HyperDbgVmmImports.h File Reference

Headers relating exported functions from hypervisor. More...

Go to the source code of this file.

Macros
#define	IMPORT_EXPORT_VMM   __declspec(dllimport)

Functions
IMPORT_EXPORT_VMM NTSTATUS	VmFuncVmxVmcall (unsigned long long VmcallNumber, unsigned long long OptionalParam1, unsigned long long OptionalParam2, unsigned long long OptionalParam3)
	Export for running VMX VMCALLs.
IMPORT_EXPORT_VMM VOID	VmFuncPerformRipIncrement (UINT32 CoreId)
	Perform the incrementation of RIP.
IMPORT_EXPORT_VMM VOID	VmFuncSuppressRipIncrement (UINT32 CoreId)
	Suppress the incrementation of RIP.
IMPORT_EXPORT_VMM VOID	VmFuncChangeMtfUnsettingState (UINT32 CoreId, BOOLEAN Set)
	Suppress unsetting MTF.
IMPORT_EXPORT_VMM VOID	VmFuncChangeIgnoreOneMtfState (UINT32 CoreId, BOOLEAN Set)
	Change ignore one MTF state.
IMPORT_EXPORT_VMM VOID	VmFuncSetMonitorTrapFlag (BOOLEAN Set)
	Set the monitor trap flag.
IMPORT_EXPORT_VMM VOID	VmFuncSetRflagTrapFlag (BOOLEAN Set)
	Set Rflag's trap flag.
IMPORT_EXPORT_VMM VOID	VmFuncRegisterMtfBreak (UINT32 CoreId)
	Register for break in the case of an MTF.
IMPORT_EXPORT_VMM VOID	VmFuncUnRegisterMtfBreak (UINT32 CoreId)
	Unregister for break in the case of an MTF.
IMPORT_EXPORT_VMM VOID	VmFuncSetLoadDebugControls (BOOLEAN Set)
	Set LOAD DEBUG CONTROLS on Vm-entry controls.
IMPORT_EXPORT_VMM VOID	VmFuncSetSaveDebugControls (BOOLEAN Set)
	Set SAVE DEBUG CONTROLS on Vm-exit controls.
IMPORT_EXPORT_VMM VOID	VmFuncSetPmcVmexit (BOOLEAN Set)
	Set vm-exit for rdpmc instructions.
IMPORT_EXPORT_VMM VOID	VmFuncSetMovControlRegsExiting (BOOLEAN Set, UINT64 ControlRegister, UINT64 MaskRegister)
	Set vm-exit for mov-to-cr0/4.
IMPORT_EXPORT_VMM VOID	VmFuncSetMovToCr3Vmexit (UINT32 CoreId, BOOLEAN Set)
	Set vm-exit for mov-to-cr3.
IMPORT_EXPORT_VMM VOID	VmFuncWriteExceptionBitmap (UINT32 BitmapMask)
	Write on exception bitmap in VMCS DO NOT CALL IT DIRECTLY, instead use HvSetExceptionBitmap.
IMPORT_EXPORT_VMM VOID	VmFuncSetInterruptWindowExiting (BOOLEAN Set)
	Set Interrupt-window exiting.
IMPORT_EXPORT_VMM VOID	VmFuncSetNmiWindowExiting (BOOLEAN Set)
	Set NMI-window exiting.
IMPORT_EXPORT_VMM VOID	VmFuncSetNmiExiting (BOOLEAN Set)
	Set the NMI Exiting.
IMPORT_EXPORT_VMM VOID	VmFuncSetExceptionBitmap (UINT32 CoreId, UINT32 IdtIndex)
	Set exception bitmap in VMCS.
IMPORT_EXPORT_VMM VOID	VmFuncUnsetExceptionBitmap (UINT32 CoreId, UINT32 IdtIndex)
	Unset exception bitmap in VMCS.
IMPORT_EXPORT_VMM VOID	VmFuncSetExternalInterruptExiting (UINT32 CoreId, BOOLEAN Set)
	Set the External Interrupt Exiting.
IMPORT_EXPORT_VMM VOID	VmFuncSetRdtscExiting (UINT32 CoreId, BOOLEAN Set)
	Set the RDTSC/P Exiting.
IMPORT_EXPORT_VMM VOID	VmFuncSetMovDebugRegsExiting (UINT32 CoreId, BOOLEAN Set)
	Set or unset the Mov to Debug Registers Exiting.
IMPORT_EXPORT_VMM VOID	VmFuncInjectPendingExternalInterrupts (UINT32 CoreId)
	Inject pending external interrupts.
IMPORT_EXPORT_VMM VOID	VmFuncSetRflags (UINT64 Rflags)
	Set guest's RFLAGS.
IMPORT_EXPORT_VMM VOID	VmFuncSetRip (UINT64 Rip)
	Set guest's RIP.
IMPORT_EXPORT_VMM VOID	VmFuncSetTriggerEventForVmcalls (BOOLEAN Set)
	Set triggering events for VMCALLs.
IMPORT_EXPORT_VMM VOID	VmFuncSetTriggerEventForCpuids (BOOLEAN Set)
	Set triggering events for CPUIDs.
IMPORT_EXPORT_VMM VOID	VmFuncSetInterruptibilityState (UINT64 InterruptibilityState)
	Set guest's interruptibility state.
IMPORT_EXPORT_VMM VOID	VmFuncCheckAndEnableExternalInterrupts (UINT32 CoreId)
	Check and enable external interrupts.
IMPORT_EXPORT_VMM VOID	VmFuncDisableExternalInterruptsAndInterruptWindow (UINT32 CoreId)
	Disable external-interrupts and interrupt window.
IMPORT_EXPORT_VMM VOID	VmFuncEventInjectPageFaultWithCr2 (UINT32 CoreId, UINT64 Address, UINT32 PageFaultCode)
	Inject #PF and configure CR2 register.
IMPORT_EXPORT_VMM VOID	VmFuncEventInjectPageFaultRangeAddress (UINT32 CoreId, UINT64 AddressFrom, UINT64 AddressTo, UINT32 PageFaultCode)
	Inject a range of page-faults.
IMPORT_EXPORT_VMM VOID	VmFuncEventInjectInterruption (UINT32 InterruptionType, UINT32 Vector, BOOLEAN DeliverErrorCode, UINT32 ErrorCode)
	Inject interrupt/faults/exceptions.
IMPORT_EXPORT_VMM VOID	VmFuncVmxBroadcastInitialize ()
	Export for initialize the VMX Broadcast mechanism.
IMPORT_EXPORT_VMM VOID	VmFuncVmxBroadcastUninitialize ()
	Export for uninitialize the VMX Broadcast mechanism.
IMPORT_EXPORT_VMM VOID	VmFuncEventInjectBreakpoint ()
	Inject #BP to the guest (Event Injection)
IMPORT_EXPORT_VMM VOID	VmFuncInvalidateEptSingleContext (UINT32 CoreId)
	Requests for single-context EPT invalidation.
IMPORT_EXPORT_VMM VOID	VmFuncInvalidateEptAllContexts ()
	Requests for all contexts EPT invalidation.
IMPORT_EXPORT_VMM VOID	VmFuncUninitVmm ()
	Uninitialize Terminate Vmx on all logical cores.
IMPORT_EXPORT_VMM VOID	VmFuncEnableMtfAndChangeExternalInterruptState (UINT32 CoreId)
	Enables MTF and adjust external interrupt state.
IMPORT_EXPORT_VMM VOID	VmFuncEnableAndCheckForPreviousExternalInterrupts (UINT32 CoreId)
	Checks to enable and reinject previous interrupts.
IMPORT_EXPORT_VMM UINT16	VmFuncGetCsSelector ()
	Read CS selector.
IMPORT_EXPORT_VMM UINT32	VmFuncReadExceptionBitmap ()
	Read exception bitmap in VMCS.
IMPORT_EXPORT_VMM UINT64	VmFuncGetLastVmexitRip (UINT32 CoreId)
	get the last vm-exit RIP
IMPORT_EXPORT_VMM UINT64	VmFuncGetRflags ()
	Read guest's RFLAGS.
IMPORT_EXPORT_VMM UINT64	VmFuncGetRip ()
	Read guest's RIP.
IMPORT_EXPORT_VMM UINT64	VmFuncGetInterruptibilityState ()
	Read guest's interruptibility state.
IMPORT_EXPORT_VMM UINT64	VmFuncClearSteppingBits (UINT64 Interruptibility)
	Clear STI and MOV SS bits.
IMPORT_EXPORT_VMM BOOLEAN	VmFuncInitVmm (VMM_CALLBACKS *VmmCallbacks)
	Initializes hypervisor.
IMPORT_EXPORT_VMM UINT32	VmFuncVmxCompatibleStrlen (const CHAR *s)
	VMX-root compatible strlen.
IMPORT_EXPORT_VMM UINT32	VmFuncVmxCompatibleWcslen (const wchar_t *s)
	VMX-root compatible strlen.
IMPORT_EXPORT_VMM BOOLEAN	VmFuncNmiBroadcastRequest (UINT32 CoreId)
	Broadcast NMI requests.
IMPORT_EXPORT_VMM BOOLEAN	VmFuncNmiBroadcastInvalidateEptSingleContext (UINT32 CoreId)
	Broadcast NMI requests for single-context EPT invalidation.
IMPORT_EXPORT_VMM BOOLEAN	VmFuncNmiBroadcastInvalidateEptAllContexts (UINT32 CoreId)
	Broadcast NMI requests for all contexts EPT invalidation.
IMPORT_EXPORT_VMM BOOLEAN	VmFuncVmxGetCurrentExecutionMode ()
	Get the current VMX operation state.
IMPORT_EXPORT_VMM BOOLEAN	VmFuncQueryModeExecTrap ()
	Get the current state of mode exec trap mechanism.
IMPORT_EXPORT_VMM INT32	VmFuncVmxCompatibleStrcmp (const CHAR *Address1, const CHAR *Address2)
	VMX-root compatible strcmp.
IMPORT_EXPORT_VMM INT32	VmFuncVmxCompatibleStrncmp (const CHAR *Address1, const CHAR *Address2, SIZE_T Num)
	VMX-root compatible strncmp.
IMPORT_EXPORT_VMM INT32	VmFuncVmxCompatibleWcscmp (const wchar_t *Address1, const wchar_t *Address2)
	VMX-root compatible wcscmp.
IMPORT_EXPORT_VMM INT32	VmFuncVmxCompatibleWcsncmp (const wchar_t *Address1, const wchar_t *Address2, SIZE_T Num)
	VMX-root compatible wcsncmp.
IMPORT_EXPORT_VMM INT32	VmFuncVmxCompatibleMemcmp (const CHAR *Address1, const CHAR *Address2, size_t Count)
	VMX-root compatible memcmp.
IMPORT_EXPORT_VMM VOID	ConfigureEnableMovToCr3ExitingOnAllProcessors ()
	routines for debugging threads (enable mov-to-cr3 exiting)
IMPORT_EXPORT_VMM VOID	ConfigureDisableMovToCr3ExitingOnAllProcessors ()
	routines for debugging threads (disable mov-to-cr3 exiting)
IMPORT_EXPORT_VMM VOID	ConfigureEnableEferSyscallEventsOnAllProcessors ()
	routines for enabling syscall hooks on all cores
IMPORT_EXPORT_VMM VOID	ConfigureDisableEferSyscallEventsOnAllProcessors ()
	routines for disabling syscall hooks on all cores
IMPORT_EXPORT_VMM VOID	ConfigureSetExternalInterruptExitingOnSingleCore (UINT32 TargetCoreId)
	set external interrupt exiting on a single core
IMPORT_EXPORT_VMM VOID	ConfigureEnableRdtscExitingOnSingleCore (UINT32 TargetCoreId)
	enable RDTSC exiting on a single core
IMPORT_EXPORT_VMM VOID	ConfigureEnableRdpmcExitingOnSingleCore (UINT32 TargetCoreId)
	enable RDPMC exiting on a single core
IMPORT_EXPORT_VMM VOID	ConfigureEnableMovToDebugRegistersExitingOnSingleCore (UINT32 TargetCoreId)
	enable mov 2 debug register exiting on a single core
IMPORT_EXPORT_VMM VOID	ConfigureSetExceptionBitmapOnSingleCore (UINT32 TargetCoreId, UINT32 BitMask)
	set exception bitmap on a single core
IMPORT_EXPORT_VMM VOID	ConfigureEnableMovToControlRegisterExitingOnSingleCore (UINT32 TargetCoreId, DEBUGGER_EVENT_OPTIONS *BroadcastingOption)
	enable mov 2 control register on a single core
IMPORT_EXPORT_VMM VOID	ConfigureChangeMsrBitmapWriteOnSingleCore (UINT32 TargetCoreId, UINT64 MsrMask)
	change the mask of msr bitmaps for write on a single core
IMPORT_EXPORT_VMM VOID	ConfigureChangeMsrBitmapReadOnSingleCore (UINT32 TargetCoreId, UINT64 MsrMask)
	change the mask of msr bitmaps for read on a single core
IMPORT_EXPORT_VMM VOID	ConfigureChangeIoBitmapOnSingleCore (UINT32 TargetCoreId, UINT64 Port)
	change I/O port bitmap on a single core
IMPORT_EXPORT_VMM VOID	ConfigureEnableEferSyscallHookOnSingleCore (UINT32 TargetCoreId)
	routines for enabling EFER syscall hooks on a single core
IMPORT_EXPORT_VMM VOID	ConfigureSetEferSyscallOrSysretHookType (DEBUGGER_EVENT_SYSCALL_SYSRET_TYPE SyscallHookType)
	routines for setting EFER syscall or sysret hooks type
IMPORT_EXPORT_VMM VOID	ConfigureDirtyLoggingInitializeOnAllProcessors ()
	routines for initializing dirty logging mechanism
IMPORT_EXPORT_VMM VOID	ConfigureDirtyLoggingUninitializeOnAllProcessors ()
	routines for uninitializing dirty logging mechanism
IMPORT_EXPORT_VMM VOID	ConfigureModeBasedExecHookUninitializeOnAllProcessors ()
	routines for initializing Mode-based execution hooks
IMPORT_EXPORT_VMM VOID	ConfigureUninitializeExecTrapOnAllProcessors ()
	routines for uninitializing user-mode, kernel-mode exec trap
IMPORT_EXPORT_VMM BOOLEAN	ConfigureInitializeExecTrapOnAllProcessors ()
	routines for initializing user-mode, kernel-mode exec trap
IMPORT_EXPORT_VMM BOOLEAN	ConfigureEptHook (PVOID TargetAddress, UINT32 ProcessId)
	This function invokes a VMCALL to set the hook and broadcast the exiting for the breakpoints on exception bitmap.
IMPORT_EXPORT_VMM BOOLEAN	ConfigureEptHookFromVmxRoot (PVOID TargetAddress)
	This function invokes a direct VMCALL to setup the hook.
IMPORT_EXPORT_VMM BOOLEAN	ConfigureEptHook2 (UINT32 CoreId, PVOID TargetAddress, PVOID HookFunction, UINT32 ProcessId)
	This function allocates a buffer in VMX Non Root Mode and then invokes a VMCALL to set the hook (inline)
IMPORT_EXPORT_VMM BOOLEAN	ConfigureEptHook2FromVmxRoot (UINT32 CoreId, PVOID TargetAddress, PVOID HookFunction)
	This function allocates a buffer in VMX Non Root Mode and then invokes a VMCALL to set the hook (inline EPT hook)
IMPORT_EXPORT_VMM BOOLEAN	ConfigureEptHookMonitor (UINT32 CoreId, EPT_HOOKS_ADDRESS_DETAILS_FOR_MEMORY_MONITOR *HookingDetails, UINT32 ProcessId)
	This function allocates a buffer in VMX Non Root Mode and then invokes a VMCALL to set the hook.
IMPORT_EXPORT_VMM BOOLEAN	ConfigureEptHookMonitorFromVmxRoot (UINT32 CoreId, EPT_HOOKS_ADDRESS_DETAILS_FOR_MEMORY_MONITOR *MemoryAddressDetails)
	This function allocates a buffer in VMX Non Root Mode and then invokes a VMCALL to set the hook.
IMPORT_EXPORT_VMM BOOLEAN	ConfigureEptHookModifyInstructionFetchState (UINT32 CoreId, PVOID PhysicalAddress, BOOLEAN IsUnset)
	Change PML EPT state for execution (execute) @detail should be called from VMX-root.
IMPORT_EXPORT_VMM BOOLEAN	ConfigureEptHookModifyPageReadState (UINT32 CoreId, PVOID PhysicalAddress, BOOLEAN IsUnset)
	Change PML EPT state for read @detail should be called from VMX-root.
IMPORT_EXPORT_VMM BOOLEAN	ConfigureEptHookModifyPageWriteState (UINT32 CoreId, PVOID PhysicalAddress, BOOLEAN IsUnset)
	Change PML EPT state for write @detail should be called from VMX-root.
IMPORT_EXPORT_VMM BOOLEAN	ConfigureEptHookUnHookAllByHookingTag (UINT64 HookingTag)
	Remove all hooks from the hooked pages list using Hooking Tag.
IMPORT_EXPORT_VMM BOOLEAN	ConfigureEptHookUnHookSingleHookByHookingTagFromVmxRoot (UINT64 HookingTag, EPT_SINGLE_HOOK_UNHOOKING_DETAILS *TargetUnhookingDetails)
	Remove single hook from the hooked pages by the given hooking tag.
IMPORT_EXPORT_VMM BOOLEAN	ConfigureEptHookUnHookSingleAddress (UINT64 VirtualAddress, UINT64 PhysAddress, UINT32 ProcessId)
	Remove single hook from the hooked pages list and invalidate TLB.
IMPORT_EXPORT_VMM BOOLEAN	ConfigureEptHookUnHookSingleAddressFromVmxRoot (UINT64 VirtualAddress, UINT64 PhysAddress, EPT_SINGLE_HOOK_UNHOOKING_DETAILS *TargetUnhookingDetails)
	Remove single hook from the hooked pages list and invalidate TLB.
IMPORT_EXPORT_VMM VOID	ConfigureEptHookAllocateExtraHookingPagesForMemoryMonitorsAndExecEptHooks (UINT32 Count)
	Allocate (reserve) extra pages for storing details of page hooks for memory monitor and regular hidden breakpoit exec EPT hooks.
IMPORT_EXPORT_VMM VOID	ConfigureEptHookReservePreallocatedPoolsForEptHooks (UINT32 Count)
	Allocate (reserve) pages for storing EPT hooks page hooks.
IMPORT_EXPORT_VMM BOOLEAN	ConfigureExecTrapAddProcessToWatchingList (UINT32 ProcessId)
	Add the target process to the watching list.
IMPORT_EXPORT_VMM BOOLEAN	ConfigureExecTrapRemoveProcessFromWatchingList (UINT32 ProcessId)
	Remove the target process from the watching list.
IMPORT_EXPORT_VMM NTSTATUS	DirectVmcallTest (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for test direct VMCALL
IMPORT_EXPORT_VMM NTSTATUS	DirectVmcallPerformVmcall (UINT32 CoreId, UINT64 VmcallNumber, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for performing a direct VMCALL
IMPORT_EXPORT_VMM NTSTATUS	DirectVmcallChangeMsrBitmapRead (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for changing MSR Bitmap (Read)
IMPORT_EXPORT_VMM NTSTATUS	DirectVmcallChangeMsrBitmapWrite (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for changing MSR Bitmap (Write)
IMPORT_EXPORT_VMM NTSTATUS	DirectVmcallChangeIoBitmap (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for changing IO Bitmap
IMPORT_EXPORT_VMM NTSTATUS	DirectVmcallEnableRdpmcExiting (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for enabling rdpmc exiting
IMPORT_EXPORT_VMM NTSTATUS	DirectVmcallEnableRdtscpExiting (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for enabling rdtsc/rdtscp exiting
IMPORT_EXPORT_VMM NTSTATUS	DirectVmcallEnableMov2DebugRegsExiting (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for enabling mov to debug registers exiting
IMPORT_EXPORT_VMM NTSTATUS	DirectVmcallSetExceptionBitmap (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for setting exception bitmap
IMPORT_EXPORT_VMM NTSTATUS	DirectVmcallEnableExternalInterruptExiting (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for enabling external interrupt exiting
IMPORT_EXPORT_VMM NTSTATUS	DirectVmcallEnableMovToCrExiting (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for enabling mov to CR exiting
IMPORT_EXPORT_VMM NTSTATUS	DirectVmcallEnableEferSyscall (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for enabling syscall hook using EFER SCE bit
IMPORT_EXPORT_VMM NTSTATUS	DirectVmcallSetHiddenBreakpointHook (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for putting hidden breakpoints (using EPT)
IMPORT_EXPORT_VMM NTSTATUS	DirectVmcallInvalidateEptAllContexts (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for invalidating EPT (All Contexts)
IMPORT_EXPORT_VMM NTSTATUS	DirectVmcallInvalidateSingleContext (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for invalidating EPT (A Single Context)
IMPORT_EXPORT_VMM NTSTATUS	DirectVmcallUnsetExceptionBitmap (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for unsetting exception bitmap on VMCS
IMPORT_EXPORT_VMM NTSTATUS	DirectVmcallUnhookSinglePage (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for restoring a single EPT entry and invalidating EPT cache
IMPORT_EXPORT_VMM NTSTATUS	DirectVmcallSetDisableExternalInterruptExitingOnlyOnClearingInterruptEvents (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for disabling external interrupt exiting only to clear !interrupt commands
IMPORT_EXPORT_VMM NTSTATUS	DirectVmcallResetMsrBitmapRead (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for resetting MSR Bitmap Read
IMPORT_EXPORT_VMM NTSTATUS	DirectVmcallResetMsrBitmapWrite (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for resetting MSR Bitmap Write
IMPORT_EXPORT_VMM NTSTATUS	DirectVmcallResetExceptionBitmapOnlyOnClearingExceptionEvents (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for resetting exception bitmap on VMCS
IMPORT_EXPORT_VMM NTSTATUS	DirectVmcallResetIoBitmap (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for resetting I/O Bitmaps (A & B)
IMPORT_EXPORT_VMM NTSTATUS	DirectVmcallDisableRdtscExitingForClearingTscEvents (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for clearing rdtsc exiting bit ONLY in the case of disabling the events for !tsc command
IMPORT_EXPORT_VMM NTSTATUS	DirectVmcallDisableRdpmcExiting (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for disabling rdpmc exiting in primary cpu-based controls
IMPORT_EXPORT_VMM NTSTATUS	DirectVmcallDisableEferSyscallEvents (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for disabling syscall hook using EFER SCE bit
IMPORT_EXPORT_VMM NTSTATUS	DirectVmcallDisableMov2DrExitingForClearingDrEvents (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for clearing mov 2 hw dr exiting bit ONLY in the case of disabling the events for !dr command
IMPORT_EXPORT_VMM NTSTATUS	DirectVmcallDisableMov2CrExitingForClearingCrEvents (UINT32 CoreId, DIRECT_VMCALL_PARAMETERS *DirectVmcallOptions)
	routines for clearing mov 2 cr exiting bit ONLY in the case of disabling the events for !crwrite command
IMPORT_EXPORT_VMM BOOLEAN	DisassemblerShowInstructionsInVmxNonRootMode (PVOID Address, UINT32 Length, BOOLEAN Is32Bit)
	Disassembler show the instructions.
IMPORT_EXPORT_VMM BOOLEAN	DisassemblerShowOneInstructionInVmxNonRootMode (PVOID Address, UINT64 ActualRip, BOOLEAN Is32Bit)
	Disassembler show only one instruction.
IMPORT_EXPORT_VMM UINT32	DisassemblerShowOneInstructionInVmxRootMode (PVOID Address, BOOLEAN Is32Bit)
	Shows the disassembly of only one instruction.
IMPORT_EXPORT_VMM UINT64	VirtualAddressToPhysicalAddress (_In_ PVOID VirtualAddress)
	Converts Virtual Address to Physical Address.
IMPORT_EXPORT_VMM UINT64	VirtualAddressToPhysicalAddressByProcessId (_In_ PVOID VirtualAddress, _In_ UINT32 ProcessId)
IMPORT_EXPORT_VMM UINT64	VirtualAddressToPhysicalAddressByProcessCr3 (_In_ PVOID VirtualAddress, _In_ CR3_TYPE TargetCr3)
IMPORT_EXPORT_VMM UINT64	VirtualAddressToPhysicalAddressOnTargetProcess (_In_ PVOID VirtualAddress)
IMPORT_EXPORT_VMM UINT64	PhysicalAddressToVirtualAddress (_In_ UINT64 PhysicalAddress)
IMPORT_EXPORT_VMM UINT64	PhysicalAddressToVirtualAddressByProcessId (_In_ PVOID PhysicalAddress, _In_ UINT32 ProcessId)
IMPORT_EXPORT_VMM UINT64	PhysicalAddressToVirtualAddressByCr3 (_In_ PVOID PhysicalAddress, _In_ CR3_TYPE TargetCr3)
IMPORT_EXPORT_VMM UINT64	PhysicalAddressToVirtualAddressOnTargetProcess (_In_ PVOID PhysicalAddress)
IMPORT_EXPORT_VMM CR3_TYPE	SwitchToProcessMemoryLayout (_In_ UINT32 ProcessId)
IMPORT_EXPORT_VMM CR3_TYPE	SwitchToCurrentProcessMemoryLayout ()
	Switch to guest's running process's cr3.
IMPORT_EXPORT_VMM CR3_TYPE	SwitchToProcessMemoryLayoutByCr3 (_In_ CR3_TYPE TargetCr3)
IMPORT_EXPORT_VMM VOID	SwitchToPreviousProcess (_In_ CR3_TYPE PreviousProcess)
IMPORT_EXPORT_VMM BOOLEAN	CheckAddressValidityUsingTsx (CHAR *Address)
	This function checks whether the address is valid or not using Intel TSX.
IMPORT_EXPORT_VMM BOOLEAN	CheckAccessValidityAndSafety (UINT64 TargetAddress, UINT32 Size)
	Check the safety to access the memory.
IMPORT_EXPORT_VMM BOOLEAN	CheckAddressPhysical (UINT64 PAddr)
	Checks if the physical address is correct or not based on physical address width.
IMPORT_EXPORT_VMM UINT32	CheckAddressMaximumInstructionLength (PVOID Address)
	This function returns the maximum instruction length that can be read from this address.
IMPORT_EXPORT_VMM CR3_TYPE	LayoutGetCurrentProcessCr3 ()
	Get cr3 of the target running process.
IMPORT_EXPORT_VMM CR3_TYPE	LayoutGetExactGuestProcessCr3 ()
	Get cr3 of the target running process.
IMPORT_EXPORT_VMM PVOID	MemoryMapperGetPteVa (_In_ PVOID Va, _In_ PAGING_LEVEL Level)
IMPORT_EXPORT_VMM PVOID	MemoryMapperGetPteVaByCr3 (_In_ PVOID Va, _In_ PAGING_LEVEL Level, _In_ CR3_TYPE TargetCr3)
IMPORT_EXPORT_VMM PVOID	MemoryMapperGetPteVaWithoutSwitchingByCr3 (_In_ PVOID Va, _In_ PAGING_LEVEL Level, _In_ CR3_TYPE TargetCr3)
IMPORT_EXPORT_VMM PVOID	MemoryMapperGetPteVaOnTargetProcess (_In_ PVOID Va, _In_ PAGING_LEVEL Level)
IMPORT_EXPORT_VMM PVOID	MemoryMapperSetExecuteDisableToPteOnTargetProcess (_In_ PVOID Va, _In_ BOOLEAN Set)
IMPORT_EXPORT_VMM BOOLEAN	MemoryMapperCheckPteIsPresentOnTargetProcess (PVOID Va, PAGING_LEVEL Level)
	This function checks whether the virtual address is present in the RAM or not.
IMPORT_EXPORT_VMM BOOLEAN	MemoryMapperReadMemorySafe (_In_ UINT64 VaAddressToRead, _Inout_ PVOID BufferToSaveMemory, _In_ SIZE_T SizeToRead)
IMPORT_EXPORT_VMM BOOLEAN	MemoryMapperReadMemorySafeByPhysicalAddress (_In_ UINT64 PaAddressToRead, _Inout_ UINT64 BufferToSaveMemory, _In_ SIZE_T SizeToRead)
IMPORT_EXPORT_VMM BOOLEAN	MemoryMapperReadMemorySafeOnTargetProcess (_In_ UINT64 VaAddressToRead, _Inout_ PVOID BufferToSaveMemory, _In_ SIZE_T SizeToRead)
IMPORT_EXPORT_VMM UINT32	DisassemblerLengthDisassembleEngine (PVOID Address, BOOLEAN Is32Bit)
	Disassembler length disassemble engine.
IMPORT_EXPORT_VMM UINT32	DisassemblerLengthDisassembleEngineInVmxRootOnTargetProcess (PVOID Address, BOOLEAN Is32Bit)
	Disassembler length disassembler engine.
IMPORT_EXPORT_VMM BOOLEAN	MemoryMapperWriteMemorySafe (_Inout_ UINT64 Destination, _In_ PVOID Source, _In_ SIZE_T SizeToWrite, _In_ CR3_TYPE TargetProcessCr3)
IMPORT_EXPORT_VMM BOOLEAN	MemoryMapperWriteMemorySafeOnTargetProcess (_Inout_ UINT64 Destination, _In_ PVOID Source, _In_ SIZE_T Size)
IMPORT_EXPORT_VMM BOOLEAN	MemoryMapperWriteMemorySafeByPhysicalAddress (_Inout_ UINT64 DestinationPa, _In_ UINT64 Source, _In_ SIZE_T SizeToWrite)
IMPORT_EXPORT_VMM BOOLEAN	MemoryMapperWriteMemoryUnsafe (_Inout_ UINT64 Destination, _In_ PVOID Source, _In_ SIZE_T SizeToWrite, _In_ UINT32 TargetProcessId)
IMPORT_EXPORT_VMM UINT64	MemoryMapperReserveUsermodeAddressOnTargetProcess (_In_ UINT32 ProcessId, _In_ BOOLEAN Allocate)
IMPORT_EXPORT_VMM BOOLEAN	MemoryMapperFreeMemoryOnTargetProcess (_In_ UINT32 ProcessId, _Inout_ PVOID BaseAddress)
IMPORT_EXPORT_VMM BOOLEAN	MemoryMapperSetSupervisorBitWithoutSwitchingByCr3 (_In_ PVOID Va, _In_ BOOLEAN Set, _In_ PAGING_LEVEL Level, _In_ CR3_TYPE TargetCr3)
IMPORT_EXPORT_VMM BOOLEAN	MemoryMapperCheckIfPageIsNxBitSetOnTargetProcess (_In_ PVOID Va)
IMPORT_EXPORT_VMM BOOLEAN	MemoryMapperCheckIfPdeIsLargePageOnTargetProcess (_In_ PVOID Va)
IMPORT_EXPORT_VMM BOOLEAN	MemoryManagerReadProcessMemoryNormal (HANDLE PID, PVOID Address, DEBUGGER_READ_MEMORY_TYPE MemType, PVOID UserBuffer, SIZE_T Size, PSIZE_T ReturnSize)
	Read process memory.
IMPORT_EXPORT_VMM BOOLEAN	PoolManagerCheckAndPerformAllocationAndDeallocation ()
	This function performs allocations from VMX non-root based on g_RequestNewAllocation.
IMPORT_EXPORT_VMM BOOLEAN	PoolManagerRequestAllocation (SIZE_T Size, UINT32 Count, POOL_ALLOCATION_INTENTION Intention)
	Request to allocate new buffers.
IMPORT_EXPORT_VMM UINT64	PoolManagerRequestPool (POOL_ALLOCATION_INTENTION Intention, BOOLEAN RequestNewPool, UINT32 Size)
	This function should be called from vmx-root in order to get a pool from the list.
IMPORT_EXPORT_VMM BOOLEAN	PoolManagerFreePool (UINT64 AddressToFree)
	This function set a pool flag to be freed, and it will be freed on the next IOCTL when it's safe to remove.
IMPORT_EXPORT_VMM VOID	PoolManagerShowPreAllocatedPools ()
	Shows list of pre-allocated pools available (used for debugging purposes)
IMPORT_EXPORT_VMM VOID	SetGuestCsSel (PVMX_SEGMENT_SELECTOR Cs)
	Set just the Guest Cs selector.
IMPORT_EXPORT_VMM VOID	SetGuestCs (PVMX_SEGMENT_SELECTOR Cs)
	Set the Guest Cs.
IMPORT_EXPORT_VMM VMX_SEGMENT_SELECTOR	GetGuestCs ()
	Get the Guest Cs Selector.
IMPORT_EXPORT_VMM VOID	SetGuestSsSel (PVMX_SEGMENT_SELECTOR Ss)
	Set just the Guest Ss selector.
IMPORT_EXPORT_VMM VOID	SetGuestSs (PVMX_SEGMENT_SELECTOR Ss)
	Set the Guest Ss selector.
IMPORT_EXPORT_VMM VMX_SEGMENT_SELECTOR	GetGuestSs ()
	Get the Guest Ss Selector.
IMPORT_EXPORT_VMM VOID	SetGuestDsSel (PVMX_SEGMENT_SELECTOR Ds)
	Set just the Guest Ds selector.
IMPORT_EXPORT_VMM VOID	SetGuestDs (PVMX_SEGMENT_SELECTOR Ds)
	Set the Guest Ds selector.
IMPORT_EXPORT_VMM VMX_SEGMENT_SELECTOR	GetGuestDs ()
	Get the Guest Ds Selector.
IMPORT_EXPORT_VMM VOID	SetGuestFsSel (PVMX_SEGMENT_SELECTOR Fs)
	Set just the Guest Fs selector.
IMPORT_EXPORT_VMM VOID	SetGuestFs (PVMX_SEGMENT_SELECTOR Fs)
	Set the Guest Fs selector.
IMPORT_EXPORT_VMM VMX_SEGMENT_SELECTOR	GetGuestFs ()
	Get the Guest Fs Selector.
IMPORT_EXPORT_VMM VOID	SetGuestGsSel (PVMX_SEGMENT_SELECTOR Gs)
	Set just the Guest Gs selector.
IMPORT_EXPORT_VMM VOID	SetGuestGs (PVMX_SEGMENT_SELECTOR Gs)
	Set the Guest Gs selector.
IMPORT_EXPORT_VMM VMX_SEGMENT_SELECTOR	GetGuestGs ()
	Get the Guest Gs Selector.
IMPORT_EXPORT_VMM VOID	SetGuestEsSel (PVMX_SEGMENT_SELECTOR Es)
	Set just the Guest Es selector.
IMPORT_EXPORT_VMM VOID	SetGuestEs (PVMX_SEGMENT_SELECTOR Es)
	Set the Guest Es selector.
IMPORT_EXPORT_VMM VMX_SEGMENT_SELECTOR	GetGuestEs ()
	Get the Guest Es Selector.
IMPORT_EXPORT_VMM VOID	SetGuestIdtr (UINT64 Idtr)
	Set the Guest Idtr.
IMPORT_EXPORT_VMM UINT64	GetGuestIdtr ()
	Get the Guest Idtr.
IMPORT_EXPORT_VMM VOID	SetGuestLdtr (UINT64 Ldtr)
	Set the Guest Ldtr.
IMPORT_EXPORT_VMM UINT64	GetGuestLdtr ()
	Get the Guest Ldtr.
IMPORT_EXPORT_VMM VOID	SetGuestGdtr (UINT64 Gdtr)
	Set the Guest Gdtr.
IMPORT_EXPORT_VMM UINT64	GetGuestGdtr ()
	Get the Guest Gdtr.
IMPORT_EXPORT_VMM VOID	SetGuestTr (UINT64 Tr)
IMPORT_EXPORT_VMM UINT64	GetGuestTr ()
	Get the Guest Tr.
IMPORT_EXPORT_VMM VOID	SetGuestRFlags (UINT64 RFlags)
	Set the Guest RFLAGS Register.
IMPORT_EXPORT_VMM UINT64	GetGuestRFlags ()
	Get the Guest Rflags value.
IMPORT_EXPORT_VMM VOID	SetGuestRIP (UINT64 RIP)
	Set the Guest RIP Register.
IMPORT_EXPORT_VMM VOID	SetGuestRSP (UINT64 RSP)
	Set the Guest RSP Register.
IMPORT_EXPORT_VMM UINT64	GetGuestRIP ()
	Get the Guest RIP value.
IMPORT_EXPORT_VMM UINT64	GetGuestCr0 ()
	Get the Guest Cr0 value.
IMPORT_EXPORT_VMM UINT64	GetGuestCr2 ()
	Get the Guest Cr2 value.
IMPORT_EXPORT_VMM UINT64	GetGuestCr3 ()
	Get the Guest Cr3 value.
IMPORT_EXPORT_VMM UINT64	GetGuestCr4 ()
	Get the Guest Cr4 value.
IMPORT_EXPORT_VMM UINT64	GetGuestCr8 ()
	Get the Guest Cr8 value.
IMPORT_EXPORT_VMM VOID	SetGuestCr0 (UINT64 Cr0)
	Set the Guest Cr0 Register.
IMPORT_EXPORT_VMM VOID	SetGuestCr2 (UINT64 Cr2)
	Set the Guest Cr2 Register.
IMPORT_EXPORT_VMM VOID	SetGuestCr3 (UINT64 Cr3)
	Set the Guest Cr3 Register.
IMPORT_EXPORT_VMM VOID	SetGuestCr4 (UINT64 Cr4)
	Set the Guest Cr4 Register.
IMPORT_EXPORT_VMM VOID	SetGuestCr8 (UINT64 Cr8)
	Set the Guest Cr8 Register.
IMPORT_EXPORT_VMM UINT64	GetGuestDr0 ()
	Get the Guest Dr0 value.
IMPORT_EXPORT_VMM UINT64	GetGuestDr1 ()
	Get the Guest Dr1 value.
IMPORT_EXPORT_VMM UINT64	GetGuestDr2 ()
	Get the Guest Dr2 value.
IMPORT_EXPORT_VMM UINT64	GetGuestDr3 ()
	Get the Guest Dr3 value.
IMPORT_EXPORT_VMM UINT64	GetGuestDr6 ()
	Get the Guest Dr6 (breakpoint status) value.
IMPORT_EXPORT_VMM UINT64	GetGuestDr7 ()
	Get the Guest Dr7 (breakpoint trigger) value.
IMPORT_EXPORT_VMM VOID	SetGuestDr0 (UINT64 value)
	Set the Guest Dr0 Register.
IMPORT_EXPORT_VMM VOID	SetGuestDr1 (UINT64 value)
	Set the Guest Dr1 Register.
IMPORT_EXPORT_VMM VOID	SetGuestDr2 (UINT64 value)
	Set the Guest Dr2 Register.
IMPORT_EXPORT_VMM VOID	SetGuestDr3 (UINT64 value)
	Set the Guest Dr3 Register.
IMPORT_EXPORT_VMM VOID	SetGuestDr6 (UINT64 value)
	Set the Guest Dr6 Register.
IMPORT_EXPORT_VMM VOID	SetGuestDr7 (UINT64 value)
	Set the Guest Dr7 Register.
IMPORT_EXPORT_VMM BOOLEAN	SetDebugRegisters (UINT32 DebugRegNum, DEBUG_REGISTER_TYPE ActionType, BOOLEAN ApplyToVmcs, UINT64 TargetAddress)
	Configure hardware debug register for access, write and fetch breakpoints.
IMPORT_EXPORT_VMM NTSTATUS	TransparentHideDebugger (PDEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE Measurements)
	Hide debugger on transparent-mode (activate transparent-mode)
IMPORT_EXPORT_VMM NTSTATUS	TransparentUnhideDebugger ()
	Deactivate transparent-mode.
IMPORT_EXPORT_VMM VOID	BroadcastEnableBreakpointExitingOnExceptionBitmapAllCores ()
	routines to enable vm-exit for breakpoints (exception bitmap)
IMPORT_EXPORT_VMM VOID	BroadcastDisableBreakpointExitingOnExceptionBitmapAllCores ()
	routines to disable vm-exit for breakpoints (exception bitmap)
IMPORT_EXPORT_VMM VOID	BroadcastEnableDbAndBpExitingAllCores ()
	routines to set vm-exit on all #DBs and #BP on all cores
IMPORT_EXPORT_VMM VOID	BroadcastDisableDbAndBpExitingAllCores ()
	routines to unset vm-exit on all #DBs and #BP on all cores
IMPORT_EXPORT_VMM VOID	BroadcastEnableRdtscExitingAllCores ()
	a broadcast that causes vm-exit on all execution of rdtsc/rdtscp
IMPORT_EXPORT_VMM VOID	BroadcastDisableRdtscExitingAllCores ()
	a broadcast that causes for disabling rdtsc/p exiting
IMPORT_EXPORT_VMM VOID	BroadcastChangeAllMsrBitmapReadAllCores (UINT64 BitmapMask)
	routines for !msrread command which
IMPORT_EXPORT_VMM VOID	BroadcastResetChangeAllMsrBitmapReadAllCores ()
	routines for disable (reset) !msrread command
IMPORT_EXPORT_VMM VOID	BroadcastChangeAllMsrBitmapWriteAllCores (UINT64 BitmapMask)
	routines for !msrwrite command which
IMPORT_EXPORT_VMM VOID	BroadcastResetAllMsrBitmapWriteAllCores ()
	routines for reset !msrwrite command which
IMPORT_EXPORT_VMM VOID	BroadcastDisableRdtscExitingForClearingEventsAllCores ()
	routines ONLY for disabling !tsc command
IMPORT_EXPORT_VMM VOID	BroadcastDisableMov2ControlRegsExitingForClearingEventsAllCores (PDEBUGGER_EVENT_OPTIONS BroadcastingOption)
	routines ONLY for disabling !crwrite command
IMPORT_EXPORT_VMM VOID	BroadcastDisableMov2DebugRegsExitingForClearingEventsAllCores ()
	routines ONLY for disabling !dr command
IMPORT_EXPORT_VMM VOID	BroadcastEnableRdpmcExitingAllCores ()
	routines for !pmc
IMPORT_EXPORT_VMM VOID	BroadcastDisableRdpmcExitingAllCores ()
	routines for disabling !pmc
IMPORT_EXPORT_VMM VOID	BroadcastSetExceptionBitmapAllCores (UINT64 ExceptionIndex)
	routines for !exception command which
IMPORT_EXPORT_VMM VOID	BroadcastUnsetExceptionBitmapAllCores (UINT64 ExceptionIndex)
	routines for disabling exception bitmap
IMPORT_EXPORT_VMM VOID	BroadcastResetExceptionBitmapAllCores ()
	routines for reset !exception command
IMPORT_EXPORT_VMM VOID	BroadcastEnableMovControlRegisterExitingAllCores (PDEBUGGER_EVENT_OPTIONS BroadcastingOption)
	routines for !crwrite
IMPORT_EXPORT_VMM VOID	BroadcastDisableMovToControlRegistersExitingAllCores (PDEBUGGER_EVENT_OPTIONS BroadcastingOption)
	routines for disabling !crwrite
IMPORT_EXPORT_VMM VOID	BroadcastEnableMovDebugRegistersExitingAllCores ()
	routines for !dr
IMPORT_EXPORT_VMM VOID	BroadcastDisableMovDebugRegistersExitingAllCores ()
	routines for disabling !dr
IMPORT_EXPORT_VMM VOID	BroadcastSetExternalInterruptExitingAllCores ()
	routines for !interrupt command which
IMPORT_EXPORT_VMM VOID	BroadcastUnsetExternalInterruptExitingOnlyOnClearingInterruptEventsAllCores ()
	routines for ONLY terminate !interrupt command
IMPORT_EXPORT_VMM VOID	BroadcastIoBitmapChangeAllCores (UINT64 Port)
	routines for !ioin and !ioout command which
IMPORT_EXPORT_VMM VOID	BroadcastIoBitmapResetAllCores ()
	routines for reset !ioin and !ioout command
IMPORT_EXPORT_VMM VOID	BroadcastEnableMovToCr3ExitingOnAllProcessors ()
	routines for debugging threads (enable mov-to-cr3 exiting)
IMPORT_EXPORT_VMM VOID	BroadcastDisableMovToCr3ExitingOnAllProcessors ()
	routines for debugging threads (disable mov-to-cr3 exiting)
IMPORT_EXPORT_VMM VOID	BroadcastEnableEferSyscallEventsOnAllProcessors ()
	routines for enabling syscall hooks on all cores
IMPORT_EXPORT_VMM VOID	BroadcastDisableEferSyscallEventsOnAllProcessors ()
	routines for disabling syscall hooks on all cores

Detailed Description

Headers relating exported functions from hypervisor.

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.1

Date

2022-12-09

Copyright

This project is released under the GNU Public License v3.

Macro Definition Documentation

IMPORT_EXPORT_VMM

#define IMPORT_EXPORT_VMM   __declspec(dllimport)

Function Documentation

BroadcastChangeAllMsrBitmapReadAllCores()

IMPORT_EXPORT_VMM VOID BroadcastChangeAllMsrBitmapReadAllCores

(

UINT64

BitmapMask

)

routines for !msrread command which

causes vm-exit on all msr reads

Parameters

BitmapMask

Bit mask of msr to put on msr bitmap

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineChangeMsrBitmapReadOnAllCores, (PVOID)BitmapMask);
}

BroadcastChangeAllMsrBitmapWriteAllCores()

IMPORT_EXPORT_VMM VOID BroadcastChangeAllMsrBitmapWriteAllCores

(

UINT64

BitmapMask

)

routines for !msrwrite command which

causes vm-exit on all msr writes

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineChangeMsrBitmapWriteOnAllCores, (PVOID)BitmapMask);
}

BroadcastDisableBreakpointExitingOnExceptionBitmapAllCores()

IMPORT_EXPORT_VMM VOID BroadcastDisableBreakpointExitingOnExceptionBitmapAllCores

(

)

routines to disable vm-exit for breakpoints (exception bitmap)

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineDisableBreakpointOnExceptionBitmapOnAllCores, NULL);
}

BroadcastDisableDbAndBpExitingAllCores()

IMPORT_EXPORT_VMM VOID BroadcastDisableDbAndBpExitingAllCores

(

)

routines to unset vm-exit on all #DBs and #BP on all cores

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineDisableDbAndBpExitingOnAllCores, NULL);
}

BroadcastDisableEferSyscallEventsOnAllProcessors()

IMPORT_EXPORT_VMM VOID BroadcastDisableEferSyscallEventsOnAllProcessors

(

)

routines for disabling syscall hooks on all cores

Returns

VOID

{
    KeGenericCallDpc(DpcRoutineDisableEferSyscallEvents, 0x0);
}

BroadcastDisableMov2ControlRegsExitingForClearingEventsAllCores()

IMPORT_EXPORT_VMM VOID BroadcastDisableMov2ControlRegsExitingForClearingEventsAllCores

(

PDEBUGGER_EVENT_OPTIONS

BroadcastingOption

)

routines ONLY for disabling !crwrite command

Parameters

Event

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineDisableMov2CrExitingForClearingCrEventsAllCores, BroadcastingOption);
}

BroadcastDisableMov2DebugRegsExitingForClearingEventsAllCores()

IMPORT_EXPORT_VMM VOID BroadcastDisableMov2DebugRegsExitingForClearingEventsAllCores

(

)

routines ONLY for disabling !dr command

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineDisableMov2DrExitingForClearingDrEventsAllCores, NULL);
}

BroadcastDisableMovDebugRegistersExitingAllCores()

IMPORT_EXPORT_VMM VOID BroadcastDisableMovDebugRegistersExitingAllCores

(

)

routines for disabling !dr

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineDisableMovDebigRegisterExitingAllCores, NULL);
}

BroadcastDisableMovToControlRegistersExitingAllCores()

IMPORT_EXPORT_VMM VOID BroadcastDisableMovToControlRegistersExitingAllCores

(

PDEBUGGER_EVENT_OPTIONS

BroadcastingOption

)

routines for disabling !crwrite

Parameters

Event

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineDisableMovControlRegisterExitingAllCores, BroadcastingOption);
}

BroadcastDisableMovToCr3ExitingOnAllProcessors()

IMPORT_EXPORT_VMM VOID BroadcastDisableMovToCr3ExitingOnAllProcessors

(

)

routines for debugging threads (disable mov-to-cr3 exiting)

Returns

VOID

{
    KeGenericCallDpc(DpcRoutineDisableMovToCr3Exiting, 0x0);
}

BroadcastDisableRdpmcExitingAllCores()

IMPORT_EXPORT_VMM VOID BroadcastDisableRdpmcExitingAllCores

(

)

routines for disabling !pmc

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineDisableRdpmcExitingAllCores, NULL);
}

BroadcastDisableRdtscExitingAllCores()

IMPORT_EXPORT_VMM VOID BroadcastDisableRdtscExitingAllCores

(

)

a broadcast that causes for disabling rdtsc/p exiting

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineDisableRdtscExitingAllCores, NULL);
}

BroadcastDisableRdtscExitingForClearingEventsAllCores()

IMPORT_EXPORT_VMM VOID BroadcastDisableRdtscExitingForClearingEventsAllCores

(

)

routines ONLY for disabling !tsc command

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineDisableRdtscExitingForClearingTscEventsAllCores, NULL);
}

BroadcastEnableBreakpointExitingOnExceptionBitmapAllCores()

IMPORT_EXPORT_VMM VOID BroadcastEnableBreakpointExitingOnExceptionBitmapAllCores

(

)

routines to enable vm-exit for breakpoints (exception bitmap)

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineEnableBreakpointOnExceptionBitmapOnAllCores, NULL);
}

BroadcastEnableDbAndBpExitingAllCores()

IMPORT_EXPORT_VMM VOID BroadcastEnableDbAndBpExitingAllCores

(

)

routines to set vm-exit on all #DBs and #BP on all cores

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineEnableDbAndBpExitingOnAllCores, NULL);
}

BroadcastEnableEferSyscallEventsOnAllProcessors()

IMPORT_EXPORT_VMM VOID BroadcastEnableEferSyscallEventsOnAllProcessors

(

)

routines for enabling syscall hooks on all cores

Returns

VOID

{
    KeGenericCallDpc(DpcRoutineEnableEferSyscallEvents, 0x0);
}

BroadcastEnableMovControlRegisterExitingAllCores()

IMPORT_EXPORT_VMM VOID BroadcastEnableMovControlRegisterExitingAllCores

(

PDEBUGGER_EVENT_OPTIONS

BroadcastingOption

)

routines for !crwrite

causes vm-exit on all accesses to debug registers

Parameters

Event

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineEnableMovControlRegisterExitingAllCores, BroadcastingOption);
}

BroadcastEnableMovDebugRegistersExitingAllCores()

IMPORT_EXPORT_VMM VOID BroadcastEnableMovDebugRegistersExitingAllCores

(

)

routines for !dr

causes vm-exit on all accesses to debug registers

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineEnableMovDebigRegisterExitingAllCores, NULL);
}

BroadcastEnableMovToCr3ExitingOnAllProcessors()

IMPORT_EXPORT_VMM VOID BroadcastEnableMovToCr3ExitingOnAllProcessors

(

)

routines for debugging threads (enable mov-to-cr3 exiting)

Returns

VOID

{
    KeGenericCallDpc(DpcRoutineEnableMovToCr3Exiting, 0x0);
}

BroadcastEnableRdpmcExitingAllCores()

IMPORT_EXPORT_VMM VOID BroadcastEnableRdpmcExitingAllCores

(

)

routines for !pmc

causes vm-exit on all execution of rdpmc

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineEnableRdpmcExitingAllCores, NULL);
}

BroadcastEnableRdtscExitingAllCores()

IMPORT_EXPORT_VMM VOID BroadcastEnableRdtscExitingAllCores

(

)

a broadcast that causes vm-exit on all execution of rdtsc/rdtscp

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineEnableRdtscExitingAllCores, NULL);
}

BroadcastIoBitmapChangeAllCores()

IMPORT_EXPORT_VMM VOID BroadcastIoBitmapChangeAllCores

(

UINT64

Port

)

routines for !ioin and !ioout command which

causes vm-exit on all i/o instructions or one port

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineChangeIoBitmapOnAllCores, (PVOID)Port);
}

BroadcastIoBitmapResetAllCores()

IMPORT_EXPORT_VMM VOID BroadcastIoBitmapResetAllCores

(

)

routines for reset !ioin and !ioout command

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineResetIoBitmapOnAllCores, NULL);
}

BroadcastResetAllMsrBitmapWriteAllCores()

IMPORT_EXPORT_VMM VOID BroadcastResetAllMsrBitmapWriteAllCores

(

)

routines for reset !msrwrite command which

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineResetMsrBitmapWriteOnAllCores, NULL);
}

BroadcastResetChangeAllMsrBitmapReadAllCores()

IMPORT_EXPORT_VMM VOID BroadcastResetChangeAllMsrBitmapReadAllCores

(

)

routines for disable (reset) !msrread command

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineResetMsrBitmapReadOnAllCores, NULL);
}

BroadcastResetExceptionBitmapAllCores()

IMPORT_EXPORT_VMM VOID BroadcastResetExceptionBitmapAllCores

(

)

routines for reset !exception command

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineResetExceptionBitmapOnlyOnClearingExceptionEventsOnAllCores, NULL);
}

BroadcastSetExceptionBitmapAllCores()

IMPORT_EXPORT_VMM VOID BroadcastSetExceptionBitmapAllCores

(

UINT64

ExceptionIndex

)

routines for !exception command which

causes vm-exit when exception occurred

Parameters

ExceptionIndex

index of exception on IDT

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineSetExceptionBitmapOnAllCores, (PVOID)ExceptionIndex);
}

BroadcastSetExternalInterruptExitingAllCores()

IMPORT_EXPORT_VMM VOID BroadcastSetExternalInterruptExitingAllCores

(

)

routines for !interrupt command which

causes vm-exit when external interrupt occurs

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineSetEnableExternalInterruptExitingOnAllCores, NULL);
}

BroadcastUnsetExceptionBitmapAllCores()

IMPORT_EXPORT_VMM VOID BroadcastUnsetExceptionBitmapAllCores

(

UINT64

ExceptionIndex

)

routines for disabling exception bitmap

removes vm-exit when exception occurred

Parameters

ExceptionIndex

index of exception on IDT

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineUnsetExceptionBitmapOnAllCores, (PVOID)ExceptionIndex);
}

BroadcastUnsetExternalInterruptExitingOnlyOnClearingInterruptEventsAllCores()

IMPORT_EXPORT_VMM VOID BroadcastUnsetExternalInterruptExitingOnlyOnClearingInterruptEventsAllCores

(

)

routines for ONLY terminate !interrupt command

Returns

VOID

{
    //
    // Broadcast to all cores
    //
    KeGenericCallDpc(DpcRoutineSetDisableExternalInterruptExitingOnlyOnClearingInterruptEventsOnAllCores, NULL);
}

CheckAccessValidityAndSafety()

IMPORT_EXPORT_VMM BOOLEAN CheckAccessValidityAndSafety	(	UINT64	TargetAddress,
		UINT32	Size )

Check the safety to access the memory.

Parameters

TargetAddress
Size

Returns

BOOLEAN

{
    CR3_TYPE GuestCr3;
    UINT64   OriginalCr3;
    BOOLEAN  IsKernelAddress;
    BOOLEAN  Result = FALSE;
 
    //
    // First, we check if the address is canonical based
    // on Intel processor's virtual address width
    //
    if (!CheckAddressCanonicality(TargetAddress, &IsKernelAddress))
    {
        //
        // No need for further check, address is invalid
        //
        Result = FALSE;
        goto Return;
    }
 
    //
    // Find the current process cr3
    //
    GuestCr3.Flags = LayoutGetCurrentProcessCr3().Flags;
 
    //
    // Move to new cr3
    //
    OriginalCr3 = __readcr3();
    __writecr3(GuestCr3.Flags);
 
    //
    // We'll only check address with TSX if the address is a kernel-mode
    // address because an exception is thrown if we access user-mode code
    // from vmx-root mode, thus, TSX will fail the transaction and the
    // result is not true, so we check each pages' page-table for user-mode
    // codes in both user-mode and kernel-mode
    //
    // if (g_RtmSupport && IsKernelAddress)
    // {
    //     //
    //     // The guest supports Intel TSX
    //     //
    //     UINT64 AlignedPage = (UINT64)PAGE_ALIGN(TargetAddress);
    //     UINT64 PageCount   = ((TargetAddress - AlignedPage) + Size) / PAGE_SIZE;
    //
    //     for (size_t i = 0; i <= PageCount; i++)
    //     {
    //         UINT64 CheckAddr = AlignedPage + (PAGE_SIZE * i);
    //         if (!CheckAddressValidityUsingTsx(CheckAddr))
    //         {
    //             //
    //             // Address is not valid
    //             //
    //             Result = FALSE;
    //
    //             goto RestoreCr3;
    //         }
    //     }
    // }
 
    //
    // We've realized that using TSX for address checking is not faster
    // than the legacy memory checking (traversing the page-tables),
    // based on our resultsm it's ~50 TSC clock cycles for a valid address
    // and ~180 TSC clock cycles for an invalid address slower to use TSX
    // for memory checking, that's why it is deprecated now
    //
 
    //
    // Check if memory is safe and present
    //
    UINT64 AddressToCheck = (CHAR *)TargetAddress + Size - ((CHAR *)PAGE_ALIGN(TargetAddress));
 
    if (AddressToCheck > PAGE_SIZE)
    {
        //
        // Address should be accessed in more than one page
        //
        UINT64 ReadSize = AddressToCheck;
 
        while (Size != 0)
        {
            ReadSize = (UINT64)PAGE_ALIGN(TargetAddress + PAGE_SIZE) - TargetAddress;
 
            if (ReadSize == PAGE_SIZE && Size < PAGE_SIZE)
            {
                ReadSize = Size;
            }
 
            if (!MemoryMapperCheckIfPageIsPresentByCr3((PVOID)TargetAddress, GuestCr3))
            {
                //
                // Address is not valid
                //
                Result = FALSE;
 
                goto RestoreCr3;
            }
 
            /*
            LogInfo("Addr From : %llx to Addr To : %llx | ReadSize : %llx\n",
                    TargetAddress,
                    TargetAddress + ReadSize,
                    ReadSize);
            */
 
            //
            // Apply the changes to the next addresses (if any)
            //
            Size          = (UINT32)(Size - ReadSize);
            TargetAddress = TargetAddress + ReadSize;
        }
    }
    else
    {
        if (!MemoryMapperCheckIfPageIsPresentByCr3((PVOID)TargetAddress, GuestCr3))
        {
            //
            // Address is not valid
            //
            Result = FALSE;
 
            goto RestoreCr3;
        }
    }
 
    //
    // If we've reached here, the address was valid
    //
    Result = TRUE;
 
RestoreCr3:
 
    //
    // Move back to original cr3
    //
    __writecr3(OriginalCr3);
 
Return:
    return Result;
}

CheckAddressMaximumInstructionLength()

IMPORT_EXPORT_VMM UINT32 CheckAddressMaximumInstructionLength

(

PVOID

Address

)

This function returns the maximum instruction length that can be read from this address.

Parameters

Address

Returns

UINT32

{
    UINT64 SizeOfSafeBufferToRead = 0;
 
    //
    // Compute the amount of buffer we can read without problem
    //
    SizeOfSafeBufferToRead = (UINT64)Address & 0xfff;
    SizeOfSafeBufferToRead += MAXIMUM_INSTR_SIZE;
 
    if (SizeOfSafeBufferToRead >= PAGE_SIZE)
    {
        SizeOfSafeBufferToRead = SizeOfSafeBufferToRead - PAGE_SIZE;
 
        //
        // When we reached here, we're sure the instruction is on the boundary of a
        // page table, so we have the maximum instruction length to read, but just
        // to make sure that the instruction is not continued into two pages, we'll
        // check the validity of the next page
        //
        if (CheckAccessValidityAndSafety((UINT64)Address + PAGE_SIZE, sizeof(CHAR)))
        {
            //
            // Address is safe to be read from the next page, so we just extend it
            // to the MAXIMUM_INSTR_SIZE
            //
            SizeOfSafeBufferToRead = MAXIMUM_INSTR_SIZE;
        }
        else
        {
            SizeOfSafeBufferToRead = MAXIMUM_INSTR_SIZE - SizeOfSafeBufferToRead;
        }
    }
    else
    {
        SizeOfSafeBufferToRead = MAXIMUM_INSTR_SIZE;
    }
 
    return (UINT32)SizeOfSafeBufferToRead;
}

CheckAddressPhysical()

IMPORT_EXPORT_VMM BOOLEAN CheckAddressPhysical

(

UINT64

PAddr

)

Checks if the physical address is correct or not based on physical address width.

Parameters

PAddr

Physical address to check

Returns

BOOLEAN

{
    UINT64 Addr = (UINT64)PAddr;
    UINT64 MaxPA;
 
    //
    // Get processor's address width for PS
    //
    UINT32 AddrWidth = g_CompatibilityCheck.PhysicalAddressWidth;
 
    //
    // get max address for physical address
    //
    MaxPA = ((UINT64)1ull << (AddrWidth - 1)) - 1;
 
    // LogInfo("Max physical address: %llx", MaxPA);
 
    //
    // Check to see if the address in a canonical address
    //
    if (Addr > MaxPA)
    {
        return FALSE;
    }
 
    return TRUE;
}

CheckAddressValidityUsingTsx()

IMPORT_EXPORT_VMM BOOLEAN CheckAddressValidityUsingTsx

(

CHAR *

Address

)

This function checks whether the address is valid or not using Intel TSX.

Parameters

Address	Address to check
UINT32	ProcId

Returns

BOOLEAN Returns true if the address is valid; otherwise, false

{
    UINT32  Status = 0;
    BOOLEAN Result = FALSE;
    CHAR    TempContent;
 
    if ((Status = _xbegin()) == _XBEGIN_STARTED)
    {
        //
        // Try to read the memory
        //
        TempContent = *(CHAR *)Address;
        _xend();
 
        //
        // No error, address is valid
        //
        Result = TRUE;
    }
    else
    {
        //
        // Address is not valid, it aborts the tsx rtm
        //
        Result = FALSE;
    }
 
    return Result;
}

ConfigureChangeIoBitmapOnSingleCore()

IMPORT_EXPORT_VMM VOID ConfigureChangeIoBitmapOnSingleCore	(	UINT32	TargetCoreId,
		UINT64	Port )

change I/O port bitmap on a single core

Parameters

TargetCoreId	The target core's ID (to just run on this core)
Port	Target port in I/O bitmap

Returns

VOID

{
    DpcRoutineRunTaskOnSingleCore(TargetCoreId, (PVOID)DpcRoutinePerformChangeIoBitmapOnSingleCore, (PVOID)Port);
}

ConfigureChangeMsrBitmapReadOnSingleCore()

IMPORT_EXPORT_VMM VOID ConfigureChangeMsrBitmapReadOnSingleCore	(	UINT32	TargetCoreId,
		UINT64	MsrMask )

change the mask of msr bitmaps for read on a single core

Parameters

TargetCoreId	The target core's ID (to just run on this core)
MsrMask	The ECX in MSR (mask)

Returns

VOID

{
    DpcRoutineRunTaskOnSingleCore(TargetCoreId, (PVOID)DpcRoutinePerformChangeMsrBitmapReadOnSingleCore, (PVOID)MsrMask);
}

ConfigureChangeMsrBitmapWriteOnSingleCore()

IMPORT_EXPORT_VMM VOID ConfigureChangeMsrBitmapWriteOnSingleCore	(	UINT32	TargetCoreId,
		UINT64	MsrMask )

change the mask of msr bitmaps for write on a single core

Parameters

TargetCoreId	The target core's ID (to just run on this core)
MsrMask	The ECX in MSR (mask)

Returns

VOID

{
    DpcRoutineRunTaskOnSingleCore(TargetCoreId, (PVOID)DpcRoutinePerformChangeMsrBitmapWriteOnSingleCore, (PVOID)MsrMask);
}

ConfigureDirtyLoggingInitializeOnAllProcessors()

IMPORT_EXPORT_VMM VOID ConfigureDirtyLoggingInitializeOnAllProcessors

(

)

routines for initializing dirty logging mechanism

Returns

VOID

{
    DirtyLoggingInitialize();
}

ConfigureDirtyLoggingUninitializeOnAllProcessors()

IMPORT_EXPORT_VMM VOID ConfigureDirtyLoggingUninitializeOnAllProcessors

(

)

routines for uninitializing dirty logging mechanism

Returns

VOID

{
    DirtyLoggingUninitialize();
}

ConfigureDisableEferSyscallEventsOnAllProcessors()

IMPORT_EXPORT_VMM VOID ConfigureDisableEferSyscallEventsOnAllProcessors

(

)

routines for disabling syscall hooks on all cores

Returns

VOID

{
    BroadcastDisableEferSyscallEventsOnAllProcessors();
}

ConfigureDisableMovToCr3ExitingOnAllProcessors()

IMPORT_EXPORT_VMM VOID ConfigureDisableMovToCr3ExitingOnAllProcessors

(

)

routines for debugging threads (disable mov-to-cr3 exiting)

Returns

VOID

{
    //
    // Indicate that the future #PFs should or should not be checked with user debugger
    //
    g_CheckPageFaultsAndMov2Cr3VmexitsWithUserDebugger = FALSE;
 
    BroadcastDisableMovToCr3ExitingOnAllProcessors();
}

ConfigureEnableEferSyscallEventsOnAllProcessors()

IMPORT_EXPORT_VMM VOID ConfigureEnableEferSyscallEventsOnAllProcessors

(

)

routines for enabling syscall hooks on all cores

Returns

VOID

{
    BroadcastEnableEferSyscallEventsOnAllProcessors();
}

ConfigureEnableEferSyscallHookOnSingleCore()

IMPORT_EXPORT_VMM VOID ConfigureEnableEferSyscallHookOnSingleCore

(

UINT32

TargetCoreId

)

routines for enabling EFER syscall hooks on a single core

Parameters

TargetCoreId

The target core's ID (to just run on this core)

Returns

VOID

{
    DpcRoutineRunTaskOnSingleCore(TargetCoreId, (PVOID)DpcRoutinePerformEnableEferSyscallHookOnSingleCore, NULL);
}

ConfigureEnableMovToControlRegisterExitingOnSingleCore()

IMPORT_EXPORT_VMM VOID ConfigureEnableMovToControlRegisterExitingOnSingleCore	(	UINT32	TargetCoreId,
		DEBUGGER_EVENT_OPTIONS *	BroadcastingOption )

enable mov 2 control register on a single core

Parameters

TargetCoreId	The target core's ID (to just run on this core)
BroadcastingOption	The optional broadcasting fields

Returns

VOID

{
    DpcRoutineRunTaskOnSingleCore(TargetCoreId, (PVOID)DpcRoutinePerformEnableMovToControlRegisterExiting, &BroadcastingOption);
}

ConfigureEnableMovToCr3ExitingOnAllProcessors()

IMPORT_EXPORT_VMM VOID ConfigureEnableMovToCr3ExitingOnAllProcessors

(

)

routines for debugging threads (enable mov-to-cr3 exiting)

Returns

VOID

{
    //
    // Indicate that the future #PFs should or should not be checked with user debugger
    //
    g_CheckPageFaultsAndMov2Cr3VmexitsWithUserDebugger = TRUE;
 
    BroadcastEnableMovToCr3ExitingOnAllProcessors();
}

ConfigureEnableMovToDebugRegistersExitingOnSingleCore()

IMPORT_EXPORT_VMM VOID ConfigureEnableMovToDebugRegistersExitingOnSingleCore

(

UINT32

TargetCoreId

)

enable mov 2 debug register exiting on a single core

Parameters

TargetCoreId

The target core's ID (to just run on this core)

Returns

VOID

{
    DpcRoutineRunTaskOnSingleCore(TargetCoreId, (PVOID)DpcRoutinePerformEnableMovToDebugRegistersExiting, NULL);
}

ConfigureEnableRdpmcExitingOnSingleCore()

IMPORT_EXPORT_VMM VOID ConfigureEnableRdpmcExitingOnSingleCore

(

UINT32

TargetCoreId

)

enable RDPMC exiting on a single core

Parameters

TargetCoreId

The target core's ID (to just run on this core)

Returns

VOID

{
    DpcRoutineRunTaskOnSingleCore(TargetCoreId, (PVOID)DpcRoutinePerformEnableRdpmcExitingOnSingleCore, NULL);
}

ConfigureEnableRdtscExitingOnSingleCore()

IMPORT_EXPORT_VMM VOID ConfigureEnableRdtscExitingOnSingleCore

(

UINT32

TargetCoreId

)

enable RDTSC exiting on a single core

Parameters

TargetCoreId

The target core's ID (to just run on this core)

Returns

VOID

{
    DpcRoutineRunTaskOnSingleCore(TargetCoreId, (PVOID)DpcRoutinePerformEnableRdtscExitingOnSingleCore, NULL);
}

ConfigureEptHook()

IMPORT_EXPORT_VMM BOOLEAN ConfigureEptHook	(	PVOID	TargetAddress,
		UINT32	ProcessId )

This function invokes a VMCALL to set the hook and broadcast the exiting for the breakpoints on exception bitmap.

this command uses hidden breakpoints (0xcc) to hook, THIS FUNCTION SHOULD BE CALLED WHEN THE VMLAUNCH ALREADY EXECUTED, it is because, broadcasting to enable exception bitmap for breakpoint is not clear here, if we want to broadcast to enable exception bitmaps on all cores when vmlaunch is not executed then that's ok but a user might call this function when we didn't configure the vmcs, it's a problem! we can solve it by giving a hint to vmcs configure function to make it ok for future configuration but that sounds stupid, I think it's better to not support this feature. Btw, debugger won't use this function in the above mentioned method, so we won't have any problem with this :)

Parameters

TargetAddress	The address of function or memory address to be hooked
ProcessId	The process id to translate based on that process's cr3

Returns

BOOLEAN Returns true if the hook was successful or false if there was an error

{
    return EptHook(TargetAddress, ProcessId);
}

ConfigureEptHook2()

IMPORT_EXPORT_VMM BOOLEAN ConfigureEptHook2	(	UINT32	CoreId,
		PVOID	TargetAddress,
		PVOID	HookFunction,
		UINT32	ProcessId )

This function allocates a buffer in VMX Non Root Mode and then invokes a VMCALL to set the hook (inline)

this command uses hidden detours, this NOT be called from vmx-root mode

Parameters

CoreId	ID of the target core
TargetAddress	The address of function or memory address to be hooked
HookFunction	The function that will be called when hook triggered
ProcessId	The process id to translate based on that process's cr3

Returns

BOOLEAN Returns true if the hook was successful or false if there was an error

{
    return EptHookInlineHook(&g_GuestState[CoreId],
                             TargetAddress,
                             HookFunction,
                             ProcessId);
}

ConfigureEptHook2FromVmxRoot()

IMPORT_EXPORT_VMM BOOLEAN ConfigureEptHook2FromVmxRoot	(	UINT32	CoreId,
		PVOID	TargetAddress,
		PVOID	HookFunction )

This function allocates a buffer in VMX Non Root Mode and then invokes a VMCALL to set the hook (inline EPT hook)

this command uses hidden detours, this should be called from vmx-root mode

Parameters

CoreId	ID of the target core
TargetAddress	The address of function or memory address to be hooked
HookFunction	The function that will be called when hook triggered

Returns

BOOLEAN Returns true if the hook was successful or false if there was an error

{
    return EptHookInlineHookFromVmxRoot(&g_GuestState[CoreId],
                                        TargetAddress,
                                        HookFunction);
}

ConfigureEptHookAllocateExtraHookingPagesForMemoryMonitorsAndExecEptHooks()

IMPORT_EXPORT_VMM VOID ConfigureEptHookAllocateExtraHookingPagesForMemoryMonitorsAndExecEptHooks

(

UINT32

Count

)

Allocate (reserve) extra pages for storing details of page hooks for memory monitor and regular hidden breakpoit exec EPT hooks.

Parameters

Count

Returns

VOID

{
    EptHookAllocateExtraHookingPagesForMemoryMonitorsAndExecEptHooks(Count);
}

ConfigureEptHookFromVmxRoot()

IMPORT_EXPORT_VMM BOOLEAN ConfigureEptHookFromVmxRoot

(

PVOID

TargetAddress

)

This function invokes a direct VMCALL to setup the hook.

the caller of this function should make sure to 1) broadcast to all cores to intercept breakpoints (#BPs) and after calling this function 2) the caller should broadcast to all cores to invalidate their EPTPs

Parameters

TargetAddress

The address of function or memory address to be hooked

Returns

BOOLEAN Returns true if the hook was successful or false if there was an error

{
    return EptHookFromVmxRoot(TargetAddress);
}

ConfigureEptHookModifyInstructionFetchState()

IMPORT_EXPORT_VMM BOOLEAN ConfigureEptHookModifyInstructionFetchState	(	UINT32	CoreId,
		PVOID	PhysicalAddress,
		BOOLEAN	IsUnset )

Change PML EPT state for execution (execute) @detail should be called from VMX-root.

Parameters

CoreId	Current Core ID
PhysicalAddress	Target physical address
IsUnset	Is unsetting bit or setting bit

Returns

BOOLEAN

{
    return EptHookModifyInstructionFetchState(&g_GuestState[CoreId], PhysicalAddress, IsUnset);
}

ConfigureEptHookModifyPageReadState()

IMPORT_EXPORT_VMM BOOLEAN ConfigureEptHookModifyPageReadState	(	UINT32	CoreId,
		PVOID	PhysicalAddress,
		BOOLEAN	IsUnset )

Change PML EPT state for read @detail should be called from VMX-root.

Parameters

VCpu	The virtual processor's state
PhysicalAddress	Target physical address
IsUnset	Is unsetting bit or setting bit

Returns

BOOLEAN

{
    return EptHookModifyPageReadState(&g_GuestState[CoreId], PhysicalAddress, IsUnset);
}

ConfigureEptHookModifyPageWriteState()

IMPORT_EXPORT_VMM BOOLEAN ConfigureEptHookModifyPageWriteState	(	UINT32	CoreId,
		PVOID	PhysicalAddress,
		BOOLEAN	IsUnset )

Change PML EPT state for write @detail should be called from VMX-root.

Parameters

VCpu	The virtual processor's state
PhysicalAddress	Target physical address
IsUnset	Is unsetting bit or setting bit

Returns

BOOLEAN

{
    return EptHookModifyPageWriteState(&g_GuestState[CoreId], PhysicalAddress, IsUnset);
}

ConfigureEptHookMonitor()

IMPORT_EXPORT_VMM BOOLEAN ConfigureEptHookMonitor	(	UINT32	CoreId,
		EPT_HOOKS_ADDRESS_DETAILS_FOR_MEMORY_MONITOR *	HookingDetails,
		UINT32	ProcessId )

This function allocates a buffer in VMX Non Root Mode and then invokes a VMCALL to set the hook.

this command uses hidden detours, this NOT be called from vmx-root mode

Parameters

CoreId	ID of the target core
HookingDetails	Monitor hooking detail
ProcessId	The process id to translate based on that process's cr3

Returns

BOOLEAN Returns true if the hook was successful or false if there was an error

{
    return EptHookMonitorHook(&g_GuestState[CoreId],
                              HookingDetails,
                              ProcessId);
}

ConfigureEptHookMonitorFromVmxRoot()

IMPORT_EXPORT_VMM BOOLEAN ConfigureEptHookMonitorFromVmxRoot	(	UINT32	CoreId,
		EPT_HOOKS_ADDRESS_DETAILS_FOR_MEMORY_MONITOR *	MemoryAddressDetails )

This function allocates a buffer in VMX Non Root Mode and then invokes a VMCALL to set the hook.

this command uses hidden detours, this should be called from vmx-root mode

Parameters

CoreId	ID of the target core
MemoryAddressDetails	Monitor hooking details

Returns

BOOLEAN Returns true if the hook was successful or false if there was an error

{
    return EptHookMonitorFromVmxRoot(&g_GuestState[CoreId], MemoryAddressDetails);
}

ConfigureEptHookReservePreallocatedPoolsForEptHooks()

IMPORT_EXPORT_VMM VOID ConfigureEptHookReservePreallocatedPoolsForEptHooks

(

UINT32

Count

)

Allocate (reserve) pages for storing EPT hooks page hooks.

Parameters

Count

Returns

VOID

{
    EptHookReservePreallocatedPoolsForEptHooks(Count);
}

ConfigureEptHookUnHookAllByHookingTag()

IMPORT_EXPORT_VMM BOOLEAN ConfigureEptHookUnHookAllByHookingTag

(

UINT64

HookingTag

)

Remove all hooks from the hooked pages list using Hooking Tag.

Should be called from vmx non-root

Parameters

HookingTag

The hooking tag to remove all hooks

Returns

BOOLEAN If unhook was successful it returns true or if it was not successful returns false

{
    return EptHookUnHookAllByHookingTag(HookingTag);
}

ConfigureEptHookUnHookSingleAddress()

IMPORT_EXPORT_VMM BOOLEAN ConfigureEptHookUnHookSingleAddress	(	UINT64	VirtualAddress,
		UINT64	PhysAddress,
		UINT32	ProcessId )

Remove single hook from the hooked pages list and invalidate TLB.

Should be called from vmx non-root

Parameters

VirtualAddress	Virtual address to unhook
PhysAddress	Physical address to unhook (optional)
ProcessId	The process id of target process

in unhooking for some hooks only physical address is availables

Returns

BOOLEAN If unhook was successful it returns true or if it was not successful returns false

{
    return EptHookUnHookSingleAddress(VirtualAddress, PhysAddress, ProcessId);
}

ConfigureEptHookUnHookSingleAddressFromVmxRoot()

IMPORT_EXPORT_VMM BOOLEAN ConfigureEptHookUnHookSingleAddressFromVmxRoot	(	UINT64	VirtualAddress,
		UINT64	PhysAddress,
		EPT_SINGLE_HOOK_UNHOOKING_DETAILS *	TargetUnhookingDetails )

Remove single hook from the hooked pages list and invalidate TLB.

Should be called from vmx root-mode and it's the responsibility of caller to broadcast to all cores to remove the target physical address and invalidate EPT and modify exception bitmap (#BPs) if needed

Parameters

VirtualAddress	Virtual address to unhook
PhysAddress	Physical address to unhook (optional)
TargetUnhookingDetails	Target data for the caller to restore EPT entry and invalidate EPT caches. Only when applied in VMX-root mode directly

Returns

BOOLEAN If unhook was successful it returns true or if it was not successful returns false

{
    return EptHookUnHookSingleAddressFromVmxRoot(VirtualAddress,
                                                 PhysAddress,
                                                 TargetUnhookingDetails);
}

ConfigureEptHookUnHookSingleHookByHookingTagFromVmxRoot()

IMPORT_EXPORT_VMM BOOLEAN ConfigureEptHookUnHookSingleHookByHookingTagFromVmxRoot	(	UINT64	HookingTag,
		EPT_SINGLE_HOOK_UNHOOKING_DETAILS *	TargetUnhookingDetails )

Remove single hook from the hooked pages by the given hooking tag.

Should be called from Vmx root-mode

Parameters

HookingTag

The hooking tag to unhook

Returns

BOOLEAN If unhook was successful it returns true or if it was not successful returns false

{
    return EptHookUnHookSingleHookByHookingTagFromVmxRoot(HookingTag, TargetUnhookingDetails);
}

ConfigureExecTrapAddProcessToWatchingList()

IMPORT_EXPORT_VMM BOOLEAN ConfigureExecTrapAddProcessToWatchingList

(

UINT32

ProcessId

)

Add the target process to the watching list.

Parameters

ProcessId

Returns

BOOLEAN

{
    return ExecTrapAddProcessToWatchingList(ProcessId);
}

ConfigureExecTrapRemoveProcessFromWatchingList()

IMPORT_EXPORT_VMM BOOLEAN ConfigureExecTrapRemoveProcessFromWatchingList

(

UINT32

ProcessId

)

Remove the target process from the watching list.

Parameters

ProcessId

Returns

BOOLEAN

{
    return ExecTrapRemoveProcessFromWatchingList(ProcessId);
}

ConfigureInitializeExecTrapOnAllProcessors()

IMPORT_EXPORT_VMM BOOLEAN ConfigureInitializeExecTrapOnAllProcessors

(

)

routines for initializing user-mode, kernel-mode exec trap

Returns

BOOLEAN

{
    return ExecTrapInitialize();
}

ConfigureModeBasedExecHookUninitializeOnAllProcessors()

IMPORT_EXPORT_VMM VOID ConfigureModeBasedExecHookUninitializeOnAllProcessors

(

)

routines for initializing Mode-based execution hooks

Returns

VOID

{
    ModeBasedExecHookUninitialize();
}

ConfigureSetEferSyscallOrSysretHookType()

IMPORT_EXPORT_VMM VOID ConfigureSetEferSyscallOrSysretHookType

(

DEBUGGER_EVENT_SYSCALL_SYSRET_TYPE

SyscallHookType

)

routines for setting EFER syscall or sysret hooks type

Parameters

SyscallHookType

Type of hook

Returns

VOID

{
    if (SyscallHookType == DEBUGGER_EVENT_SYSCALL_SYSRET_HANDLE_ALL_UD)
    {
        g_IsUnsafeSyscallOrSysretHandling = TRUE;
    }
    else if (SyscallHookType == DEBUGGER_EVENT_SYSCALL_SYSRET_SAFE_ACCESS_MEMORY)
    {
        g_IsUnsafeSyscallOrSysretHandling = FALSE;
    }
}

ConfigureSetExceptionBitmapOnSingleCore()

IMPORT_EXPORT_VMM VOID ConfigureSetExceptionBitmapOnSingleCore	(	UINT32	TargetCoreId,
		UINT32	BitMask )

set exception bitmap on a single core

Parameters

TargetCoreId	The target core's ID (to just run on this core)
BitMask	The bit mask of exception bitmap

Returns

VOID

{
    DpcRoutineRunTaskOnSingleCore(TargetCoreId, (PVOID)DpcRoutinePerformSetExceptionBitmapOnSingleCore, (PVOID)BitMask);
}

ConfigureSetExternalInterruptExitingOnSingleCore()

IMPORT_EXPORT_VMM VOID ConfigureSetExternalInterruptExitingOnSingleCore

(

UINT32

TargetCoreId

)

set external interrupt exiting on a single core

Parameters

TargetCoreId

The target core's ID (to just run on this core)

Returns

VOID

{
    DpcRoutineRunTaskOnSingleCore(TargetCoreId, (PVOID)DpcRoutinePerformSetExternalInterruptExitingOnSingleCore, NULL);
}

ConfigureUninitializeExecTrapOnAllProcessors()

IMPORT_EXPORT_VMM VOID ConfigureUninitializeExecTrapOnAllProcessors

(

)

routines for uninitializing user-mode, kernel-mode exec trap

Returns

VOID

{
    ExecTrapUninitialize();
}

DirectVmcallChangeIoBitmap()

IMPORT_EXPORT_VMM NTSTATUS DirectVmcallChangeIoBitmap	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for changing IO Bitmap

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_CHANGE_IO_BITMAP, DirectVmcallOptions);
}

DirectVmcallChangeMsrBitmapRead()

IMPORT_EXPORT_VMM NTSTATUS DirectVmcallChangeMsrBitmapRead	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for changing MSR Bitmap (Read)

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_CHANGE_MSR_BITMAP_READ, DirectVmcallOptions);
}

DirectVmcallChangeMsrBitmapWrite()

IMPORT_EXPORT_VMM NTSTATUS DirectVmcallChangeMsrBitmapWrite	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for changing MSR Bitmap (Write)

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_CHANGE_MSR_BITMAP_WRITE, DirectVmcallOptions);
}

DirectVmcallDisableEferSyscallEvents()

IMPORT_EXPORT_VMM NTSTATUS DirectVmcallDisableEferSyscallEvents	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for disabling syscall hook using EFER SCE bit

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_DISABLE_SYSCALL_HOOK_EFER, DirectVmcallOptions);
}

DirectVmcallDisableMov2CrExitingForClearingCrEvents()

IMPORT_EXPORT_VMM NTSTATUS DirectVmcallDisableMov2CrExitingForClearingCrEvents	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for clearing mov 2 cr exiting bit ONLY in the case of disabling the events for !crwrite command

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_DISABLE_MOV_TO_CR_EXITING_ONLY_FOR_CR_EVENTS, DirectVmcallOptions);
}

DirectVmcallDisableMov2DrExitingForClearingDrEvents()

IMPORT_EXPORT_VMM NTSTATUS DirectVmcallDisableMov2DrExitingForClearingDrEvents	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for clearing mov 2 hw dr exiting bit ONLY in the case of disabling the events for !dr command

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_DISABLE_MOV_TO_HW_DR_EXITING_ONLY_FOR_DR_EVENTS, DirectVmcallOptions);
}

DirectVmcallDisableRdpmcExiting()

IMPORT_EXPORT_VMM NTSTATUS DirectVmcallDisableRdpmcExiting	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for disabling rdpmc exiting in primary cpu-based controls

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_UNSET_RDPMC_EXITING, DirectVmcallOptions);
}

DirectVmcallDisableRdtscExitingForClearingTscEvents()

IMPORT_EXPORT_VMM NTSTATUS DirectVmcallDisableRdtscExitingForClearingTscEvents	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for clearing rdtsc exiting bit ONLY in the case of disabling the events for !tsc command

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_DISABLE_RDTSC_EXITING_ONLY_FOR_TSC_EVENTS, DirectVmcallOptions);
}

DirectVmcallEnableEferSyscall()

IMPORT_EXPORT_VMM NTSTATUS DirectVmcallEnableEferSyscall	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for enabling syscall hook using EFER SCE bit

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_ENABLE_SYSCALL_HOOK_EFER, DirectVmcallOptions);
}

DirectVmcallEnableExternalInterruptExiting()

IMPORT_EXPORT_VMM NTSTATUS DirectVmcallEnableExternalInterruptExiting	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for enabling external interrupt exiting

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_ENABLE_EXTERNAL_INTERRUPT_EXITING, DirectVmcallOptions);
}

DirectVmcallEnableMov2DebugRegsExiting()

IMPORT_EXPORT_VMM NTSTATUS DirectVmcallEnableMov2DebugRegsExiting	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for enabling mov to debug registers exiting

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_ENABLE_MOV_TO_DEBUG_REGS_EXITING, DirectVmcallOptions);
}

DirectVmcallEnableMovToCrExiting()

IMPORT_EXPORT_VMM NTSTATUS DirectVmcallEnableMovToCrExiting	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for enabling mov to CR exiting

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_ENABLE_MOV_TO_CONTROL_REGS_EXITING, DirectVmcallOptions);
}

DirectVmcallEnableRdpmcExiting()

IMPORT_EXPORT_VMM NTSTATUS DirectVmcallEnableRdpmcExiting	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for enabling rdpmc exiting

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_SET_RDPMC_EXITING, DirectVmcallOptions);
}

DirectVmcallEnableRdtscpExiting()

IMPORT_EXPORT_VMM NTSTATUS DirectVmcallEnableRdtscpExiting	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for enabling rdtsc/rdtscp exiting

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_SET_RDTSC_EXITING, DirectVmcallOptions);
}

DirectVmcallInvalidateEptAllContexts()

IMPORT_EXPORT_VMM NTSTATUS DirectVmcallInvalidateEptAllContexts	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for invalidating EPT (All Contexts)

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_INVEPT_ALL_CONTEXTS, DirectVmcallOptions);
}

DirectVmcallInvalidateSingleContext()

IMPORT_EXPORT_VMM NTSTATUS DirectVmcallInvalidateSingleContext	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for invalidating EPT (A Single Context)

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_INVEPT_SINGLE_CONTEXT, DirectVmcallOptions);
}

DirectVmcallPerformVmcall()

IMPORT_EXPORT_VMM NTSTATUS DirectVmcallPerformVmcall	(	UINT32	CoreId,
		UINT64	VmcallNumber,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for performing a direct VMCALL

Should be called from VMX root-mode

Parameters

CoreId
VmcallNumber
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VmcallNumber, DirectVmcallOptions);
}

DirectVmcallResetExceptionBitmapOnlyOnClearingExceptionEvents()

IMPORT_EXPORT_VMM NTSTATUS DirectVmcallResetExceptionBitmapOnlyOnClearingExceptionEvents	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for resetting exception bitmap on VMCS

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_RESET_EXCEPTION_BITMAP_ONLY_ON_CLEARING_EXCEPTION_EVENTS, DirectVmcallOptions);
}

DirectVmcallResetIoBitmap()

IMPORT_EXPORT_VMM NTSTATUS DirectVmcallResetIoBitmap	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for resetting I/O Bitmaps (A & B)

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_RESET_IO_BITMAP, DirectVmcallOptions);
}

DirectVmcallResetMsrBitmapRead()

IMPORT_EXPORT_VMM NTSTATUS DirectVmcallResetMsrBitmapRead	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for resetting MSR Bitmap Read

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_RESET_MSR_BITMAP_READ, DirectVmcallOptions);
}

DirectVmcallResetMsrBitmapWrite()

IMPORT_EXPORT_VMM NTSTATUS DirectVmcallResetMsrBitmapWrite	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for resetting MSR Bitmap Write

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_RESET_MSR_BITMAP_WRITE, DirectVmcallOptions);
}

DirectVmcallSetDisableExternalInterruptExitingOnlyOnClearingInterruptEvents()

IMPORT_EXPORT_VMM NTSTATUS DirectVmcallSetDisableExternalInterruptExitingOnlyOnClearingInterruptEvents	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for disabling external interrupt exiting only to clear !interrupt commands

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_DISABLE_EXTERNAL_INTERRUPT_EXITING_ONLY_TO_CLEAR_INTERRUPT_COMMANDS, DirectVmcallOptions);
}

DirectVmcallSetExceptionBitmap()

IMPORT_EXPORT_VMM NTSTATUS DirectVmcallSetExceptionBitmap	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for setting exception bitmap

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_SET_EXCEPTION_BITMAP, DirectVmcallOptions);
}

DirectVmcallSetHiddenBreakpointHook()

IMPORT_EXPORT_VMM NTSTATUS DirectVmcallSetHiddenBreakpointHook	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for putting hidden breakpoints (using EPT)

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_SET_HIDDEN_CC_BREAKPOINT, DirectVmcallOptions);
}

DirectVmcallTest()

IMPORT_EXPORT_VMM NTSTATUS DirectVmcallTest	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for test direct VMCALL

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_TEST, DirectVmcallOptions);
}

DirectVmcallUnhookSinglePage()

IMPORT_EXPORT_VMM NTSTATUS DirectVmcallUnhookSinglePage	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for restoring a single EPT entry and invalidating EPT cache

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_UNHOOK_SINGLE_PAGE, DirectVmcallOptions);
}

DirectVmcallUnsetExceptionBitmap()

IMPORT_EXPORT_VMM NTSTATUS DirectVmcallUnsetExceptionBitmap	(	UINT32	CoreId,
		DIRECT_VMCALL_PARAMETERS *	DirectVmcallOptions )

routines for unsetting exception bitmap on VMCS

Should be called from VMX root-mode

Parameters

CoreId
DirectVmcallOptions

Returns

NTSTATUS

{
    //
    // Call the VMCALL handler (directly)
    //
    return VmxVmcallDirectVmcallHandler(&g_GuestState[CoreId], VMCALL_UNSET_EXCEPTION_BITMAP, DirectVmcallOptions);
}

DisassemblerLengthDisassembleEngine()

IMPORT_EXPORT_VMM UINT32 DisassemblerLengthDisassembleEngine	(	PVOID	Address,
		BOOLEAN	Is32Bit )

Disassembler length disassemble engine.

if you want to call it directly, shouldn't not be in VMX-root mode, otherwise, you can call DisassemblerLengthDisassembleEngineInVmxRootOnTargetProcess to access memory safely

Parameters

Address
Is32Bit

Returns

UINT32

{
    ZydisDecoder            Decoder;
    ZydisDecodedInstruction Instruction;
    ZydisDecodedOperand     Operands[ZYDIS_MAX_OPERAND_COUNT];
    ZyanStatus              Status;
 
    if (ZydisGetVersion() != ZYDIS_VERSION)
    {
        LogError("Err, invalid zydis version");
        return NULL_ZERO;
    }
 
    //
    // Initialize Zydis decoder
    //
    if (Is32Bit)
    {
        if (!ZYAN_SUCCESS(ZydisDecoderInit(&Decoder, ZYDIS_MACHINE_MODE_LONG_COMPAT_32, ZYDIS_STACK_WIDTH_32)))
        {
            return NULL_ZERO;
        }
    }
    else
    {
        if (!ZYAN_SUCCESS(ZydisDecoderInit(&Decoder, ZYDIS_MACHINE_MODE_LONG_64, ZYDIS_STACK_WIDTH_64)))
        {
            return NULL_ZERO;
        }
    }
 
    //
    // Start the decode loop
    //
    while ((Status = ZydisDecoderDecodeFull(&Decoder,
                                            (PVOID)((UINT64)Address),
                                            MAXIMUM_INSTR_SIZE,
                                            &Instruction,
                                            Operands)) != ZYDIS_STATUS_NO_MORE_DATA)
    {
        NT_ASSERT(ZYAN_SUCCESS(Status));
 
        if (!ZYAN_SUCCESS(Status))
        {
            //
            // Probably invalid instruction
            //
            return NULL_ZERO;
        }
 
        //
        // This is a length disassembler, so we just return the length
        //
        return Instruction.length;
    }
 
    //
    // return an error status
    //
    return NULL_ZERO;
}

DisassemblerLengthDisassembleEngineInVmxRootOnTargetProcess()

IMPORT_EXPORT_VMM UINT32 DisassemblerLengthDisassembleEngineInVmxRootOnTargetProcess	(	PVOID	Address,
		BOOLEAN	Is32Bit )

Disassembler length disassembler engine.

Should be called in VMX-root mode

Parameters

Address
Is32Bit

Returns

UINT32

{
    BYTE   SafeMemoryToRead[MAXIMUM_INSTR_SIZE] = {0};
    UINT64 SizeOfSafeBufferToRead               = 0;
 
    //
    // Read the maximum number of instruction that is valid to be read in the
    // target address
    //
    SizeOfSafeBufferToRead = CheckAddressMaximumInstructionLength(Address);
 
    //
    // Find the current instruction
    //
    MemoryMapperReadMemorySafeOnTargetProcess((UINT64)Address,
                                              SafeMemoryToRead,
                                              SizeOfSafeBufferToRead);
 
    return DisassemblerLengthDisassembleEngine(SafeMemoryToRead, Is32Bit);
}

DisassemblerShowInstructionsInVmxNonRootMode()

IMPORT_EXPORT_VMM BOOLEAN DisassemblerShowInstructionsInVmxNonRootMode	(	PVOID	Address,
		UINT32	Length,
		BOOLEAN	Is32Bit )

Disassembler show the instructions.

This function should not be called from VMX-root mode

Parameters

Address
Length
Is32Bit

Returns

BOOLEAN

{
    ZydisDecoder            Decoder;
    ZydisFormatter          Formatter;
    SIZE_T                  ReadOffset = 0;
    ZydisDecodedInstruction Instruction;
    ZydisDecodedOperand     Operands[ZYDIS_MAX_OPERAND_COUNT];
    ZyanStatus              Status;
    CHAR                    PrintBuffer[128];
 
    PAGED_CODE();
 
    if (ZydisGetVersion() != ZYDIS_VERSION)
    {
        LogError("Err, invalid zydis version");
        return FALSE;
    }
 
    //
    // Initialize Zydis decoder
    //
    if (Is32Bit)
    {
        if (!ZYAN_SUCCESS(ZydisDecoderInit(&Decoder, ZYDIS_MACHINE_MODE_LONG_COMPAT_32, ZYDIS_STACK_WIDTH_32)))
        {
            return FALSE;
        }
    }
    else
    {
        if (!ZYAN_SUCCESS(ZydisDecoderInit(&Decoder, ZYDIS_MACHINE_MODE_LONG_64, ZYDIS_STACK_WIDTH_64)))
        {
            return FALSE;
        }
    }
 
    //
    // Initialize Zydis formatter
    //
    if (!ZYAN_SUCCESS(ZydisFormatterInit(&Formatter, ZYDIS_FORMATTER_STYLE_INTEL)))
    {
        return FALSE;
    }
 
    //
    // Start the decode loop
    //
    while ((Status = ZydisDecoderDecodeFull(&Decoder,
                                            (PVOID)((UINT64)Address + ReadOffset),
                                            Length - ReadOffset,
                                            &Instruction,
                                            Operands)) != ZYDIS_STATUS_NO_MORE_DATA)
    {
        NT_ASSERT(ZYAN_SUCCESS(Status));
        if (!ZYAN_SUCCESS(Status))
        {
            ReadOffset++;
            continue;
        }
 
        // Format and print the instruction
        const ZyanU64 InstrAddress = (ZyanU64)((UINT64)Address + ReadOffset);
        ZydisFormatterFormatInstruction(
            &Formatter,
            &Instruction,
            Operands,
            Instruction.operand_count_visible,
            PrintBuffer,
            sizeof(PrintBuffer),
            InstrAddress,
            NULL);
 
        LogInfo("+%-4X 0x%-16llX\t\t%hs\n", (UINT32)ReadOffset, InstrAddress, PrintBuffer);
 
        ReadOffset += Instruction.length;
    }
 
    //
    // return an error status so that the driver does not have to be unloaded after running
    //
    return TRUE;
}

DisassemblerShowOneInstructionInVmxNonRootMode()

IMPORT_EXPORT_VMM BOOLEAN DisassemblerShowOneInstructionInVmxNonRootMode	(	PVOID	Address,
		UINT64	ActualRip,
		BOOLEAN	Is32Bit )

Disassembler show only one instruction.

This function should not be directly called from VMX-root mode if the caller is sure that the target buffer is safe to be access, then it's okay

Parameters

Address
ActualRip
Is32Bit

Returns

BOOLEAN

{
    ZydisDecoder            Decoder;
    ZydisFormatter          Formatter;
    SIZE_T                  ReadOffset = 0;
    ZydisDecodedInstruction Instruction;
    ZydisDecodedOperand     Operands[ZYDIS_MAX_OPERAND_COUNT];
    ZyanStatus              Status;
    CHAR                    PrintBuffer[128];
 
    if (ZydisGetVersion() != ZYDIS_VERSION)
    {
        LogError("Err, invalid zydis version");
        return FALSE;
    }
 
    //
    // Initialize Zydis decoder
    //
    if (Is32Bit)
    {
        if (!ZYAN_SUCCESS(ZydisDecoderInit(&Decoder, ZYDIS_MACHINE_MODE_LONG_COMPAT_32, ZYDIS_STACK_WIDTH_32)))
        {
            return FALSE;
        }
    }
    else
    {
        if (!ZYAN_SUCCESS(ZydisDecoderInit(&Decoder, ZYDIS_MACHINE_MODE_LONG_64, ZYDIS_STACK_WIDTH_64)))
        {
            return FALSE;
        }
    }
 
    //
    // Initialize Zydis formatter
    //
    if (!ZYAN_SUCCESS(ZydisFormatterInit(&Formatter, ZYDIS_FORMATTER_STYLE_INTEL)))
    {
        return FALSE;
    }
 
    //
    // Start the decode loop
    //
    while ((Status = ZydisDecoderDecodeFull(&Decoder,
                                            (PVOID)((UINT64)Address + ReadOffset),
                                            MAXIMUM_INSTR_SIZE - ReadOffset,
                                            &Instruction,
                                            Operands)) != ZYDIS_STATUS_NO_MORE_DATA)
    {
        NT_ASSERT(ZYAN_SUCCESS(Status));
        if (!ZYAN_SUCCESS(Status))
        {
            ReadOffset++;
            continue;
        }
 
        // Format and print the instruction
        const ZyanU64 InstrAddress = (ZyanU64)((UINT64)ActualRip + ReadOffset);
        ZydisFormatterFormatInstruction(
            &Formatter,
            &Instruction,
            Operands,
            Instruction.operand_count_visible,
            PrintBuffer,
            sizeof(PrintBuffer),
            InstrAddress,
            NULL);
 
        // LogInfo("+%-4X 0x%-16llX\t\t%hs\n", (UINT32)ReadOffset, InstrAddress, PrintBuffer);
 
        Log("core: %x | pid: %x - tid: %x,\t %llx \t\t\t\t%hs\n",
            KeGetCurrentProcessorNumberEx(NULL),
            PsGetCurrentProcessId(),
            PsGetCurrentThreadId(),
            ActualRip,
            PrintBuffer);
 
        // ReadOffset += Instruction.length;
 
        //
        // Only one instruction is enough
        //
        break;
    }
 
    //
    // return an error status so that the driver does not have to be unloaded after running
    //
    return TRUE;
}

DisassemblerShowOneInstructionInVmxRootMode()

IMPORT_EXPORT_VMM UINT32 DisassemblerShowOneInstructionInVmxRootMode	(	PVOID	Address,
		BOOLEAN	Is32Bit )

Shows the disassembly of only one instruction.

Should be called in VMX-root mode

Parameters

Address
Is32Bit

Returns

UINT32

{
    BYTE   SafeMemoryToRead[MAXIMUM_INSTR_SIZE] = {0};
    UINT64 SizeOfSafeBufferToRead               = 0;
 
    //
    // Read the maximum number of instruction that is valid to be read in the
    // target address
    //
    SizeOfSafeBufferToRead = CheckAddressMaximumInstructionLength(Address);
 
    //
    // Find the current instruction
    //
    MemoryMapperReadMemorySafeOnTargetProcess((UINT64)Address,
                                              SafeMemoryToRead,
                                              SizeOfSafeBufferToRead);
 
    return DisassemblerShowOneInstructionInVmxNonRootMode(SafeMemoryToRead, (UINT64)Address, Is32Bit);
}

GetGuestCr0()

IMPORT_EXPORT_VMM UINT64 GetGuestCr0

(

)

Get the Guest Cr0 value.

Returns

UINT64

{
    UINT64 Cr0;
 
    __vmx_vmread(VMCS_GUEST_CR0, &Cr0);
    return Cr0;
}

GetGuestCr2()

IMPORT_EXPORT_VMM UINT64 GetGuestCr2

(

)

Get the Guest Cr2 value.

Returns

UINT64

{
    UINT64 Cr2;
 
    Cr2 = __readcr2();
    return Cr2;
}

GetGuestCr3()

IMPORT_EXPORT_VMM UINT64 GetGuestCr3

(

)

Get the Guest Cr3 value.

Returns

UINT64

{
    UINT64 Cr3;
 
    __vmx_vmread(VMCS_GUEST_CR3, &Cr3);
    return Cr3;
}

GetGuestCr4()

IMPORT_EXPORT_VMM UINT64 GetGuestCr4

(

)

Get the Guest Cr4 value.

Returns

UINT64

{
    UINT64 Cr4;
 
    __vmx_vmread(VMCS_GUEST_CR4, &Cr4);
    return Cr4;
}

GetGuestCr8()

IMPORT_EXPORT_VMM UINT64 GetGuestCr8

(

)

Get the Guest Cr8 value.

Returns

UINT64

{
    UINT64 Cr8;
 
    Cr8 = __readcr8();
    return Cr8;
}

GetGuestCs()

IMPORT_EXPORT_VMM VMX_SEGMENT_SELECTOR GetGuestCs

(

)

Get the Guest Cs Selector.

Returns

SEGMENT_SELECTOR

{
    VMX_SEGMENT_SELECTOR Cs;
 
    __vmx_vmread(VMCS_GUEST_CS_BASE, &Cs.Base);
    VmxVmread32P(VMCS_GUEST_CS_LIMIT, &Cs.Limit);
    VmxVmread32P(VMCS_GUEST_CS_ACCESS_RIGHTS, &Cs.Attributes.AsUInt);
    VmxVmread16P(VMCS_GUEST_CS_SELECTOR, &Cs.Selector);
 
    return Cs;
}

GetGuestDr0()

IMPORT_EXPORT_VMM UINT64 GetGuestDr0

(

)

Get the Guest Dr0 value.

Returns

UINT64

{
    UINT64 Dr0 = 0;
    Dr0        = __readdr(0);
    return Dr0;
}

GetGuestDr1()

IMPORT_EXPORT_VMM UINT64 GetGuestDr1

(

)

Get the Guest Dr1 value.

Returns

UINT64

{
    UINT64 Dr1 = 0;
    Dr1        = __readdr(1);
    return Dr1;
}

GetGuestDr2()

IMPORT_EXPORT_VMM UINT64 GetGuestDr2

(

)

Get the Guest Dr2 value.

Returns

UINT64

{
    UINT64 Dr2 = 0;
    Dr2        = __readdr(2);
    return Dr2;
}

GetGuestDr3()

IMPORT_EXPORT_VMM UINT64 GetGuestDr3

(

)

Get the Guest Dr3 value.

Returns

UINT64

{
    UINT64 Dr3 = 0;
    Dr3        = __readdr(3);
    return Dr3;
}

GetGuestDr6()

IMPORT_EXPORT_VMM UINT64 GetGuestDr6

(

)

Get the Guest Dr6 (breakpoint status) value.

Returns

UINT64

{
    UINT64 Dr6 = 0;
    Dr6        = __readdr(6);
    return Dr6;
}

GetGuestDr7()

IMPORT_EXPORT_VMM UINT64 GetGuestDr7

(

)

Get the Guest Dr7 (breakpoint trigger) value.

Returns

UINT64

{
    UINT64 Dr7 = 0;
    Dr7        = __readdr(7);
    return Dr7;
}

GetGuestDs()

IMPORT_EXPORT_VMM VMX_SEGMENT_SELECTOR GetGuestDs

(

)

Get the Guest Ds Selector.

Returns

SEGMENT_SELECTOR

{
    VMX_SEGMENT_SELECTOR Ds;
 
    __vmx_vmread(VMCS_GUEST_DS_BASE, &Ds.Base);
    VmxVmread32P(VMCS_GUEST_DS_LIMIT, &Ds.Limit);
    VmxVmread32P(VMCS_GUEST_DS_ACCESS_RIGHTS, &Ds.Attributes.AsUInt);
    VmxVmread16P(VMCS_GUEST_DS_SELECTOR, &Ds.Selector);
 
    return Ds;
}

GetGuestEs()

IMPORT_EXPORT_VMM VMX_SEGMENT_SELECTOR GetGuestEs

(

)

Get the Guest Es Selector.

Returns

SEGMENT_SELECTOR

{
    VMX_SEGMENT_SELECTOR Es;
 
    __vmx_vmread(VMCS_GUEST_ES_BASE, &Es.Base);
    VmxVmread32P(VMCS_GUEST_ES_LIMIT, &Es.Limit);
    VmxVmread32P(VMCS_GUEST_ES_ACCESS_RIGHTS, &Es.Attributes.AsUInt);
    VmxVmread16P(VMCS_GUEST_ES_SELECTOR, &Es.Selector);
 
    return Es;
}

GetGuestFs()

IMPORT_EXPORT_VMM VMX_SEGMENT_SELECTOR GetGuestFs

(

)

Get the Guest Fs Selector.

Returns

SEGMENT_SELECTOR

{
    VMX_SEGMENT_SELECTOR Fs;
 
    __vmx_vmread(VMCS_GUEST_FS_BASE, &Fs.Base);
    VmxVmread32P(VMCS_GUEST_FS_LIMIT, &Fs.Limit);
    VmxVmread32P(VMCS_GUEST_FS_ACCESS_RIGHTS, &Fs.Attributes.AsUInt);
    VmxVmread16P(VMCS_GUEST_FS_SELECTOR, &Fs.Selector);
 
    return Fs;
}

GetGuestGdtr()

IMPORT_EXPORT_VMM UINT64 GetGuestGdtr

(

)

Get the Guest Gdtr.

Returns

UINT64

{
    UINT64 Gdtr;
 
    __vmx_vmread(VMCS_GUEST_GDTR_BASE, &Gdtr);
 
    return Gdtr;
}

GetGuestGs()

IMPORT_EXPORT_VMM VMX_SEGMENT_SELECTOR GetGuestGs

(

)

Get the Guest Gs Selector.

Returns

SEGMENT_SELECTOR

{
    VMX_SEGMENT_SELECTOR Gs;
 
    __vmx_vmread(VMCS_GUEST_GS_BASE, &Gs.Base);
    VmxVmread32P(VMCS_GUEST_GS_LIMIT, &Gs.Limit);
    VmxVmread32P(VMCS_GUEST_GS_ACCESS_RIGHTS, &Gs.Attributes.AsUInt);
    VmxVmread16P(VMCS_GUEST_GS_SELECTOR, &Gs.Selector);
 
    return Gs;
}

GetGuestIdtr()

IMPORT_EXPORT_VMM UINT64 GetGuestIdtr

(

)

Get the Guest Idtr.

Returns

UINT64

{
    UINT64 Idtr;
 
    __vmx_vmread(VMCS_GUEST_IDTR_BASE, &Idtr);
 
    return Idtr;
}

GetGuestLdtr()

IMPORT_EXPORT_VMM UINT64 GetGuestLdtr

(

)

Get the Guest Ldtr.

Returns

UINT64

{
    UINT64 Ldtr;
 
    __vmx_vmread(VMCS_GUEST_LDTR_BASE, &Ldtr);
 
    return Ldtr;
}

GetGuestRFlags()

IMPORT_EXPORT_VMM UINT64 GetGuestRFlags

(

)

Get the Guest Rflags value.

Returns

UINT64

{
    UINT64 RFlags;
    __vmx_vmread(VMCS_GUEST_RFLAGS, &RFlags);
    return RFlags;
}

GetGuestRIP()

IMPORT_EXPORT_VMM UINT64 GetGuestRIP

(

)

Get the Guest RIP value.

Returns

UINT64

{
    UINT64 RIP;
 
    __vmx_vmread(VMCS_GUEST_RIP, &RIP);
    return RIP;
}

GetGuestSs()

IMPORT_EXPORT_VMM VMX_SEGMENT_SELECTOR GetGuestSs

(

)

Get the Guest Ss Selector.

Returns

SEGMENT_SELECTOR

{
    VMX_SEGMENT_SELECTOR Ss;
 
    __vmx_vmread(VMCS_GUEST_SS_BASE, &Ss.Base);
    VmxVmread32P(VMCS_GUEST_SS_LIMIT, &Ss.Limit);
    VmxVmread32P(VMCS_GUEST_SS_ACCESS_RIGHTS, &Ss.Attributes.AsUInt);
    VmxVmread16P(VMCS_GUEST_SS_SELECTOR, &Ss.Selector);
 
    return Ss;
}

GetGuestTr()

IMPORT_EXPORT_VMM UINT64 GetGuestTr

(

)

Get the Guest Tr.

Returns

UINT64

{
    UINT64 Tr;
 
    __vmx_vmread(VMCS_GUEST_TR_BASE, &Tr);
 
    return Tr;
}

LayoutGetCurrentProcessCr3()

IMPORT_EXPORT_VMM CR3_TYPE LayoutGetCurrentProcessCr3

(

)

Get cr3 of the target running process.

Returns

CR3_TYPE Returns the cr3 of running process

{
    CR3_TYPE GuestCr3;
 
    //
    // Due to KVA Shadowing, we need to switch to a different directory table base
    // if the PCID indicates this is a user mode directory table base.
    //
    NT_KPROCESS * CurrentProcess = (NT_KPROCESS *)(PsGetCurrentProcess());
    GuestCr3.Flags               = CurrentProcess->DirectoryTableBase;
 
    return GuestCr3;
}

LayoutGetExactGuestProcessCr3()

IMPORT_EXPORT_VMM CR3_TYPE LayoutGetExactGuestProcessCr3

(

)

Get cr3 of the target running process.

Returns

CR3_TYPE Returns the cr3 of running process

{
    CR3_TYPE GuestCr3 = {0};
 
    __vmx_vmread(VMCS_GUEST_CR3, &GuestCr3.Flags);
 
    return GuestCr3;
}

MemoryManagerReadProcessMemoryNormal()

IMPORT_EXPORT_VMM BOOLEAN MemoryManagerReadProcessMemoryNormal	(	HANDLE	PID,
		PVOID	Address,
		DEBUGGER_READ_MEMORY_TYPE	MemType,
		PVOID	UserBuffer,
		SIZE_T	Size,
		PSIZE_T	ReturnSize )

Read process memory.

This function should not be called from vmx-root mode

Parameters

PID	Target Process Id
Address	Target Address
MemType	Type of memory
UserBuffer	Buffer to save to the user. This buffer must be in nonpageable memory.
Size	Size of read
ReturnSize	Return Size

Returns

BOOLEAN

{
    PEPROCESS        SourceProcess;
    MM_COPY_ADDRESS  CopyAddress         = {0};
    KAPC_STATE       State               = {0};
    PHYSICAL_ADDRESS TempPhysicalAddress = {0};
 
    //
    // Check if we want another process memory, this way we attach to that process
    // the find the physical address of the memory and read it from here using physical
    // address
 
    //
    // The second thing that we consider here is reading a physical address doesn't
    // need to attach to another process
    //
    if (PsGetCurrentProcessId() != PID && MemType == DEBUGGER_READ_VIRTUAL_ADDRESS)
    {
        //
        // User needs another process memory
        //
 
        if (PsLookupProcessByProcessId(PID, &SourceProcess) != STATUS_SUCCESS)
        {
            //
            // if the process not found
            //
            return FALSE;
        }
        __try
        {
            KeStackAttachProcess(SourceProcess, &State);
 
            //
            // We're in context of another process let's read the memory
            //
            TempPhysicalAddress = MmGetPhysicalAddress(Address);
 
            KeUnstackDetachProcess(&State);
 
            //
            // Now we have to read the physical address
            //
            CopyAddress.PhysicalAddress.QuadPart = TempPhysicalAddress.QuadPart;
            MmCopyMemory(UserBuffer, CopyAddress, Size, MM_COPY_MEMORY_PHYSICAL, ReturnSize);
 
            ObDereferenceObject(SourceProcess);
 
            return TRUE;
        }
        __except (EXCEPTION_EXECUTE_HANDLER)
        {
            KeUnstackDetachProcess(&State);
 
            ObDereferenceObject(SourceProcess);
 
            return FALSE;
        }
    }
    else
    {
        //
        // Process needs itself memory
        //
        __try
        {
            if (MemType == DEBUGGER_READ_VIRTUAL_ADDRESS)
            {
                CopyAddress.VirtualAddress = Address;
                MmCopyMemory(UserBuffer, CopyAddress, Size, MM_COPY_MEMORY_VIRTUAL, ReturnSize);
            }
            else if (MemType == DEBUGGER_READ_PHYSICAL_ADDRESS)
            {
                //
                // Check whether the physical memory is valid or not
                //
                if (!CheckAddressPhysical((UINT64)Address))
                {
                    return FALSE;
                }
 
                CopyAddress.PhysicalAddress.QuadPart = (LONGLONG)Address;
                MmCopyMemory(UserBuffer, CopyAddress, Size, MM_COPY_MEMORY_PHYSICAL, ReturnSize);
            }
            else
            {
                //
                // Type is not recognized
                //
                return FALSE;
            }
 
            //
            // MmCopyVirtualMemory(SourceProcess, Address, TargetProcess, UserBuffer, Size, KernelMode, ReturnSize);
            // memcpy(UserBuffer, Address, Size);
            //
 
            return TRUE;
        }
        __except (EXCEPTION_EXECUTE_HANDLER)
        {
            return FALSE;
        }
    }
}

MemoryMapperCheckIfPageIsNxBitSetOnTargetProcess()

IMPORT_EXPORT_VMM BOOLEAN MemoryMapperCheckIfPageIsNxBitSetOnTargetProcess

(

_In_ PVOID

Va

)

MemoryMapperCheckIfPdeIsLargePageOnTargetProcess()

IMPORT_EXPORT_VMM BOOLEAN MemoryMapperCheckIfPdeIsLargePageOnTargetProcess

(

_In_ PVOID

Va

)

MemoryMapperCheckPteIsPresentOnTargetProcess()

IMPORT_EXPORT_VMM BOOLEAN MemoryMapperCheckPteIsPresentOnTargetProcess	(	PVOID	Va,
		PAGING_LEVEL	Level )

This function checks whether the virtual address is present in the RAM or not.

Parameters

Va	Virtual Address
Level	PMLx

Returns

BOOLEAN Is present or not

{
    PPAGE_ENTRY PageEntry = NULL;
    CR3_TYPE    GuestCr3;
    CR3_TYPE    CurrentProcessCr3 = {0};
    BOOLEAN     Result            = FALSE;
 
    //
    // Move to guest process as we're currently in system cr3
    //
 
    //
    // Find the current process cr3
    //
    GuestCr3.Flags = LayoutGetCurrentProcessCr3().Flags;
 
    //
    // Switch to new process's memory layout
    // It is because, we're not trying to change the cr3 multiple times
    // so instead of using PhysicalAddressToVirtualAddressByCr3 we use
    // PhysicalAddressToVirtualAddress, but keep in mind that cr3 should
    // be a kernel cr3 (not KPTI user cr3) as the functions to translate
    // physical address to virtual address is not mapped on the user cr3
    //
    CurrentProcessCr3 = SwitchToProcessMemoryLayoutByCr3(GuestCr3);
 
    //
    // Call the wrapper
    //
    PageEntry = MemoryMapperGetPteVaWithoutSwitchingByCr3(Va, Level, GuestCr3);
 
    if (PageEntry == NULL)
    {
        Result = FALSE;
    }
    else
    {
        //
        // Check if page is present or not
        //
        if (PageEntry->Fields.Present == TRUE)
        {
            //
            // It's present
            //
            Result = TRUE;
        }
        else
        {
            //
            // It's not present
            //
            Result = FALSE;
        }
    }
 
    //
    // Restore the original process
    //
    SwitchToPreviousProcess(CurrentProcessCr3);
 
    return Result;
}

MemoryMapperFreeMemoryOnTargetProcess()

IMPORT_EXPORT_VMM BOOLEAN MemoryMapperFreeMemoryOnTargetProcess	(	_In_ UINT32	ProcessId,
		_Inout_ PVOID	BaseAddress )

MemoryMapperGetPteVa()

IMPORT_EXPORT_VMM PVOID MemoryMapperGetPteVa	(	_In_ PVOID	Va,
		_In_ PAGING_LEVEL	Level )

MemoryMapperGetPteVaByCr3()

IMPORT_EXPORT_VMM PVOID MemoryMapperGetPteVaByCr3	(	_In_ PVOID	Va,
		_In_ PAGING_LEVEL	Level,
		_In_ CR3_TYPE	TargetCr3 )

MemoryMapperGetPteVaOnTargetProcess()

IMPORT_EXPORT_VMM PVOID MemoryMapperGetPteVaOnTargetProcess	(	_In_ PVOID	Va,
		_In_ PAGING_LEVEL	Level )

MemoryMapperGetPteVaWithoutSwitchingByCr3()

IMPORT_EXPORT_VMM PVOID MemoryMapperGetPteVaWithoutSwitchingByCr3	(	_In_ PVOID	Va,
		_In_ PAGING_LEVEL	Level,
		_In_ CR3_TYPE	TargetCr3 )

MemoryMapperReadMemorySafe()

IMPORT_EXPORT_VMM BOOLEAN MemoryMapperReadMemorySafe	(	_In_ UINT64	VaAddressToRead,
		_Inout_ PVOID	BufferToSaveMemory,
		_In_ SIZE_T	SizeToRead )

MemoryMapperReadMemorySafeByPhysicalAddress()

IMPORT_EXPORT_VMM BOOLEAN MemoryMapperReadMemorySafeByPhysicalAddress	(	_In_ UINT64	PaAddressToRead,
		_Inout_ UINT64	BufferToSaveMemory,
		_In_ SIZE_T	SizeToRead )

MemoryMapperReadMemorySafeOnTargetProcess()

IMPORT_EXPORT_VMM BOOLEAN MemoryMapperReadMemorySafeOnTargetProcess	(	_In_ UINT64	VaAddressToRead,
		_Inout_ PVOID	BufferToSaveMemory,
		_In_ SIZE_T	SizeToRead )

MemoryMapperReserveUsermodeAddressOnTargetProcess()

IMPORT_EXPORT_VMM UINT64 MemoryMapperReserveUsermodeAddressOnTargetProcess	(	_In_ UINT32	ProcessId,
		_In_ BOOLEAN	Allocate )

MemoryMapperSetExecuteDisableToPteOnTargetProcess()

IMPORT_EXPORT_VMM PVOID MemoryMapperSetExecuteDisableToPteOnTargetProcess	(	_In_ PVOID	Va,
		_In_ BOOLEAN	Set )

MemoryMapperSetSupervisorBitWithoutSwitchingByCr3()

IMPORT_EXPORT_VMM BOOLEAN MemoryMapperSetSupervisorBitWithoutSwitchingByCr3	(	_In_ PVOID	Va,
		_In_ BOOLEAN	Set,
		_In_ PAGING_LEVEL	Level,
		_In_ CR3_TYPE	TargetCr3 )

MemoryMapperWriteMemorySafe()

IMPORT_EXPORT_VMM BOOLEAN MemoryMapperWriteMemorySafe	(	_Inout_ UINT64	Destination,
		_In_ PVOID	Source,
		_In_ SIZE_T	SizeToWrite,
		_In_ CR3_TYPE	TargetProcessCr3 )

MemoryMapperWriteMemorySafeByPhysicalAddress()

IMPORT_EXPORT_VMM BOOLEAN MemoryMapperWriteMemorySafeByPhysicalAddress	(	_Inout_ UINT64	DestinationPa,
		_In_ UINT64	Source,
		_In_ SIZE_T	SizeToWrite )

MemoryMapperWriteMemorySafeOnTargetProcess()

IMPORT_EXPORT_VMM BOOLEAN MemoryMapperWriteMemorySafeOnTargetProcess	(	_Inout_ UINT64	Destination,
		_In_ PVOID	Source,
		_In_ SIZE_T	Size )

MemoryMapperWriteMemoryUnsafe()

IMPORT_EXPORT_VMM BOOLEAN MemoryMapperWriteMemoryUnsafe	(	_Inout_ UINT64	Destination,
		_In_ PVOID	Source,
		_In_ SIZE_T	SizeToWrite,
		_In_ UINT32	TargetProcessId )

PhysicalAddressToVirtualAddress()

IMPORT_EXPORT_VMM UINT64 PhysicalAddressToVirtualAddress

(

_In_ UINT64

PhysicalAddress

)

PhysicalAddressToVirtualAddressByCr3()

IMPORT_EXPORT_VMM UINT64 PhysicalAddressToVirtualAddressByCr3	(	_In_ PVOID	PhysicalAddress,
		_In_ CR3_TYPE	TargetCr3 )

PhysicalAddressToVirtualAddressByProcessId()

IMPORT_EXPORT_VMM UINT64 PhysicalAddressToVirtualAddressByProcessId	(	_In_ PVOID	PhysicalAddress,
		_In_ UINT32	ProcessId )

PhysicalAddressToVirtualAddressOnTargetProcess()

IMPORT_EXPORT_VMM UINT64 PhysicalAddressToVirtualAddressOnTargetProcess

(

_In_ PVOID

PhysicalAddress

)

PoolManagerCheckAndPerformAllocationAndDeallocation()

IMPORT_EXPORT_VMM BOOLEAN PoolManagerCheckAndPerformAllocationAndDeallocation

(

)

This function performs allocations from VMX non-root based on g_RequestNewAllocation.

Returns

BOOLEAN If the pool manager allocates buffer or there was no buffer to allocate then it returns true, if there was any error then it returns false

{
    BOOLEAN     Result   = TRUE;
    PLIST_ENTRY ListTemp = 0;
 
    //
    // let's make sure we're on vmx non-root and also we have new allocation
    //
    if (VmxGetCurrentExecutionMode() == TRUE)
    {
        //
        // allocation's can't be done from vmx root
        //
        return FALSE;
    }
 
    //
    // Make sure paging works properly
    //
    PAGED_CODE();
 
    //
    // Check for new allocation
    //
    if (g_IsNewRequestForAllocationReceived)
    {
        for (SIZE_T i = 0; i < MaximumRequestsQueueDepth; i++)
        {
            REQUEST_NEW_ALLOCATION * CurrentItem = &g_RequestNewAllocation[i];
 
            if (CurrentItem->Size != 0)
            {
                Result = PoolManagerAllocateAndAddToPoolTable(CurrentItem->Size,
                                                              CurrentItem->Count,
                                                              CurrentItem->Intention);
 
                //
                // Free the data for future use
                //
                CurrentItem->Count     = 0;
                CurrentItem->Intention = 0;
                CurrentItem->Size      = 0;
            }
        }
    }
 
    //
    // Check for deallocation
    //
    if (g_IsNewRequestForDeAllocation)
    {
        ListTemp = &g_ListOfAllocatedPoolsHead;
 
        SpinlockLock(&LockForReadingPool);
 
        while (&g_ListOfAllocatedPoolsHead != ListTemp->Flink)
        {
            ListTemp = ListTemp->Flink;
 
            //
            // Get the head of the record
            //
            PPOOL_TABLE PoolTable = (PPOOL_TABLE)CONTAINING_RECORD(ListTemp, POOL_TABLE, PoolsList);
 
            //
            // Check whether this pool should be freed or not and
            // also check whether it's already freed or not
            //
            if (PoolTable->ShouldBeFreed && !PoolTable->AlreadyFreed)
            {
                //
                // Set the flag to indicate that we freed
                //
                PoolTable->AlreadyFreed = TRUE;
 
                //
                // This item should be freed
                //
                PlatformMemFreePool((PVOID)PoolTable->Address);
 
                //
                // Now we should remove the entry from the g_ListOfAllocatedPoolsHead
                //
                RemoveEntryList(&PoolTable->PoolsList);
 
                //
                // Free the structure pool
                //
                PlatformMemFreePool(PoolTable);
            }
        }
 
        SpinlockUnlock(&LockForReadingPool);
    }
 
    //
    // All allocation and deallocation are performed
    //
    g_IsNewRequestForDeAllocation       = FALSE;
    g_IsNewRequestForAllocationReceived = FALSE;
 
    return Result;
}

PoolManagerFreePool()

IMPORT_EXPORT_VMM BOOLEAN PoolManagerFreePool

(

UINT64

AddressToFree

)

This function set a pool flag to be freed, and it will be freed on the next IOCTL when it's safe to remove.

Parameters

AddressToFree

The pool address that was previously obtained from the pool manager

Returns

BOOLEAN If the address was already in the list of allocated pools by pool manager then it returns TRUE; otherwise, FALSE

{
    PLIST_ENTRY ListTemp = 0;
    BOOLEAN     Result   = FALSE;
    ListTemp             = &g_ListOfAllocatedPoolsHead;
 
    SpinlockLock(&LockForReadingPool);
 
    while (&g_ListOfAllocatedPoolsHead != ListTemp->Flink)
    {
        ListTemp = ListTemp->Flink;
 
        //
        // Get the head of the record
        //
        PPOOL_TABLE PoolTable = (PPOOL_TABLE)CONTAINING_RECORD(ListTemp, POOL_TABLE, PoolsList);
 
        if (PoolTable->Address == AddressToFree)
        {
            //
            // We found an entry that matched the detailed from
            // previously allocated pools
            //
            PoolTable->ShouldBeFreed = TRUE;
            Result                   = TRUE;
 
            g_IsNewRequestForDeAllocation = TRUE;
            break;
        }
    }
 
    SpinlockUnlock(&LockForReadingPool);
    return Result;
}

PoolManagerRequestAllocation()

IMPORT_EXPORT_VMM BOOLEAN PoolManagerRequestAllocation	(	SIZE_T	Size,
		UINT32	Count,
		POOL_ALLOCATION_INTENTION	Intention )

Request to allocate new buffers.

Parameters

Size	Request new buffer to allocate
Count	Count of chunks
Intention	The intention of chunks (buffer tag)

Returns

BOOLEAN If the request is save it returns true otherwise it returns false

{
    BOOLEAN FoundAPlace = FALSE;
 
    //
    // ******** We check to find a free place to store ********
    //
 
    SpinlockLock(&LockForRequestAllocation);
 
    for (SIZE_T i = 0; i < MaximumRequestsQueueDepth; i++)
    {
        REQUEST_NEW_ALLOCATION * CurrentItem = &g_RequestNewAllocation[i];
 
        if (CurrentItem->Size == 0)
        {
            CurrentItem->Count     = Count;
            CurrentItem->Intention = Intention;
            CurrentItem->Size      = Size;
 
            FoundAPlace = TRUE;
 
            break;
        }
    }
 
    if (!FoundAPlace)
    {
        SpinlockUnlock(&LockForRequestAllocation);
        return FALSE;
    }
 
    //
    // Signals to show that we have new allocations
    //
    g_IsNewRequestForAllocationReceived = TRUE;
 
    SpinlockUnlock(&LockForRequestAllocation);
    return TRUE;
}

PoolManagerRequestPool()

IMPORT_EXPORT_VMM UINT64 PoolManagerRequestPool	(	POOL_ALLOCATION_INTENTION	Intention,
		BOOLEAN	RequestNewPool,
		UINT32	Size )

This function should be called from vmx-root in order to get a pool from the list.

If RequestNewPool is TRUE then Size is used, otherwise Size is useless Note : Most of the times this function called from vmx root but not all the time

Parameters

Intention	The intention why we need this pool for (buffer tag)
RequestNewPool	Create a request to allocate a new pool with the same size, next time that it's safe to allocate (this way we never ran out of pools for this "Intention")
Size	If the RequestNewPool is true the we should specify a size for the new pool

Returns

UINT64 Returns a pool address or returns null if there was an error

{
    UINT64 Address = 0;
 
    ScopedSpinlock(
        LockForReadingPool,
        LIST_FOR_EACH_LINK(g_ListOfAllocatedPoolsHead, POOL_TABLE, PoolsList, PoolTable) {
            if (PoolTable->Intention == Intention && PoolTable->IsBusy == FALSE)
            {
                PoolTable->IsBusy = TRUE;
                Address           = PoolTable->Address;
                break;
            }
        });
 
    //
    // Check if we need additional pools e.g another pool or the pool
    // will be available for the next use blah blah
    //
    if (RequestNewPool)
    {
        PoolManagerRequestAllocation(Size, 1, Intention);
    }
 
    //
    // return Address might be null indicating there is no valid pools
    //
    return Address;
}

PoolManagerShowPreAllocatedPools()

IMPORT_EXPORT_VMM VOID PoolManagerShowPreAllocatedPools

(

)

Shows list of pre-allocated pools available (used for debugging purposes)

Returns

VOID

{
    PLIST_ENTRY ListTemp = 0;
    ListTemp             = &g_ListOfAllocatedPoolsHead;
 
    while (&g_ListOfAllocatedPoolsHead != ListTemp->Flink)
    {
        ListTemp = ListTemp->Flink;
 
        //
        // Get the head of the record
        //
        PPOOL_TABLE PoolTable = (PPOOL_TABLE)CONTAINING_RECORD(ListTemp, POOL_TABLE, PoolsList);
 
        LogInfo("Pool details, Pool intention: %x | Pool address: %llx | Pool state: %s | Should be freed: %s | Already freed: %s\n",
                PoolTable->Intention,
                PoolTable->Address,
                PoolTable->IsBusy ? "used" : "free",
                PoolTable->ShouldBeFreed ? "true" : "false",
                PoolTable->AlreadyFreed ? "true" : "false");
    }
}

SetDebugRegisters()

IMPORT_EXPORT_VMM BOOLEAN SetDebugRegisters	(	UINT32	DebugRegNum,
		DEBUG_REGISTER_TYPE	ActionType,
		BOOLEAN	ApplyToVmcs,
		UINT64	TargetAddress )

Configure hardware debug register for access, write and fetch breakpoints.

if apply to vmcs is true then should be called at vmx-root mode keep in mind that it applies only on one core Also, the caller must be sure that Load Debug Controls and Save Debug Controls on VM-entry and VM-exit controls on the VMCS of the target core, vmcalls VMCALL_SET_VM_ENTRY_LOAD_DEBUG_CONTROLS and VMCALL_SET_VM_EXIT_SAVE_DEBUG_CONTROLS are designed for this purpose should be called on vmx-root mode if the ApplyToVmcs is TRUE

Parameters

DebugRegNum	Debug register that want to apply to it (can be between 0 to 3 as current processors support only 4 locations on hardware debug register)
ActionType	Type of breakpoint (Access, write, fetch)
ApplyToVmcs	Apply on GUEST_RIP register of VMCS, see details above for more information
TargetAddress	Target breakpoint virtual address

Returns

BOOLEAN If TRUE, shows the request configuration is correct, otherwise it's either not supported or not correct configuration

{
    DR7 Dr7 = {0};
 
    //
    // Debug registers can be dr0, dr1, dr2, dr3
    //
    if (DebugRegNum >= 4)
    {
        return FALSE;
    }
 
    //
    // Configure the dr7 (dr6 is only to show the status)
    // the configuration derived from https://stackoverflow.com/questions/40818920/
    //
    // Check-list:
    //     - Set the reserved bits to their right values
    //     - Set DR7.LE and DR7.GE to 1
    //     - Set DR7.L0(L1, L2, L3) to 1 [local breakpoint]
    //     - Make sure DR7.RW/0 (RW/1, RW/2, RW/3) is 0 [break on instruction exec]
    //     - Make sure DR7.LEN0 (LEN1, LEN2, LEN3) is 0 [1 byte length]
    //     - Set DR0 (1, 2, 3) to the instruction linear address
    //     - Make sure linear address [DR0 to DR3] falls on the first byte of the instruction
    //
 
    //
    // Must be 1
    //
    Dr7.Reserved1 = 1;
 
    //
    // Based on Intel Manual:
    // we recommend that the LE and GE flags be set to 1 if exact breakpoints are required
    //
    Dr7.LocalExactBreakpoint  = 1;
    Dr7.GlobalExactBreakpoint = 1;
 
    //
    // Set the target address and enable it on dr7
    //
    if (DebugRegNum == 0)
    {
        __writedr(0, TargetAddress);
 
        Dr7.GlobalBreakpoint0 = 1;
 
        //
        // Based on SDM :
        //   00 - Break on instruction execution only.
        //   01 - Break on data writes only.
        //   10 - Break on I/O reads or writes.
        //   11 - Break on data reads or writes but not instruction fetches
        // Also 10, is based on another bit so it is configured based on
        // other bits, read the SDM for more.
        //
 
        switch (ActionType)
        {
        case BREAK_ON_INSTRUCTION_FETCH:
            Dr7.ReadWrite0 = 0b00; // 0b00 => 0
            break;
        case BREAK_ON_WRITE_ONLY:
            Dr7.ReadWrite0 = 0b01; // 0b01 => 1
            break;
        case BREAK_ON_IO_READ_OR_WRITE_NOT_SUPPORTED:
            Dr7.ReadWrite0 = 0b10; // 0b10 => 2
            LogError("Err, I/O access breakpoint by debug regs are not supported");
            return FALSE;
            break;
        case BREAK_ON_READ_AND_WRITE_BUT_NOT_FETCH:
            Dr7.ReadWrite0 = 0b11; // 0b11 => 3
            break;
 
        default:
            //
            // what?
            //
            LogError("Err, unknown parameter as debug reg action type");
            return FALSE;
            break;
        }
    }
    else if (DebugRegNum == 1)
    {
        __writedr(1, TargetAddress);
        Dr7.GlobalBreakpoint1 = 1;
 
        //
        // Based on SDM :
        //   00 - Break on instruction execution only.
        //   01 - Break on data writes only.
        //   10 - Break on I/O reads or writes.
        //   11 - Break on data reads or writes but not instruction fetches
        // Also 10, is based on another bit so it is configured based on
        // other bits, read the SDM for more.
        //
 
        switch (ActionType)
        {
        case BREAK_ON_INSTRUCTION_FETCH:
            Dr7.ReadWrite1 = 0b00; // 0b00 => 0
            break;
        case BREAK_ON_WRITE_ONLY:
            Dr7.ReadWrite1 = 0b01; // 0b01 => 1
            break;
        case BREAK_ON_IO_READ_OR_WRITE_NOT_SUPPORTED:
            Dr7.ReadWrite1 = 0b10; // 0b10 => 2
            LogError("Err, I/O access breakpoint by debug regs are not supported");
            return FALSE;
            break;
        case BREAK_ON_READ_AND_WRITE_BUT_NOT_FETCH:
            Dr7.ReadWrite1 = 0b11; // 0b11 => 3
            break;
 
        default:
            //
            // what?
            //
            LogError("Err, unknown parameter as debug reg action type");
            return FALSE;
            break;
        }
    }
    else if (DebugRegNum == 2)
    {
        __writedr(2, TargetAddress);
        Dr7.GlobalBreakpoint2 = 1;
 
        //
        // Based on SDM :
        //   00 - Break on instruction execution only.
        //   01 - Break on data writes only.
        //   10 - Break on I/O reads or writes.
        //   11 - Break on data reads or writes but not instruction fetches
        // Also 10, is based on another bit so it is configured based on
        // other bits, read the SDM for more.
        //
 
        switch (ActionType)
        {
        case BREAK_ON_INSTRUCTION_FETCH:
            Dr7.ReadWrite2 = 0b00; // 0b00 => 0
            break;
        case BREAK_ON_WRITE_ONLY:
            Dr7.ReadWrite2 = 0b01; // 0b01 => 1
            break;
        case BREAK_ON_IO_READ_OR_WRITE_NOT_SUPPORTED:
            Dr7.ReadWrite2 = 0b10; // 0b10 => 2
            LogError("Err, I/O access breakpoint by debug regs are not supported");
            return FALSE;
            break;
        case BREAK_ON_READ_AND_WRITE_BUT_NOT_FETCH:
            Dr7.ReadWrite2 = 0b11; // 0b11 => 3
            break;
 
        default:
            //
            // what?
            //
            LogError("Err, unknown parameter as debug reg action type");
            return FALSE;
            break;
        }
    }
    else if (DebugRegNum == 3)
    {
        __writedr(3, TargetAddress);
        Dr7.GlobalBreakpoint3 = 1;
 
        //
        // Based on SDM :
        //   00 - Break on instruction execution only.
        //   01 - Break on data writes only.
        //   10 - Break on I/O reads or writes.
        //   11 - Break on data reads or writes but not instruction fetches
        // Also 10, is based on another bit so it is configured based on
        // other bits, read the SDM for more.
        //
 
        switch (ActionType)
        {
        case BREAK_ON_INSTRUCTION_FETCH:
            Dr7.ReadWrite3 = 0b00; // 0b00 => 0
            break;
        case BREAK_ON_WRITE_ONLY:
            Dr7.ReadWrite3 = 0b01; // 0b01 => 1
            break;
        case BREAK_ON_IO_READ_OR_WRITE_NOT_SUPPORTED:
            Dr7.ReadWrite3 = 0b10; // 0b10 => 2
            LogError("Err, I/O access breakpoint by debug regs are not supported");
            return FALSE;
            break;
        case BREAK_ON_READ_AND_WRITE_BUT_NOT_FETCH:
            Dr7.ReadWrite3 = 0b11; // 0b11 => 3
            break;
 
        default:
            //
            // what?
            //
            LogError("Err, unknown parameter as debug reg action type");
            return FALSE;
            break;
        }
    }
 
    //
    // Applies to debug register 7, the caller must be sure that Load Debug
    // Controls and Save Debug Controls on VM-entry and VM-exit controls
    // on the VMCS of the target core
    //
    if (ApplyToVmcs)
    {
        __vmx_vmwrite(VMCS_GUEST_DR7, Dr7.AsUInt);
    }
    else
    {
        __writedr(7, Dr7.AsUInt);
    }
 
    return TRUE;
}

SetGuestCr0()

IMPORT_EXPORT_VMM VOID SetGuestCr0

(

UINT64

Cr0

)

Set the Guest Cr0 Register.

Parameters

Cr0	The Cr0 Value for the guest

Returns

VOID

{
    VmxVmwrite64(VMCS_GUEST_CR0, Cr0);
}

SetGuestCr2()

IMPORT_EXPORT_VMM VOID SetGuestCr2

(

UINT64

Cr2

)

Set the Guest Cr2 Register.

Parameters

Cr2	The Cr2 Value for the guest

Returns

VOID

{
    __writecr2(Cr2);
}

SetGuestCr3()

IMPORT_EXPORT_VMM VOID SetGuestCr3

(

UINT64

Cr3

)

Set the Guest Cr3 Register.

Parameters

Cr3	The Cr3 Value for the guest

Returns

VOID

{
    VmxVmwrite64(VMCS_GUEST_CR3, Cr3);
}

SetGuestCr4()

IMPORT_EXPORT_VMM VOID SetGuestCr4

(

UINT64

Cr4

)

Set the Guest Cr4 Register.

Parameters

Cr4	The Cr4 Value for the guest

Returns

VOID

{
    VmxVmwrite64(VMCS_GUEST_CR4, Cr4);
}

SetGuestCr8()

IMPORT_EXPORT_VMM VOID SetGuestCr8

(

UINT64

Cr8

)

Set the Guest Cr8 Register.

Parameters

Cr8	The Cr8 Value for the guest

Returns

VOID

{
    __writecr8(Cr8);
}

SetGuestCs()

IMPORT_EXPORT_VMM VOID SetGuestCs

(

PVMX_SEGMENT_SELECTOR

Cs

)

Set the Guest Cs.

Parameters

Cs	The CS Selector for the guest

Returns

VOID

{
    __vmx_vmwrite(VMCS_GUEST_CS_BASE, Cs->Base);
    __vmx_vmwrite(VMCS_GUEST_CS_LIMIT, Cs->Limit);
    __vmx_vmwrite(VMCS_GUEST_CS_ACCESS_RIGHTS, Cs->Attributes.AsUInt);
    __vmx_vmwrite(VMCS_GUEST_CS_SELECTOR, Cs->Selector);
}

SetGuestCsSel()

IMPORT_EXPORT_VMM VOID SetGuestCsSel

(

PVMX_SEGMENT_SELECTOR

Cs

)

Set just the Guest Cs selector.

Parameters

Cs	The CS Selector for the guest

Returns

VOID

{
    __vmx_vmwrite(VMCS_GUEST_CS_SELECTOR, Cs->Selector);
}

SetGuestDr0()

IMPORT_EXPORT_VMM VOID SetGuestDr0

(

UINT64

value

)

Set the Guest Dr0 Register.

Parameters

Dr0	The Dr0 Value for the guest

Returns

VOID

{
    __writedr(0, value);
}

SetGuestDr1()

IMPORT_EXPORT_VMM VOID SetGuestDr1

(

UINT64

value

)

Set the Guest Dr1 Register.

Parameters

Dr1	The Dr1 Value for the guest

Returns

VOID

{
    __writedr(1, value);
}

SetGuestDr2()

IMPORT_EXPORT_VMM VOID SetGuestDr2

(

UINT64

value

)

Set the Guest Dr2 Register.

Parameters

Dr2	The Dr2 Value for the guest

Returns

VOID

{
    __writedr(2, value);
}

SetGuestDr3()

IMPORT_EXPORT_VMM VOID SetGuestDr3

(

UINT64

value

)

Set the Guest Dr3 Register.

Parameters

Dr3	The Dr3 Value for the guest

Returns

VOID

{
    __writedr(3, value);
}

SetGuestDr6()

IMPORT_EXPORT_VMM VOID SetGuestDr6

(

UINT64

value

)

Set the Guest Dr6 Register.

Parameters

Dr6	The Dr6 Value for the guest

Returns

VOID

{
    __writedr(6, value);
}

SetGuestDr7()

IMPORT_EXPORT_VMM VOID SetGuestDr7

(

UINT64

value

)

Set the Guest Dr7 Register.

Parameters

Dr7	The Dr7 Value for the guest

Returns

VOID

{
    __writedr(7, value);
}

SetGuestDs()

IMPORT_EXPORT_VMM VOID SetGuestDs

(

PVMX_SEGMENT_SELECTOR

Ds

)

Set the Guest Ds selector.

Parameters

Ds	The DS Selector for the guest

Returns

VOID

{
    VmxVmwrite64(VMCS_GUEST_DS_BASE, Ds->Base);
    VmxVmwrite64(VMCS_GUEST_DS_LIMIT, Ds->Limit);
    VmxVmwrite64(VMCS_GUEST_DS_ACCESS_RIGHTS, Ds->Attributes.AsUInt);
    VmxVmwrite64(VMCS_GUEST_DS_SELECTOR, Ds->Selector);
}

SetGuestDsSel()

IMPORT_EXPORT_VMM VOID SetGuestDsSel

(

PVMX_SEGMENT_SELECTOR

Ds

)

Set just the Guest Ds selector.

Parameters

Ds	The DS Selector for the guest

Returns

VOID

{
    VmxVmwrite64(VMCS_GUEST_DS_SELECTOR, Ds->Selector);
}

SetGuestEs()

IMPORT_EXPORT_VMM VOID SetGuestEs

(

PVMX_SEGMENT_SELECTOR

Es

)

Set the Guest Es selector.

Parameters

Es	The ES Selector for the guest

Returns

VOID

{
    VmxVmwrite64(VMCS_GUEST_ES_BASE, Es->Base);
    VmxVmwrite64(VMCS_GUEST_ES_LIMIT, Es->Limit);
    VmxVmwrite64(VMCS_GUEST_ES_ACCESS_RIGHTS, Es->Attributes.AsUInt);
    VmxVmwrite64(VMCS_GUEST_ES_SELECTOR, Es->Selector);
}

SetGuestEsSel()

IMPORT_EXPORT_VMM VOID SetGuestEsSel

(

PVMX_SEGMENT_SELECTOR

Es

)

Set just the Guest Es selector.

Parameters

Es	The ES Selector for the guest

Returns

VOID

{
    VmxVmwrite64(VMCS_GUEST_ES_SELECTOR, Es->Selector);
}

SetGuestFs()

IMPORT_EXPORT_VMM VOID SetGuestFs

(

PVMX_SEGMENT_SELECTOR

Fs

)

Set the Guest Fs selector.

Parameters

Fs	The FS Selector for the guest

Returns

VOID

{
    VmxVmwrite64(VMCS_GUEST_FS_BASE, Fs->Base);
    VmxVmwrite64(VMCS_GUEST_FS_LIMIT, Fs->Limit);
    VmxVmwrite64(VMCS_GUEST_FS_ACCESS_RIGHTS, Fs->Attributes.AsUInt);
    VmxVmwrite64(VMCS_GUEST_FS_SELECTOR, Fs->Selector);
}

SetGuestFsSel()

IMPORT_EXPORT_VMM VOID SetGuestFsSel

(

PVMX_SEGMENT_SELECTOR

Fs

)

Set just the Guest Fs selector.

Parameters

Fs	The FS Selector for the guest

Returns

VOID

{
    VmxVmwrite64(VMCS_GUEST_FS_SELECTOR, Fs->Selector);
}

SetGuestGdtr()

IMPORT_EXPORT_VMM VOID SetGuestGdtr

(

UINT64

Gdtr

)

Set the Guest Gdtr.

Parameters

Gdtr	The Gdtr Selector for the guest

Returns

VOID

{
    VmxVmwrite64(VMCS_GUEST_GDTR_BASE, Gdtr);
}

SetGuestGs()

IMPORT_EXPORT_VMM VOID SetGuestGs

(

PVMX_SEGMENT_SELECTOR

Gs

)

Set the Guest Gs selector.

Parameters

Gs	The GS Selector for the guest

Returns

VOID

{
    VmxVmwrite64(VMCS_GUEST_GS_BASE, Gs->Base);
    VmxVmwrite64(VMCS_GUEST_GS_LIMIT, Gs->Limit);
    VmxVmwrite64(VMCS_GUEST_GS_ACCESS_RIGHTS, Gs->Attributes.AsUInt);
    VmxVmwrite64(VMCS_GUEST_GS_SELECTOR, Gs->Selector);
}

SetGuestGsSel()

IMPORT_EXPORT_VMM VOID SetGuestGsSel

(

PVMX_SEGMENT_SELECTOR

Gs

)

Set just the Guest Gs selector.

Parameters

Gs	The GS Selector for the guest

Returns

VOID

{
    VmxVmwrite64(VMCS_GUEST_GS_SELECTOR, Gs->Selector);
}

SetGuestIdtr()

IMPORT_EXPORT_VMM VOID SetGuestIdtr

(

UINT64

Idtr

)

Set the Guest Idtr.

Parameters

Idtr	The Idtr Selector for the guest

Returns

VOID

{
    VmxVmwrite64(VMCS_GUEST_IDTR_BASE, Idtr);
}

SetGuestLdtr()

IMPORT_EXPORT_VMM VOID SetGuestLdtr

(

UINT64

Ldtr

)

Set the Guest Ldtr.

Parameters

Ldtr	The Idtr Selector for the guest

Returns

VOID

{
    VmxVmwrite64(VMCS_GUEST_LDTR_BASE, Ldtr);
}

SetGuestRFlags()

IMPORT_EXPORT_VMM VOID SetGuestRFlags

(

UINT64

RFlags

)

Set the Guest RFLAGS Register.

Parameters

Rflags

The Rflags Value for the guest

Returns

VOID

{
    VmxVmwrite64(VMCS_GUEST_RFLAGS, RFlags);
}

SetGuestRIP()

IMPORT_EXPORT_VMM VOID SetGuestRIP

(

UINT64

RIP

)

Set the Guest RIP Register.

Parameters

RIP	The RIP Value for the guest

Returns

VOID

{
    VmxVmwrite64(VMCS_GUEST_RIP, RIP);
}

SetGuestRSP()

IMPORT_EXPORT_VMM VOID SetGuestRSP

(

UINT64

RSP

)

Set the Guest RSP Register.

Parameters

RSP	The RSP Value for the guest

Returns

VOID

{
    VmxVmwrite64(VMCS_GUEST_RSP, RSP);
}

SetGuestSs()

IMPORT_EXPORT_VMM VOID SetGuestSs

(

PVMX_SEGMENT_SELECTOR

Ss

)

Set the Guest Ss selector.

Parameters

Ss	The SS Selector for the guest

Returns

VOID

{
    VmxVmwrite64(VMCS_GUEST_SS_BASE, Ss->Base);
    VmxVmwrite64(VMCS_GUEST_SS_LIMIT, Ss->Limit);
    VmxVmwrite64(VMCS_GUEST_SS_ACCESS_RIGHTS, Ss->Attributes.AsUInt);
    VmxVmwrite64(VMCS_GUEST_SS_SELECTOR, Ss->Selector);
}

SetGuestSsSel()

IMPORT_EXPORT_VMM VOID SetGuestSsSel

(

PVMX_SEGMENT_SELECTOR

Ss

)

Set just the Guest Ss selector.

Parameters

Ss	The SS Selector for the guest

Returns

VOID

{
    __vmx_vmwrite(VMCS_GUEST_SS_SELECTOR, Ss->Selector);
}

SetGuestTr()

IMPORT_EXPORT_VMM VOID SetGuestTr

(

UINT64

Tr

)

Parameters

Tr	The Tr Selector for the guest

Returns

VOID

{
    VmxVmwrite64(VMCS_GUEST_TR_BASE, Tr);
}

SwitchToCurrentProcessMemoryLayout()

IMPORT_EXPORT_VMM CR3_TYPE SwitchToCurrentProcessMemoryLayout

(

)

Switch to guest's running process's cr3.

this function can be called from vmx-root mode

Returns

CR3_TYPE The cr3 of current process which can be used by SwitchToPreviousProcess function

{
    CR3_TYPE GuestCr3;
    CR3_TYPE CurrentProcessCr3 = {0};
 
    GuestCr3.Flags = LayoutGetCurrentProcessCr3().Flags;
 
    //
    // Read the current cr3
    //
    CurrentProcessCr3.Flags = __readcr3();
 
    //
    // Change to a new cr3 (of target process)
    //
    __writecr3(GuestCr3.Flags);
 
    return CurrentProcessCr3;
}

SwitchToPreviousProcess()

IMPORT_EXPORT_VMM VOID SwitchToPreviousProcess

(

_In_ CR3_TYPE

PreviousProcess

)

SwitchToProcessMemoryLayout()

IMPORT_EXPORT_VMM CR3_TYPE SwitchToProcessMemoryLayout

(

_In_ UINT32

ProcessId

)

SwitchToProcessMemoryLayoutByCr3()

IMPORT_EXPORT_VMM CR3_TYPE SwitchToProcessMemoryLayoutByCr3

(

_In_ CR3_TYPE

TargetCr3

)

TransparentHideDebugger()

IMPORT_EXPORT_VMM NTSTATUS TransparentHideDebugger

(

PDEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE

Measurements

)

Hide debugger on transparent-mode (activate transparent-mode)

Parameters

Measurements

Returns

NTSTATUS

{
    //
    // Check whether the transparent-mode was already initialized or not
    //
    if (!g_TransparentMode)
    {
        //
        // Allocate the measurements buffer
        //
        g_TransparentModeMeasurements = (PTRANSPARENCY_MEASUREMENTS)PlatformMemAllocateZeroedNonPagedPool(sizeof(TRANSPARENCY_MEASUREMENTS));
 
        if (!g_TransparentModeMeasurements)
        {
            return STATUS_INSUFFICIENT_RESOURCES;
        }
 
        //
        // Initialize the lists
        //
        InitializeListHead(&g_TransparentModeMeasurements->ProcessList);
 
        //
        // Fill the transparency details CPUID
        //
        g_TransparentModeMeasurements->CpuidAverage           = Measurements->CpuidAverage;
        g_TransparentModeMeasurements->CpuidMedian            = Measurements->CpuidMedian;
        g_TransparentModeMeasurements->CpuidStandardDeviation = Measurements->CpuidStandardDeviation;
 
        //
        // Fill the transparency details RDTSC
        //
        g_TransparentModeMeasurements->RdtscAverage           = Measurements->RdtscAverage;
        g_TransparentModeMeasurements->RdtscMedian            = Measurements->RdtscMedian;
        g_TransparentModeMeasurements->RdtscStandardDeviation = Measurements->RdtscStandardDeviation;
 
        //
        // add the new process name or Id to the list
        //
        TransparentAddNameOrProcessIdToTheList(Measurements);
 
        //
        // Enable RDTSC and RDTSCP exiting on all cores
        //
        BroadcastEnableRdtscExitingAllCores();
 
        //
        // Finally, enable the transparent-mode
        //
        g_TransparentMode = TRUE;
    }
    else
    {
        //
        // It's already initialized, we just need to
        // add the new process name or Id to the list
        //
        TransparentAddNameOrProcessIdToTheList(Measurements);
    }
 
    return STATUS_SUCCESS;
}

TransparentUnhideDebugger()

IMPORT_EXPORT_VMM NTSTATUS TransparentUnhideDebugger

(

)

Deactivate transparent-mode.

Returns

NTSTATUS

{
    PLIST_ENTRY TempList           = 0;
    PVOID       BufferToDeAllocate = 0;
 
    if (g_TransparentMode)
    {
        //
        // Disable the transparent-mode
        //
        g_TransparentMode = FALSE;
 
        //
        // Disable RDTSC and RDTSCP emulation
        //
        BroadcastDisableRdtscExitingAllCores();
 
        //
        // Free list of allocated buffers
        //
        // Check for process id and process name, if not match then we don't emulate it
        //
        TempList = &g_TransparentModeMeasurements->ProcessList;
        while (&g_TransparentModeMeasurements->ProcessList != TempList->Flink)
        {
            TempList                             = TempList->Flink;
            PTRANSPARENCY_PROCESS ProcessDetails = (PTRANSPARENCY_PROCESS)CONTAINING_RECORD(TempList, TRANSPARENCY_PROCESS, OtherProcesses);
 
            //
            // Save the buffer so we can de-allocate it
            //
            BufferToDeAllocate = ProcessDetails->BufferAddress;
 
            //
            // We have to remove the event from the list
            //
            RemoveEntryList(&ProcessDetails->OtherProcesses);
 
            //
            // Free the buffer
            //
            PlatformMemFreePool(BufferToDeAllocate);
        }
 
        //
        // Deallocate the measurements buffer
        //
        PlatformMemFreePool(g_TransparentModeMeasurements);
        g_TransparentModeMeasurements = NULL;
 
        return STATUS_SUCCESS;
    }
    else
    {
        return STATUS_UNSUCCESSFUL;
    }
}

VirtualAddressToPhysicalAddress()

IMPORT_EXPORT_VMM UINT64 VirtualAddressToPhysicalAddress

(

_In_ PVOID

VirtualAddress

)

Converts Virtual Address to Physical Address.

Parameters

VirtualAddress

The target virtual address

Returns

UINT64 Returns the physical address

{
    return MmGetPhysicalAddress(VirtualAddress).QuadPart;
}

VirtualAddressToPhysicalAddressByProcessCr3()

IMPORT_EXPORT_VMM UINT64 VirtualAddressToPhysicalAddressByProcessCr3	(	_In_ PVOID	VirtualAddress,
		_In_ CR3_TYPE	TargetCr3 )

VirtualAddressToPhysicalAddressByProcessId()

IMPORT_EXPORT_VMM UINT64 VirtualAddressToPhysicalAddressByProcessId	(	_In_ PVOID	VirtualAddress,
		_In_ UINT32	ProcessId )

VirtualAddressToPhysicalAddressOnTargetProcess()

IMPORT_EXPORT_VMM UINT64 VirtualAddressToPhysicalAddressOnTargetProcess

(

_In_ PVOID

VirtualAddress

)

VmFuncChangeIgnoreOneMtfState()

IMPORT_EXPORT_VMM VOID VmFuncChangeIgnoreOneMtfState	(	UINT32	CoreId,
		BOOLEAN	Set )

Change ignore one MTF state.

Parameters

CoreId	Target core's ID
Set	State of setting or unsetting

Returns

VOID

{
    g_GuestState[CoreId].IgnoreOneMtf = Set;
}

VmFuncChangeMtfUnsettingState()

IMPORT_EXPORT_VMM VOID VmFuncChangeMtfUnsettingState	(	UINT32	CoreId,
		BOOLEAN	Set )

Suppress unsetting MTF.

Parameters

CoreId	Target core's ID
Set	State of setting or unsetting

Returns

VOID

{
    g_GuestState[CoreId].IgnoreMtfUnset = Set;
}

VmFuncCheckAndEnableExternalInterrupts()

IMPORT_EXPORT_VMM VOID VmFuncCheckAndEnableExternalInterrupts

(

UINT32

CoreId

)

Check and enable external interrupts.

Parameters

CoreId

Target core's ID

Returns

VOID

{
    HvCheckAndEnableExternalInterrupts(&g_GuestState[CoreId]);
}

VmFuncClearSteppingBits()

IMPORT_EXPORT_VMM UINT64 VmFuncClearSteppingBits

(

UINT64

Interruptibility

)

Clear STI and MOV SS bits.

Returns

UINT64

{
    return HvClearSteppingBits(Interruptibility);
}

VmFuncDisableExternalInterruptsAndInterruptWindow()

IMPORT_EXPORT_VMM VOID VmFuncDisableExternalInterruptsAndInterruptWindow

(

UINT32

CoreId

)

Disable external-interrupts and interrupt window.

Parameters

CoreId

Returns

VOID

{
    HvDisableExternalInterruptsAndInterruptWindow(&g_GuestState[CoreId]);
}

VmFuncEnableAndCheckForPreviousExternalInterrupts()

IMPORT_EXPORT_VMM VOID VmFuncEnableAndCheckForPreviousExternalInterrupts

(

UINT32

CoreId

)

Checks to enable and reinject previous interrupts.

Parameters

UINT32

CoreId

Returns

VOID

{
    HvEnableAndCheckForPreviousExternalInterrupts(&g_GuestState[CoreId]);
}

VmFuncEnableMtfAndChangeExternalInterruptState()

IMPORT_EXPORT_VMM VOID VmFuncEnableMtfAndChangeExternalInterruptState

(

UINT32

CoreId

)

Enables MTF and adjust external interrupt state.

Parameters

UINT32

CoreId

Returns

VOID

{
    HvEnableMtfAndChangeExternalInterruptState(&g_GuestState[CoreId]);
}

VmFuncEventInjectBreakpoint()

IMPORT_EXPORT_VMM VOID VmFuncEventInjectBreakpoint

(

)

Inject #BP to the guest (Event Injection)

Returns

VOID

{
    EventInjectBreakpoint();
}

VmFuncEventInjectInterruption()

IMPORT_EXPORT_VMM VOID VmFuncEventInjectInterruption	(	UINT32	InterruptionType,
		UINT32	Vector,
		BOOLEAN	DeliverErrorCode,
		UINT32	ErrorCode )

Inject interrupt/faults/exceptions.

Parameters

InterruptionType
Vector
DeliverErrorCode
ErrorCode

Returns

VOID

{
    EventInjectInterruption(InterruptionType,
                            Vector,
                            DeliverErrorCode,
                            ErrorCode);
}

VmFuncEventInjectPageFaultRangeAddress()

IMPORT_EXPORT_VMM VOID VmFuncEventInjectPageFaultRangeAddress	(	UINT32	CoreId,
		UINT64	AddressFrom,
		UINT64	AddressTo,
		UINT32	PageFaultCode )

Inject a range of page-faults.

Parameters

CoreId	Target core's ID
AddressFrom	Page-fault address (from)
AddressTo	Page-fault address (to)
Address	Page-fault address
PageFaultCode	Page-fault error code

Returns

VOID

{
    EventInjectPageFaultRangeAddress(&g_GuestState[CoreId], AddressFrom, AddressTo, PageFaultCode);
}

VmFuncEventInjectPageFaultWithCr2()

IMPORT_EXPORT_VMM VOID VmFuncEventInjectPageFaultWithCr2	(	UINT32	CoreId,
		UINT64	Address,
		UINT32	PageFaultCode )

Inject #PF and configure CR2 register.

Parameters

CoreId	Target core's ID
Address	Page-fault address
PageFaultCode	Page-fault error code

Returns

VOID

{
    EventInjectPageFaultWithCr2(&g_GuestState[CoreId], Address, PageFaultCode);
}

VmFuncGetCsSelector()

IMPORT_EXPORT_VMM UINT16 VmFuncGetCsSelector

(

)

Read CS selector.

Returns

UINT16

{
    return HvGetCsSelector();
}

VmFuncGetInterruptibilityState()

IMPORT_EXPORT_VMM UINT64 VmFuncGetInterruptibilityState

(

)

Read guest's interruptibility state.

Returns

UINT64

{
    return HvGetInterruptibilityState();
}

VmFuncGetLastVmexitRip()

IMPORT_EXPORT_VMM UINT64 VmFuncGetLastVmexitRip

(

UINT32

CoreId

)

get the last vm-exit RIP

Parameters

CoreId

Target core's ID

Returns

UINT64

{
    return g_GuestState[CoreId].LastVmexitRip;
}

VmFuncGetRflags()

IMPORT_EXPORT_VMM UINT64 VmFuncGetRflags

(

)

Read guest's RFLAGS.

Returns

UINT64

{
    return HvGetRflags();
}

VmFuncGetRip()

IMPORT_EXPORT_VMM UINT64 VmFuncGetRip

(

)

Read guest's RIP.

Returns

UINT64

{
    return HvGetRip();
}

VmFuncInitVmm()

IMPORT_EXPORT_VMM BOOLEAN VmFuncInitVmm

(

VMM_CALLBACKS *

VmmCallbacks

)

Initializes hypervisor.

Parameters

VmmCallbacks

Returns

BOOLEAN Shows whether the initialization was successful or not

{
    return HvInitVmm(VmmCallbacks);
}

VmFuncInjectPendingExternalInterrupts()

IMPORT_EXPORT_VMM VOID VmFuncInjectPendingExternalInterrupts

(

UINT32

CoreId

)

Inject pending external interrupts.

Parameters

CoreId

Target core's ID

Returns

VOID

{
    HvInjectPendingExternalInterrupts(&g_GuestState[CoreId]);
}

VmFuncInvalidateEptAllContexts()

IMPORT_EXPORT_VMM VOID VmFuncInvalidateEptAllContexts

(

)

Requests for all contexts EPT invalidation.

Returns

VOID

{
    //
    // Broadcast NMI requests
    //
    EptInveptAllContexts();
}

VmFuncInvalidateEptSingleContext()

IMPORT_EXPORT_VMM VOID VmFuncInvalidateEptSingleContext

(

UINT32

CoreId

)

Requests for single-context EPT invalidation.

Parameters

CoreId

Target core's ID

Returns

VOID

{
    EptInveptSingleContext(g_GuestState[CoreId].EptPointer.AsUInt);
}

VmFuncNmiBroadcastInvalidateEptAllContexts()

IMPORT_EXPORT_VMM BOOLEAN VmFuncNmiBroadcastInvalidateEptAllContexts

(

UINT32

CoreId

)

Broadcast NMI requests for all contexts EPT invalidation.

Parameters

CoreId

Target core's ID

Returns

BOOLEAN

{
    //
    // Broadcast NMI requests
    //
    return VmxBroadcastNmi(&g_GuestState[CoreId], NMI_BROADCAST_ACTION_INVALIDATE_EPT_CACHE_ALL_CONTEXTS);
}

VmFuncNmiBroadcastInvalidateEptSingleContext()

IMPORT_EXPORT_VMM BOOLEAN VmFuncNmiBroadcastInvalidateEptSingleContext

(

UINT32

CoreId

)

Broadcast NMI requests for single-context EPT invalidation.

Parameters

CoreId

Target core's ID

Returns

BOOLEAN

{
    //
    // Broadcast NMI requests
    //
    return VmxBroadcastNmi(&g_GuestState[CoreId], NMI_BROADCAST_ACTION_INVALIDATE_EPT_CACHE_SINGLE_CONTEXT);
}

VmFuncNmiBroadcastRequest()

IMPORT_EXPORT_VMM BOOLEAN VmFuncNmiBroadcastRequest

(

UINT32

CoreId

)

Broadcast NMI requests.

Parameters

CoreId

Target core's ID

Returns

BOOLEAN

{
    //
    // Broadcast NMI requests
    //
    return VmxBroadcastNmi(&g_GuestState[CoreId], NMI_BROADCAST_ACTION_REQUEST);
}

VmFuncPerformRipIncrement()

IMPORT_EXPORT_VMM VOID VmFuncPerformRipIncrement

(

UINT32

CoreId

)

Perform the incrementation of RIP.

Parameters

CoreId

Target core's ID

Returns

VOID

{
    HvPerformRipIncrement(&g_GuestState[CoreId]);
}

VmFuncQueryModeExecTrap()

IMPORT_EXPORT_VMM BOOLEAN VmFuncQueryModeExecTrap

(

)

Get the current state of mode exec trap mechanism.

Returns

BOOLEAN

{
    return g_ExecTrapInitialized;
}

VmFuncReadExceptionBitmap()

IMPORT_EXPORT_VMM UINT32 VmFuncReadExceptionBitmap

(

)

Read exception bitmap in VMCS.

Should be called in vmx-root

Returns

UINT32

{
    return HvReadExceptionBitmap();
}

VmFuncRegisterMtfBreak()

IMPORT_EXPORT_VMM VOID VmFuncRegisterMtfBreak

(

UINT32

CoreId

)

Register for break in the case of an MTF.

Parameters

CoreId

Target core's ID

Returns

VOID

{
    g_GuestState[CoreId].RegisterBreakOnMtf = TRUE;
}

VmFuncSetExceptionBitmap()

IMPORT_EXPORT_VMM VOID VmFuncSetExceptionBitmap	(	UINT32	CoreId,
		UINT32	IdtIndex )

Set exception bitmap in VMCS.

Should be called in vmx-root

Parameters

CoreId	Target core's ID
IdtIndex	Interrupt Descriptor Table index of exception

Returns

VOID

{
    HvSetExceptionBitmap(&g_GuestState[CoreId], IdtIndex);
}

VmFuncSetExternalInterruptExiting()

IMPORT_EXPORT_VMM VOID VmFuncSetExternalInterruptExiting	(	UINT32	CoreId,
		BOOLEAN	Set )

Set the External Interrupt Exiting.

Parameters

CoreId	Target core's ID
Set	Set or unset the External Interrupt Exiting

Returns

VOID

{
    HvSetExternalInterruptExiting(&g_GuestState[CoreId], Set);
}

VmFuncSetInterruptibilityState()

IMPORT_EXPORT_VMM VOID VmFuncSetInterruptibilityState

(

UINT64

InterruptibilityState

)

Set guest's interruptibility state.

Parameters

InterruptibilityState

Returns

VOID

{
    HvSetInterruptibilityState(InterruptibilityState);
}

VmFuncSetInterruptWindowExiting()

IMPORT_EXPORT_VMM VOID VmFuncSetInterruptWindowExiting

(

BOOLEAN

Set

)

Set Interrupt-window exiting.

Parameters

Set	Set or unset the Interrupt-window exiting

Returns

VOID

{
    HvSetInterruptWindowExiting(Set);
}

VmFuncSetLoadDebugControls()

IMPORT_EXPORT_VMM VOID VmFuncSetLoadDebugControls

(

BOOLEAN

Set

)

Set LOAD DEBUG CONTROLS on Vm-entry controls.

Parameters

Set	Set or unset

Returns

VOID

{
    HvSetLoadDebugControls(Set);
}

VmFuncSetMonitorTrapFlag()

IMPORT_EXPORT_VMM VOID VmFuncSetMonitorTrapFlag

(

BOOLEAN

Set

)

Set the monitor trap flag.

Parameters

Set	Set or unset the MTFs

Returns

VOID

{
    HvSetMonitorTrapFlag(Set);
}

VmFuncSetMovControlRegsExiting()

IMPORT_EXPORT_VMM VOID VmFuncSetMovControlRegsExiting	(	BOOLEAN	Set,
		UINT64	ControlRegister,
		UINT64	MaskRegister )

Set vm-exit for mov-to-cr0/4.

Should be called in vmx-root

Parameters

Set	or unset the vm-exits
Control	Register
Mask	Register

Returns

VOID

{
    HvSetMovControlRegsExiting(Set, ControlRegister, MaskRegister);
}

VmFuncSetMovDebugRegsExiting()

IMPORT_EXPORT_VMM VOID VmFuncSetMovDebugRegsExiting	(	UINT32	CoreId,
		BOOLEAN	Set )

Set or unset the Mov to Debug Registers Exiting.

Parameters

CoreId	Target core's ID
Set	Set or unset the Mov to Debug Registers Exiting

Returns

VOID

{
    HvSetMovDebugRegsExiting(&g_GuestState[CoreId], Set);
}

VmFuncSetMovToCr3Vmexit()

IMPORT_EXPORT_VMM VOID VmFuncSetMovToCr3Vmexit	(	UINT32	CoreId,
		BOOLEAN	Set )

Set vm-exit for mov-to-cr3.

Should be called in vmx-root

Parameters

CoreId	target core id
Set	Set or unset the vm-exits

Returns

VOID

{
    HvSetMovToCr3Vmexit(&g_GuestState[CoreId], Set);
}

VmFuncSetNmiExiting()

IMPORT_EXPORT_VMM VOID VmFuncSetNmiExiting

(

BOOLEAN

Set

)

Set the NMI Exiting.

Parameters

Set	Set or unset the NMI Exiting

Returns

VOID

{
    HvSetNmiExiting(Set);
}

VmFuncSetNmiWindowExiting()

IMPORT_EXPORT_VMM VOID VmFuncSetNmiWindowExiting

(

BOOLEAN

Set

)

Set NMI-window exiting.

Parameters

Set	Set or unset the NMI-window exiting

Returns

VOID

{
    HvSetNmiWindowExiting(Set);
}

VmFuncSetPmcVmexit()

IMPORT_EXPORT_VMM VOID VmFuncSetPmcVmexit

(

BOOLEAN

Set

)

Set vm-exit for rdpmc instructions.

Should be called in vmx-root

Parameters

Set	Set or unset the vm-exits

Returns

VOID

{
    HvSetPmcVmexit(Set);
}

VmFuncSetRdtscExiting()

IMPORT_EXPORT_VMM VOID VmFuncSetRdtscExiting	(	UINT32	CoreId,
		BOOLEAN	Set )

Set the RDTSC/P Exiting.

Parameters

CoreId	Target core's ID
Set	Set or unset the RDTSC/P Exiting

Returns

VOID

{
    HvSetRdtscExiting(&g_GuestState[CoreId], Set);
}

VmFuncSetRflags()

IMPORT_EXPORT_VMM VOID VmFuncSetRflags

(

UINT64

Rflags

)

Set guest's RFLAGS.

Parameters

Rflags

Returns

VOID

{
    HvSetRflags(Rflags);
}

VmFuncSetRflagTrapFlag()

IMPORT_EXPORT_VMM VOID VmFuncSetRflagTrapFlag

(

BOOLEAN

Set

)

Set Rflag's trap flag.

Parameters

Set	Set or unset the TF

Returns

VOID

{
    HvSetRflagTrapFlag(Set);
}

VmFuncSetRip()

IMPORT_EXPORT_VMM VOID VmFuncSetRip

(

UINT64

Rip

)

Set guest's RIP.

Parameters

Rip

Returns

VOID

{
    HvSetRip(Rip);
}

VmFuncSetSaveDebugControls()

IMPORT_EXPORT_VMM VOID VmFuncSetSaveDebugControls

(

BOOLEAN

Set

)

Set SAVE DEBUG CONTROLS on Vm-exit controls.

Parameters

Set	Set or unset

Returns

VOID

{
    HvSetSaveDebugControls(Set);
}

VmFuncSetTriggerEventForCpuids()

IMPORT_EXPORT_VMM VOID VmFuncSetTriggerEventForCpuids

(

BOOLEAN

Set

)

Set triggering events for CPUIDs.

Parameters

Set	Set or unset the trigger

Returns

VOID

{
    g_TriggerEventForCpuids = Set;
}

VmFuncSetTriggerEventForVmcalls()

IMPORT_EXPORT_VMM VOID VmFuncSetTriggerEventForVmcalls

(

BOOLEAN

Set

)

Set triggering events for VMCALLs.

Parameters

Set	Set or unset the trigger

Returns

VOID

{
    g_TriggerEventForVmcalls = Set;
}

VmFuncSuppressRipIncrement()

IMPORT_EXPORT_VMM VOID VmFuncSuppressRipIncrement

(

UINT32

CoreId

)

Suppress the incrementation of RIP.

Parameters

CoreId

Target core's ID

Returns

VOID

{
    HvSuppressRipIncrement(&g_GuestState[CoreId]);
}

VmFuncUninitVmm()

IMPORT_EXPORT_VMM VOID VmFuncUninitVmm

(

)

Uninitialize Terminate Vmx on all logical cores.

Returns

VOID

{
    VmxPerformTermination();
}

VmFuncUnRegisterMtfBreak()

IMPORT_EXPORT_VMM VOID VmFuncUnRegisterMtfBreak

(

UINT32

CoreId

)

Unregister for break in the case of an MTF.

Parameters

CoreId

Target core's ID

Returns

VOID

{
    g_GuestState[CoreId].RegisterBreakOnMtf = FALSE;
}

VmFuncUnsetExceptionBitmap()

IMPORT_EXPORT_VMM VOID VmFuncUnsetExceptionBitmap	(	UINT32	CoreId,
		UINT32	IdtIndex )

Unset exception bitmap in VMCS.

Should be called in vmx-root

Parameters

CoreId	Target core's ID
IdtIndex	Interrupt Descriptor Table index of exception

Returns

VOID

{
    HvUnsetExceptionBitmap(&g_GuestState[CoreId], IdtIndex);
}

VmFuncVmxBroadcastInitialize()

IMPORT_EXPORT_VMM VOID VmFuncVmxBroadcastInitialize

(

)

Export for initialize the VMX Broadcast mechanism.

Returns

VOID

{
    VmxBroadcastInitialize();
}

VmFuncVmxBroadcastUninitialize()

IMPORT_EXPORT_VMM VOID VmFuncVmxBroadcastUninitialize

(

)

Export for uninitialize the VMX Broadcast mechanism.

Returns

VOID

{
    VmxBroadcastUninitialize();
}

VmFuncVmxCompatibleMemcmp()

IMPORT_EXPORT_VMM INT32 VmFuncVmxCompatibleMemcmp	(	const CHAR *	Address1,
		const CHAR *	Address2,
		size_t	Count )

VMX-root compatible memcmp.

Parameters

Address1
Address2
Count

Returns

INT32

{
    return VmxCompatibleMemcmp(Address1, Address2, Count);
}

VmFuncVmxCompatibleStrcmp()

IMPORT_EXPORT_VMM INT32 VmFuncVmxCompatibleStrcmp	(	const CHAR *	Address1,
		const CHAR *	Address2 )

VMX-root compatible strcmp.

Parameters

Address1
Address2

Returns

INT32

{
    return VmxCompatibleStrcmp(Address1, Address2, NULL_ZERO, FALSE);
}

VmFuncVmxCompatibleStrlen()

IMPORT_EXPORT_VMM UINT32 VmFuncVmxCompatibleStrlen

(

const CHAR *

s

)

VMX-root compatible strlen.

Parameters

s	A pointer to the string

Returns

UINT32

{
    return VmxCompatibleStrlen(s);
}

VmFuncVmxCompatibleStrncmp()

IMPORT_EXPORT_VMM INT32 VmFuncVmxCompatibleStrncmp	(	const CHAR *	Address1,
		const CHAR *	Address2,
		SIZE_T	Num )

VMX-root compatible strncmp.

Parameters

Address1
Address2
Num

Returns

INT32

{
    return VmxCompatibleStrcmp(Address1, Address2, Num, TRUE);
}

VmFuncVmxCompatibleWcscmp()

IMPORT_EXPORT_VMM INT32 VmFuncVmxCompatibleWcscmp	(	const wchar_t *	Address1,
		const wchar_t *	Address2 )

VMX-root compatible wcscmp.

Parameters

Address1
Address2

Returns

INT32

{
    return VmxCompatibleWcscmp(Address1, Address2, NULL_ZERO, FALSE);
}

VmFuncVmxCompatibleWcslen()

IMPORT_EXPORT_VMM UINT32 VmFuncVmxCompatibleWcslen

(

const wchar_t *

s

)

VMX-root compatible strlen.

Parameters

s	A pointer to the string

Returns

UINT32

{
    return VmxCompatibleWcslen(s);
}

VmFuncVmxCompatibleWcsncmp()

IMPORT_EXPORT_VMM INT32 VmFuncVmxCompatibleWcsncmp	(	const wchar_t *	Address1,
		const wchar_t *	Address2,
		SIZE_T	Num )

VMX-root compatible wcsncmp.

Parameters

Address1
Address2
Num

Returns

INT32

{
    return VmxCompatibleWcscmp(Address1, Address2, Num, TRUE);
}

VmFuncVmxGetCurrentExecutionMode()

IMPORT_EXPORT_VMM BOOLEAN VmFuncVmxGetCurrentExecutionMode

(

)

Get the current VMX operation state.

Returns

BOOLEAN

{
    return VmxGetCurrentExecutionMode();
}

VmFuncVmxVmcall()

IMPORT_EXPORT_VMM NTSTATUS VmFuncVmxVmcall	(	unsigned long long	VmcallNumber,
		unsigned long long	OptionalParam1,
		unsigned long long	OptionalParam2,
		unsigned long long	OptionalParam3 )

Export for running VMX VMCALLs.

Parameters

VmcallNumber
OptionalParam1
OptionalParam2
OptionalParam3

Returns

NTSTATUS

{
    return AsmVmxVmcall(VmcallNumber, OptionalParam1, OptionalParam2, OptionalParam3);
}

VmFuncWriteExceptionBitmap()

IMPORT_EXPORT_VMM VOID VmFuncWriteExceptionBitmap

(

UINT32

BitmapMask

)

Write on exception bitmap in VMCS DO NOT CALL IT DIRECTLY, instead use HvSetExceptionBitmap.

Should be called in vmx-root

Parameters

BitmapMask

The content to write on exception bitmap

Returns

VOID

{
    HvWriteExceptionBitmap(BitmapMask);
}