HaltedRoutines.h File Reference

Headers for all single core broadcasting functions in case of halted core. More...

Go to the source code of this file.

Functions
VOID	HaltedRoutineChangeAllMsrBitmapReadOnSingleCore (UINT32 TargetCoreId, UINT64 BitmapMask)
	This function performs running MSR changes (RDMSR) on a single core.
VOID	HaltedRoutineChangeAllMsrBitmapWriteOnSingleCore (UINT32 TargetCoreId, UINT64 BitmapMask)
	This function performs running MSR changes (WRMSR) on a single core.
VOID	HaltedRoutineChangeIoBitmapOnSingleCore (UINT32 TargetCoreId, UINT64 Port)
	This function performs running changes to I/O bitmap on a single core.
VOID	HaltedRoutineEnableRdpmcExitingOnSingleCore (UINT32 TargetCoreId)
	This function performs running enable RDPMC exiting on a single core.
VOID	HaltedRoutineEnableRdtscExitingOnSingleCore (UINT32 TargetCoreId)
	This function performs running enable rdtsc/rdtscp exiting on a single core.
VOID	HaltedRoutineEnableMov2DebugRegsExitingOnSingleCore (UINT32 TargetCoreId)
	This function performs running enable mov to debug registers exiting on a single core.
VOID	HaltedRoutineEnableExternalInterruptExiting (UINT32 TargetCoreId)
	This function performs running enable external interrupt exiting on a single core.
VOID	HaltedRoutineSetExceptionBitmapOnSingleCore (UINT32 TargetCoreId, UINT64 ExceptionIndex)
	This function performs running set exception bitmap on a single core.
VOID	HaltedRoutineUnSetExceptionBitmapOnSingleCore (UINT32 TargetCoreId, UINT64 ExceptionIndex)
	This function performs running unset exception bitmap on VMCS on a single core.
VOID	HaltedRoutineEnableMovToCrExitingOnSingleCore (UINT32 TargetCoreId, DEBUGGER_EVENT_OPTIONS *BroadcastingOption)
	This function performs running enable mov to CR exiting on a single core.
VOID	HaltedRoutineEnableEferSyscallHookOnSingleCore (UINT32 TargetCoreId)
	This function performs running enable syscall hook using EFER SCE bit on a single core.
VOID	HaltedRoutineInvalidateEptAllContextsOnSingleCore (UINT32 TargetCoreId)
	This function performs running invalidate EPT (All Contexts) on a single core.
VOID	HaltedRoutineInvalidateSingleContextOnSingleCore (UINT32 TargetCoreId)
	This function performs running invalidate EPT (A Single Context) on a single core.

Detailed Description

Headers for all single core broadcasting functions in case of halted core.

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.7

Date

2023-10-19

Copyright

This project is released under the GNU Public License v3.

Function Documentation

HaltedRoutineChangeAllMsrBitmapReadOnSingleCore()

VOID HaltedRoutineChangeAllMsrBitmapReadOnSingleCore	(	UINT32	TargetCoreId,
		UINT64	BitmapMask )

This function performs running MSR changes (RDMSR) on a single core.

Should be called from VMX root-mode

Parameters

TargetCoreId	The target core's ID (to just run on this core)
BitmapMask

Returns

VOID

{
    DIRECT_VMCALL_PARAMETERS DirectVmcallOptions = {0};
    UINT64                   HaltedCoreTask      = (UINT64)NULL;
 
    //
    // Set the target task
    //
    HaltedCoreTask = DEBUGGER_HALTED_CORE_TASK_CHANGE_MSR_BITMAP_READ;
 
    //
    // Set the parameters for the direct VMCALL
    //
    DirectVmcallOptions.OptionalParam1 = BitmapMask;
 
    //
    // Send request for the target task to the halted cores (synchronized)
    //
    HaltedCoreRunTaskOnSingleCore(TargetCoreId,
                                  HaltedCoreTask,
                                  TRUE,
                                  &DirectVmcallOptions);
}

HaltedRoutineChangeAllMsrBitmapWriteOnSingleCore()

VOID HaltedRoutineChangeAllMsrBitmapWriteOnSingleCore	(	UINT32	TargetCoreId,
		UINT64	BitmapMask )

This function performs running MSR changes (WRMSR) on a single core.

Should be called from VMX root-mode

Parameters

TargetCoreId	The target core's ID (to just run on this core)
BitmapMask

Returns

VOID

{
    DIRECT_VMCALL_PARAMETERS DirectVmcallOptions = {0};
    UINT64                   HaltedCoreTask      = (UINT64)NULL;
 
    //
    // Set the target task
    //
    HaltedCoreTask = DEBUGGER_HALTED_CORE_TASK_CHANGE_MSR_BITMAP_WRITE;
 
    //
    // Set the parameters for the direct VMCALL
    //
    DirectVmcallOptions.OptionalParam1 = BitmapMask;
 
    //
    // Send request for the target task to the halted cores (synchronized)
    //
    HaltedCoreRunTaskOnSingleCore(TargetCoreId,
                                  HaltedCoreTask,
                                  TRUE,
                                  &DirectVmcallOptions);
}

HaltedRoutineChangeIoBitmapOnSingleCore()

VOID HaltedRoutineChangeIoBitmapOnSingleCore	(	UINT32	TargetCoreId,
		UINT64	Port )

This function performs running changes to I/O bitmap on a single core.

Should be called from VMX root-mode

Parameters

TargetCoreId	The target core's ID (to just run on this core)
Port

Returns

VOID

{
    DIRECT_VMCALL_PARAMETERS DirectVmcallOptions = {0};
    UINT64                   HaltedCoreTask      = (UINT64)NULL;
 
    //
    // Set the target task
    //
    HaltedCoreTask = DEBUGGER_HALTED_CORE_TASK_CHANGE_IO_BITMAP;
 
    //
    // Set the parameters for the direct VMCALL
    //
    DirectVmcallOptions.OptionalParam1 = Port;
 
    //
    // Send request for the target task to the halted cores (synchronized)
    //
    HaltedCoreRunTaskOnSingleCore(TargetCoreId,
                                  HaltedCoreTask,
                                  TRUE,
                                  &DirectVmcallOptions);
}

HaltedRoutineEnableEferSyscallHookOnSingleCore()

VOID HaltedRoutineEnableEferSyscallHookOnSingleCore

(

UINT32

TargetCoreId

)

This function performs running enable syscall hook using EFER SCE bit on a single core.

Should be called from VMX root-mode

Parameters

TargetCoreId

The target core's ID (to just run on this core)

Returns

VOID

{
    DIRECT_VMCALL_PARAMETERS DirectVmcallOptions = {0};
    UINT64                   HaltedCoreTask      = (UINT64)NULL;
 
    //
    // Set the target task
    //
    HaltedCoreTask = DEBUGGER_HALTED_CORE_TASK_ENABLE_SYSCALL_HOOK_EFER;
 
    //
    // Send request for the target task to the halted cores (synchronized)
    //
    HaltedCoreRunTaskOnSingleCore(TargetCoreId,
                                  HaltedCoreTask,
                                  TRUE,
                                  &DirectVmcallOptions);
}

HaltedRoutineEnableExternalInterruptExiting()

VOID HaltedRoutineEnableExternalInterruptExiting

(

UINT32

TargetCoreId

)

This function performs running enable external interrupt exiting on a single core.

Should be called from VMX root-mode

Parameters

TargetCoreId

The target core's ID (to just run on this core)

Returns

VOID

{
    DIRECT_VMCALL_PARAMETERS DirectVmcallOptions = {0};
    UINT64                   HaltedCoreTask      = (UINT64)NULL;
 
    //
    // Set the target task
    //
    HaltedCoreTask = DEBUGGER_HALTED_CORE_TASK_ENABLE_EXTERNAL_INTERRUPT_EXITING;
 
    //
    // Send request for the target task to the halted cores (synchronized)
    //
    HaltedCoreRunTaskOnSingleCore(TargetCoreId,
                                  HaltedCoreTask,
                                  TRUE,
                                  &DirectVmcallOptions);
}

HaltedRoutineEnableMov2DebugRegsExitingOnSingleCore()

VOID HaltedRoutineEnableMov2DebugRegsExitingOnSingleCore

(

UINT32

TargetCoreId

)

This function performs running enable mov to debug registers exiting on a single core.

Should be called from VMX root-mode

Parameters

TargetCoreId

The target core's ID (to just run on this core)

Returns

VOID

{
    DIRECT_VMCALL_PARAMETERS DirectVmcallOptions = {0};
    UINT64                   HaltedCoreTask      = (UINT64)NULL;
 
    //
    // Set the target task
    //
    HaltedCoreTask = DEBUGGER_HALTED_CORE_TASK_ENABLE_MOV_TO_DEBUG_REGS_EXITING;
 
    //
    // Send request for the target task to the halted cores (synchronized)
    //
    HaltedCoreRunTaskOnSingleCore(TargetCoreId,
                                  HaltedCoreTask,
                                  TRUE,
                                  &DirectVmcallOptions);
}

HaltedRoutineEnableMovToCrExitingOnSingleCore()

VOID HaltedRoutineEnableMovToCrExitingOnSingleCore	(	UINT32	TargetCoreId,
		DEBUGGER_EVENT_OPTIONS *	BroadcastingOption )

This function performs running enable mov to CR exiting on a single core.

Should be called from VMX root-mode

Parameters

TargetCoreId	The target core's ID (to just run on this core)
BroadcastingOption

Returns

VOID

{
    DIRECT_VMCALL_PARAMETERS DirectVmcallOptions = {0};
    UINT64                   HaltedCoreTask      = (UINT64)NULL;
 
    //
    // Set the target task
    //
    HaltedCoreTask = DEBUGGER_HALTED_CORE_TASK_ENABLE_MOV_TO_CONTROL_REGS_EXITING;
 
    //
    // Set the parameters for the direct VMCALL
    //
    DirectVmcallOptions.OptionalParam1 = BroadcastingOption->OptionalParam1;
    DirectVmcallOptions.OptionalParam2 = BroadcastingOption->OptionalParam2;
 
    //
    // Send request for the target task to the halted cores (synchronized)
    //
    HaltedCoreRunTaskOnSingleCore(TargetCoreId,
                                  HaltedCoreTask,
                                  TRUE,
                                  &DirectVmcallOptions);
}

HaltedRoutineEnableRdpmcExitingOnSingleCore()

VOID HaltedRoutineEnableRdpmcExitingOnSingleCore

(

UINT32

TargetCoreId

)

This function performs running enable RDPMC exiting on a single core.

Should be called from VMX root-mode

Parameters

TargetCoreId

The target core's ID (to just run on this core)

Returns

VOID

{
    DIRECT_VMCALL_PARAMETERS DirectVmcallOptions = {0};
    UINT64                   HaltedCoreTask      = (UINT64)NULL;
 
    //
    // Set the target task
    //
    HaltedCoreTask = DEBUGGER_HALTED_CORE_TASK_SET_RDPMC_EXITING;
 
    //
    // Send request for the target task to the halted cores (synchronized)
    //
    HaltedCoreRunTaskOnSingleCore(TargetCoreId,
                                  HaltedCoreTask,
                                  TRUE,
                                  &DirectVmcallOptions);
}

HaltedRoutineEnableRdtscExitingOnSingleCore()

VOID HaltedRoutineEnableRdtscExitingOnSingleCore

(

UINT32

TargetCoreId

)

This function performs running enable rdtsc/rdtscp exiting on a single core.

Should be called from VMX root-mode

Parameters

TargetCoreId

The target core's ID (to just run on this core)

Returns

VOID

{
    DIRECT_VMCALL_PARAMETERS DirectVmcallOptions = {0};
    UINT64                   HaltedCoreTask      = (UINT64)NULL;
 
    //
    // Set the target task
    //
    HaltedCoreTask = DEBUGGER_HALTED_CORE_TASK_SET_RDTSC_EXITING;
 
    //
    // Send request for the target task to the halted cores (synchronized)
    //
    HaltedCoreRunTaskOnSingleCore(TargetCoreId,
                                  HaltedCoreTask,
                                  TRUE,
                                  &DirectVmcallOptions);
}

HaltedRoutineInvalidateEptAllContextsOnSingleCore()

VOID HaltedRoutineInvalidateEptAllContextsOnSingleCore

(

UINT32

TargetCoreId

)

This function performs running invalidate EPT (All Contexts) on a single core.

Should be called from VMX root-mode

Parameters

TargetCoreId

The target core's ID (to just run on this core)

Returns

VOID

{
    DIRECT_VMCALL_PARAMETERS DirectVmcallOptions = {0};
    UINT64                   HaltedCoreTask      = (UINT64)NULL;
 
    //
    // Set the target task
    //
    HaltedCoreTask = DEBUGGER_HALTED_CORE_TASK_INVEPT_ALL_CONTEXTS;
 
    //
    // Send request for the target task to the halted cores (synchronized)
    //
    HaltedCoreRunTaskOnSingleCore(TargetCoreId,
                                  HaltedCoreTask,
                                  TRUE,
                                  &DirectVmcallOptions);
}

HaltedRoutineInvalidateSingleContextOnSingleCore()

VOID HaltedRoutineInvalidateSingleContextOnSingleCore

(

UINT32

TargetCoreId

)

This function performs running invalidate EPT (A Single Context) on a single core.

Should be called from VMX root-mode

Parameters

TargetCoreId

The target core's ID (to just run on this core)

Returns

VOID

{
    DIRECT_VMCALL_PARAMETERS DirectVmcallOptions = {0};
    UINT64                   HaltedCoreTask      = (UINT64)NULL;
 
    //
    // Set the target task
    //
    HaltedCoreTask = DEBUGGER_HALTED_CORE_TASK_INVEPT_SINGLE_CONTEXT;
 
    //
    // Send request for the target task to the halted cores (synchronized)
    //
    HaltedCoreRunTaskOnSingleCore(TargetCoreId,
                                  HaltedCoreTask,
                                  TRUE,
                                  &DirectVmcallOptions);
}

HaltedRoutineSetExceptionBitmapOnSingleCore()

VOID HaltedRoutineSetExceptionBitmapOnSingleCore	(	UINT32	TargetCoreId,
		UINT64	ExceptionIndex )

This function performs running set exception bitmap on a single core.

Should be called from VMX root-mode

Parameters

TargetCoreId	The target core's ID (to just run on this core)
ExceptionIndex

Returns

VOID

{
    DIRECT_VMCALL_PARAMETERS DirectVmcallOptions = {0};
    UINT64                   HaltedCoreTask      = (UINT64)NULL;
 
    //
    // Set the target task
    //
    HaltedCoreTask = DEBUGGER_HALTED_CORE_TASK_SET_EXCEPTION_BITMAP;
 
    //
    // Set the parameters for the direct VMCALL
    //
    DirectVmcallOptions.OptionalParam1 = ExceptionIndex;
 
    //
    // Send request for the target task to the halted cores (synchronized)
    //
    HaltedCoreRunTaskOnSingleCore(TargetCoreId,
                                  HaltedCoreTask,
                                  TRUE,
                                  &DirectVmcallOptions);
}

HaltedRoutineUnSetExceptionBitmapOnSingleCore()

VOID HaltedRoutineUnSetExceptionBitmapOnSingleCore	(	UINT32	TargetCoreId,
		UINT64	ExceptionIndex )

This function performs running unset exception bitmap on VMCS on a single core.

Should be called from VMX root-mode

Parameters

TargetCoreId	The target core's ID (to just run on this core)
ExceptionIndex

Returns

VOID

{
    DIRECT_VMCALL_PARAMETERS DirectVmcallOptions = {0};
    UINT64                   HaltedCoreTask      = (UINT64)NULL;
 
    //
    // Set the target task
    //
    HaltedCoreTask = DEBUGGER_HALTED_CORE_TASK_UNSET_EXCEPTION_BITMAP;
 
    //
    // Set the parameters for the direct VMCALL
    //
    DirectVmcallOptions.OptionalParam1 = ExceptionIndex;
 
    //
    // Send request for the target task to the halted cores (synchronized)
    //
    HaltedCoreRunTaskOnSingleCore(TargetCoreId,
                                  HaltedCoreTask,
                                  TRUE,
                                  &DirectVmcallOptions);
}