED_CORE_TASK_INVEPT_ALL_CONTEXTS

#define DEBUGGER_HALTED_CORE_TASK_INVEPT_ALL_CONTEXTS   0x0000000f

Halted core task for invalidating EPT (All Contexts)

DEBUGGER_HALTED_CORE_TASK_INVEPT_SINGLE_CONTEXT

#define DEBUGGER_HALTED_CORE_TASK_INVEPT_SINGLE_CONTEXT   0x00000010

Halted core task for invalidating EPT (A Single Context)

DEBUGGER_HALTED_CORE_TASK_RESET_EXCEPTION_BITMAP_ONLY_ON_CLEARING_EXCEPTION_EVENTS

#define DEBUGGER_HALTED_CORE_TASK_RESET_EXCEPTION_BITMAP_ONLY_ON_CLEARING_EXCEPTION_EVENTS   0x00000016

Halted core task for resetting exception bitmap on VMCS.

DEBUGGER_HALTED_CORE_TASK_RESET_IO_BITMAP

#define DEBUGGER_HALTED_CORE_TASK_RESET_IO_BITMAP   0x00000017

Halted core task for resetting I/O Bitmaps (A & B)

DEBUGGER_HALTED_CORE_TASK_RESET_MSR_BITMAP_READ

#define DEBUGGER_HALTED_CORE_TASK_RESET_MSR_BITMAP_READ   0x00000014

Halted core task for resetting MSR Bitmap Read.

DEBUGGER_HALTED_CORE_TASK_RESET_MSR_BITMAP_WRITE

#define DEBUGGER_HALTED_CORE_TASK_RESET_MSR_BITMAP_WRITE   0x00000015

Halted core task for resetting MSR Bitmap Write.

DEBUGGER_HALTED_CORE_TASK_RUN_VMCALL

#define DEBUGGER_HALTED_CORE_TASK_RUN_VMCALL   0x00000002

Halted core task for running VMCALLs.

DEBUGGER_HALTED_CORE_TASK_SET_EXCEPTION_BITMAP

#define DEBUGGER_HALTED_CORE_TASK_SET_EXCEPTION_BITMAP   0x0000000b

Halted core task for setting exception bitmap.

DEBUGGER_HALTED_CORE_TASK_SET_PROCESS_INTERCEPTION

#define DEBUGGER_HALTED_CORE_TASK_SET_PROCESS_INTERCEPTION   0x00000003

Halted core task for setting process interception.

DEBUGGER_HALTED_CORE_TASK_SET_RDPMC_EXITING

#define DEBUGGER_HALTED_CORE_TASK_SET_RDPMC_EXITING   0x00000008

Halted core task for enabling rdpmc exiting.

DEBUGGER_HALTED_CORE_TASK_SET_RDTSC_EXITING

#define DEBUGGER_HALTED_CORE_TASK_SET_RDTSC_EXITING   0x00000009

Halted core task for enabling rdtsc/rdtscp exiting.

DEBUGGER_HALTED_CORE_TASK_SET_THREAD_INTERCEPTION

#define DEBUGGER_HALTED_CORE_TASK_SET_THREAD_INTERCEPTION   0x00000004

Halted core task for setting thread interception.

DEBUGGER_HALTED_CORE_TASK_TEST

#define DEBUGGER_HALTED_CORE_TASK_TEST   0x00000001

Halted core task for testing purpose.

DEBUGGER_HALTED_CORE_TASK_UNHOOK_SINGLE_PAGE

#define DEBUGGER_HALTED_CORE_TASK_UNHOOK_SINGLE_PAGE   0x00000012

Halted core task for restoring a single EPT entry and invalidating EPT cache.

DEBUGGER_HALTED_CORE_TASK_UNSET_EXCEPTION_BITMAP

#define DEBUGGER_HALTED_CORE_TASK_UNSET_EXCEPTION_BITMAP   0x00000011

Halted core task for unsetting exception bitmap on VMCS.

DEBUGGER_HALTED_CORE_TASK_UNSET_RDPMC_EXITING

#define DEBUGGER_HALTED_CORE_TASK_UNSET_RDPMC_EXITING   0x00000019

Halted core task for disabling rdpmc exiting in primary cpu-based controls.

Function Documentation

HaltedCoreBroadcastTaskAllCores()

BOOLEAN HaltedCoreBroadcastTaskAllCores	(	PROCESSOR_DEBUGGING_STATE *	DbgState,
		UINT64	TargetTask,
		BOOLEAN	LockAgainAfterTask,
		BOOLEAN	Synchronize,
		PVOID	Context )

Broadcast tasks to halted cores.

This function should be called from VMX root-mode

Parameters

DbgState	The state of the debugger on the current core
TargetTask	The target task
LockAgainAfterTask	Lock the core after the task
Synchronize	Whether the function should wait for all cores to synchronize and lock again or not
Context	optional parameter passed to the functions

Returns

BOOLEAN

{
    ULONG ProcessorsCount;
 
    ProcessorsCount = KeQueryActiveProcessorCount(0);
 
    //
    // Synchronization is not possible when the locking after the task is
    // not expected
    //
    if (Synchronize && !LockAgainAfterTask)
    {
        LogWarning("Synchronization is not possible when the locking after the task is not expected");
        return FALSE;
    }
 
    //
    // Apply the task to all cores except current core
    //
    for (UINT32 i = 0; i < ProcessorsCount; i++)
    {
        if (DbgState->CoreId != i)
        {
            //
            // apply task to the target core
            //
            HaltedCoreApplyTaskOnTargetCore(i, TargetTask, LockAgainAfterTask, Context);
        }
        else
        {
            //
            // Perform the task for the current core
            //
            HaltedCorePerformTargetTask(DbgState, TargetTask, Context);
        }
    }
 
    //
    // If synchronization is expected, we need to check to make sure
    // all cores are synchronized (locked) at this point or not
    //
    if (Synchronize)
    {
        for (size_t i = 0; i < ProcessorsCount; i++)
        {
            if (DbgState->CoreId != i)
            {
                //
                // Wait until the core is locked again
                //
                while (TRUE)
                {
                    //
                    // Keep checking to make sure the target core finished the
                    // execution its task and locked again
                    //
                    if (KdCheckTheHaltedCore(&g_DbgState[i]) == FALSE)
                    {
                        continue;
                    }
                    else
                    {
                        break;
                    }
                }
            }
        }
    }
 
    //
    // All cores locked again
    //
    return TRUE;
}

HaltedCorePerformTargetTask()

VOID HaltedCorePerformTargetTask	(	PROCESSOR_DEBUGGING_STATE *	DbgState,
		UINT64	TargetTask,
		PVOID	Context )

Perform the task on halted core.

This function should be called from VMX root-mode

Parameters

DbgState	The state of the debugger on the current core
TargetTask	The target task
Context	optional parameter passed to the functions

Returns

VOID

{
    switch (TargetTask)
    {
    case DEBUGGER_HALTED_CORE_TASK_TEST:
    {
        //
        // Perform the test task
        //
        HaltedCoreTaskTest(DbgState, Context);
        break;
    }
 
    case DEBUGGER_HALTED_CORE_TASK_RUN_VMCALL:
    {
        //
        // Call the direct VMCALL test function
        //
        DirectVmcallTest(DbgState->CoreId, (DIRECT_VMCALL_PARAMETERS *)Context);
 
        break;
    }
    case DEBUGGER_HALTED_CORE_TASK_SET_PROCESS_INTERCEPTION:
    {
        //
        // Enable process change detection
        //
        ProcessEnableOrDisableThreadChangeMonitor(DbgState, TRUE, PVOID_TO_BOOLEAN(Context));
 
        break;
    }
    case DEBUGGER_HALTED_CORE_TASK_SET_THREAD_INTERCEPTION:
    {
        //
        // Enable alert for thread changes
        //
        ThreadEnableOrDisableThreadChangeMonitor(DbgState, TRUE, PVOID_TO_BOOLEAN(Context));
 
        break;
    }
    case DEBUGGER_HALTED_CORE_TASK_CHANGE_MSR_BITMAP_READ:
    {
        //
        // Change MSR bitmap for read (RDMSR)
        //
        DirectVmcallChangeMsrBitmapRead(DbgState->CoreId, (DIRECT_VMCALL_PARAMETERS *)Context);
 
        break;
    }
    case DEBUGGER_HALTED_CORE_TASK_CHANGE_MSR_BITMAP_WRITE:
    {
        //
        // Change MSR bitmap for write (WRMSR)
        //
        DirectVmcallChangeMsrBitmapWrite(DbgState->CoreId, (DIRECT_VMCALL_PARAMETERS *)Context);
 
        break;
    }
    case DEBUGGER_HALTED_CORE_TASK_CHANGE_IO_BITMAP:
    {
        //
        // Change I/O bitmap
        //
        DirectVmcallChangeIoBitmap(DbgState->CoreId, (DIRECT_VMCALL_PARAMETERS *)Context);
 
        break;
    }
    case DEBUGGER_HALTED_CORE_TASK_SET_RDPMC_EXITING:
    {
        //
        // Enable rdpmc exiting
        //
        DirectVmcallEnableRdpmcExiting(DbgState->CoreId, (DIRECT_VMCALL_PARAMETERS *)Context);
 
        break;
    }
    case DEBUGGER_HALTED_CORE_TASK_SET_RDTSC_EXITING:
    {
        //
        // Enable rdtsc/rdtscp exiting
        //
        DirectVmcallEnableRdtscpExiting(DbgState->CoreId, (DIRECT_VMCALL_PARAMETERS *)Context);
 
        break;
    }
    case DEBUGGER_HALTED_CORE_TASK_ENABLE_MOV_TO_DEBUG_REGS_EXITING:
    {
        //
        // Enable mov to debug registers exiting
        //
        DirectVmcallEnableMov2DebugRegsExiting(DbgState->CoreId, (DIRECT_VMCALL_PARAMETERS *)Context);
 
        break;
    }
    case DEBUGGER_HALTED_CORE_TASK_SET_EXCEPTION_BITMAP:
    {
        //
        // Set exception bitmap
        //
        DirectVmcallSetExceptionBitmap(DbgState->CoreId, (DIRECT_VMCALL_PARAMETERS *)Context);
 
        break;
    }
    case DEBUGGER_HALTED_CORE_TASK_ENABLE_EXTERNAL_INTERRUPT_EXITING:
    {
        //
        // enable external interrupt exiting
        //
        DirectVmcallEnableExternalInterruptExiting(DbgState->CoreId, (DIRECT_VMCALL_PARAMETERS *)Context);
 
        break;
    }
    case DEBUGGER_HALTED_CORE_TASK_ENABLE_MOV_TO_CONTROL_REGS_EXITING:
    {
        //
        // enable mov to CR exiting
        //
        DirectVmcallEnableMovToCrExiting(DbgState->CoreId, (DIRECT_VMCALL_PARAMETERS *)Context);
 
        break;
    }
    case DEBUGGER_HALTED_CORE_TASK_ENABLE_SYSCALL_HOOK_EFER:
    {
        //
        // enable syscall hook using EFER SCE bit
        //
        DirectVmcallEnableEferSyscall(DbgState->CoreId, (DIRECT_VMCALL_PARAMETERS *)Context);
 
        break;
    }
    case DEBUGGER_HALTED_CORE_TASK_INVEPT_ALL_CONTEXTS:
    {
        //
        // invalidate EPT (All Contexts)
        //
        DirectVmcallInvalidateEptAllContexts(DbgState->CoreId, (DIRECT_VMCALL_PARAMETERS *)Context);
 
        break;
    }
    case DEBUGGER_HALTED_CORE_TASK_INVEPT_SINGLE_CONTEXT:
    {
        //
        // invalidate EPT (A Single Context)
        //
        DirectVmcallInvalidateSingleContext(DbgState->CoreId, (DIRECT_VMCALL_PARAMETERS *)Context);
 
        break;
    }
    case DEBUGGER_HALTED_CORE_TASK_UNSET_EXCEPTION_BITMAP:
    {
        //
        // unset exception bitmap on VMCS
        //
        DirectVmcallUnsetExceptionBitmap(DbgState->CoreId, (DIRECT_VMCALL_PARAMETERS *)Context);
 
        break;
    }
    case DEBUGGER_HALTED_CORE_TASK_UNHOOK_SINGLE_PAGE:
    {
        //
        // restore a single EPT entry and invalidate EPT cache
        //
        DirectVmcallUnhookSinglePage(DbgState->CoreId, (DIRECT_VMCALL_PARAMETERS *)Context);
 
        break;
    }
    case DEBUGGER_HALTED_CORE_TASK_DISABLE_EXTERNAL_INTERRUPT_EXITING_ONLY_TO_CLEAR_INTERRUPT_COMMANDS:
    {
        //
        // disable external interrupt exiting only to clear !interrupt commands
        //
        DirectVmcallSetDisableExternalInterruptExitingOnlyOnClearingInterruptEvents(DbgState->CoreId, (DIRECT_VMCALL_PARAMETERS *)Context);
 
        break;
    }
    case DEBUGGER_HALTED_CORE_TASK_RESET_MSR_BITMAP_READ:
    {
        //
        // reset MSR Bitmap Read
        //
        DirectVmcallResetMsrBitmapRead(DbgState->CoreId, (DIRECT_VMCALL_PARAMETERS *)Context);
 
        break;
    }
    case DEBUGGER_HALTED_CORE_TASK_RESET_MSR_BITMAP_WRITE:
    {
        //
        // reset MSR Bitmap Write
        //
        DirectVmcallResetMsrBitmapWrite(DbgState->CoreId, (DIRECT_VMCALL_PARAMETERS *)Context);
 
        break;
    }
    case DEBUGGER_HALTED_CORE_TASK_RESET_EXCEPTION_BITMAP_ONLY_ON_CLEARING_EXCEPTION_EVENTS:
    {
        //
        // reset exception bitmap on VMCS
        //
        DirectVmcallResetExceptionBitmapOnlyOnClearingExceptionEvents(DbgState->CoreId, (DIRECT_VMCALL_PARAMETERS *)Context);
 
        break;
    }
    case DEBUGGER_HALTED_CORE_TASK_RESET_IO_BITMAP:
    {
        //
        // reset I/O Bitmaps (A & B)
        //
        DirectVmcallResetIoBitmap(DbgState->CoreId, (DIRECT_VMCALL_PARAMETERS *)Context);
 
        break;
    }
    case DEBUGGER_HALTED_CORE_TASK_DISABLE_RDTSC_EXITING_ONLY_FOR_TSC_EVENTS:
    {
        //
        // clear rdtsc exiting bit ONLY in the case of disabling the events for !tsc command
        //
        DirectVmcallDisableRdtscExitingForClearingTscEvents(DbgState->CoreId, (DIRECT_VMCALL_PARAMETERS *)Context);
 
        break;
    }
    case DEBUGGER_HALTED_CORE_TASK_UNSET_RDPMC_EXITING:
    {
        //
        // disable rdpmc exiting in primary cpu-based controls
        //
        DirectVmcallDisableRdpmcExiting(DbgState->CoreId, (DIRECT_VMCALL_PARAMETERS *)Context);
 
        break;
    }
    case DEBUGGER_HALTED_CORE_TASK_DISABLE_SYSCALL_HOOK_EFER:
    {
        //
        // disable syscall hook using EFER SCE bit
        //
        DirectVmcallDisableEferSyscallEvents(DbgState->CoreId, (DIRECT_VMCALL_PARAMETERS *)Context);
 
        break;
    }
    case DEBUGGER_HALTED_CORE_TASK_DISABLE_MOV_TO_HW_DR_EXITING_ONLY_FOR_DR_EVENTS:
    {
        //
        // clear mov 2 hw dr exiting bit ONLY in the case of disabling the events for !dr command
        //
        DirectVmcallDisableMov2DrExitingForClearingDrEvents(DbgState->CoreId, (DIRECT_VMCALL_PARAMETERS *)Context);
 
        break;
    }
    case DEBUGGER_HALTED_CORE_TASK_DISABLE_MOV_TO_CR_EXITING_ONLY_FOR_CR_EVENTS:
    {
        //
        // clear mov 2 cr exiting bit ONLY in the case of disabling the events for !crwrite command
        //
        DirectVmcallDisableMov2CrExitingForClearingCrEvents(DbgState->CoreId, (DIRECT_VMCALL_PARAMETERS *)Context);
 
        break;
    }
    default:
        LogWarning("Warning, unknown broadcast on halted core received");
        break;
    }
}

HaltedCoreRunTaskOnSingleCore()

VOID HaltedCoreRunTaskOnSingleCore	(	UINT32	TargetCoreId,
		UINT64	TargetTask,
		BOOLEAN	LockAgainAfterTask,
		PVOID	Context )

Run the task on a single halted core.

This function should be called from VMX root-mode

Parameters

TargetCoreId	The target core's ID (to just run on this core)
TargetTask	The target task
LockAgainAfterTask	Lock the core after the task
Context	optional parameter passed to the functions

Returns

VOID

{
    //
    // Check if the task needs to be executed for the current
    // core or any other cores
    //
    if (TargetCoreId == KeGetCurrentProcessorNumberEx(NULL))
    {
        //
        // *** Perform the task for the current core ***
        //
        HaltedCorePerformTargetTask(&g_DbgState[TargetCoreId], TargetTask, Context);
    }
    else
    {
        //
        // *** Perform the task for another core ***
        //
 
        //
        // apply task to the target core
        //
        HaltedCoreApplyTaskOnTargetCore(TargetCoreId, TargetTask, LockAgainAfterTask, Context);
    }
}