ModeBasedExecHook.c File Reference

Implementation of hooks based on Mode-based execution. More...

#include "pch.h"

Functions
BOOLEAN	ModeBasedExecHookDisableUserModeExecution (PVMM_EPT_PAGE_TABLE EptTable)
	Adjust (unset) user-mode execution bit of target page-table.
BOOLEAN	ModeBasedExecHookDisableKernelModeExecution (PVMM_EPT_PAGE_TABLE EptTable)
	Adjust (unset) kernel-mode execution bit of target page-table but allow user-mode execution.
BOOLEAN	ModeBasedExecHookEnableUsermodeExecution (PVMM_EPT_PAGE_TABLE EptTable)
	Enables user-mode execution bit of target page-table.
VOID	ModeBasedExecHookEnableOrDisable (VIRTUAL_MACHINE_STATE *VCpu, UINT32 State)
	Enable/disable MBEC.
BOOLEAN	ModeBasedExecHookInitialize ()
	Initialize the needed structure for hooking mode execution.
VOID	ModeBasedExecHookUninitialize ()
	Uinitialize the needed structure for hooking mode execution.

Detailed Description

Implementation of hooks based on Mode-based execution.

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.2

Date

2023-03-16

Copyright

This project is released under the GNU Public License v3.

Function Documentation

ModeBasedExecHookDisableKernelModeExecution()

BOOLEAN ModeBasedExecHookDisableKernelModeExecution

(

PVMM_EPT_PAGE_TABLE

EptTable

)

Adjust (unset) kernel-mode execution bit of target page-table but allow user-mode execution.

should be called from vmx non-root mode

Parameters

EptTable

Returns

BOOLEAN

{
    //
    // From Intel Manual:
    // [Bit 2] If the "mode-based execute control for EPT" VM - execution control is 0, execute access;
    // indicates whether instruction fetches are allowed from the 2-MByte page controlled by this entry.
    // If that control is 1, execute access for supervisor-mode linear addresses; indicates whether instruction
    // fetches are allowed from supervisor - mode linear addresses in the 2 - MByte page controlled by this entry
    //
 
    //
    // Set execute access for PML4s
    //
    for (SIZE_T i = 0; i < VMM_EPT_PML4E_COUNT; i++)
    {
        EptTable->PML4[i].UserModeExecute = TRUE;
 
        //
        // We only set the top-level PML4 for intercepting kernel-mode execution
        //
        EptTable->PML4[i].ExecuteAccess = FALSE;
    }
 
    //
    // Set execute access for PML3s
    //
    for (SIZE_T i = 0; i < VMM_EPT_PML3E_COUNT; i++)
    {
        EptTable->PML3[i].UserModeExecute = TRUE;
    }
 
    //
    // Set execute access for PML2s
    //
    for (SIZE_T i = 0; i < VMM_EPT_PML3E_COUNT; i++)
    {
        for (SIZE_T j = 0; j < VMM_EPT_PML2E_COUNT; j++)
        {
            EptTable->PML2[i][j].UserModeExecute = TRUE;
        }
    }
 
    return TRUE;
}

ModeBasedExecHookDisableUserModeExecution()

BOOLEAN ModeBasedExecHookDisableUserModeExecution

(

PVMM_EPT_PAGE_TABLE

EptTable

)

Adjust (unset) user-mode execution bit of target page-table.

should be called from vmx non-root mode

Parameters

EptTable

Returns

BOOLEAN

{
    //
    // Set execute access for PML4s
    //
    for (SIZE_T i = 0; i < VMM_EPT_PML4E_COUNT; i++)
    {
        //
        // We only set the top-level PML4 for intercepting user-mode execution
        //
        EptTable->PML4[i].UserModeExecute = FALSE;
    }
 
    //
    // Set execute access for PML3s
    //
    for (SIZE_T i = 0; i < VMM_EPT_PML3E_COUNT; i++)
    {
        EptTable->PML3[i].UserModeExecute = TRUE;
    }
 
    //
    // Set execute access for PML2s
    //
    for (SIZE_T i = 0; i < VMM_EPT_PML3E_COUNT; i++)
    {
        for (SIZE_T j = 0; j < VMM_EPT_PML2E_COUNT; j++)
        {
            EptTable->PML2[i][j].UserModeExecute = TRUE;
        }
    }
 
    return TRUE;
}

ModeBasedExecHookEnableOrDisable()

VOID ModeBasedExecHookEnableOrDisable	(	VIRTUAL_MACHINE_STATE *	VCpu,
		UINT32	State )

Enable/disable MBEC.

Parameters

VCpu	The virtual processor's state

Returns

VOID

{
    if (State == 0x0)
    {
        HvSetModeBasedExecutionEnableFlag(FALSE);
 
        //
        // MBEC is not enabled anymore!
        //
        VCpu->MbecEnabled = FALSE;
    }
    else
    {
        HvSetModeBasedExecutionEnableFlag(TRUE);
    }
}

ModeBasedExecHookEnableUsermodeExecution()

BOOLEAN ModeBasedExecHookEnableUsermodeExecution

(

PVMM_EPT_PAGE_TABLE

EptTable

)

Enables user-mode execution bit of target page-table.

Parameters

EptTable

Returns

BOOLEAN

{
    EPT_PML1_ENTRY Pml1Entries[VMM_EPT_PML1E_COUNT];
 
    //
    // Set execute access for PML4s
    //
    for (SIZE_T i = 0; i < VMM_EPT_PML4E_COUNT; i++)
    {
        //
        // We only set the top-level PML4 for intercepting user-mode execution
        //
        EptTable->PML4[i].UserModeExecute = TRUE;
    }
 
    //
    // Set execute access for PML3s
    //
    for (SIZE_T i = 0; i < VMM_EPT_PML3E_COUNT; i++)
    {
        EptTable->PML3[i].UserModeExecute = TRUE;
    }
 
    //
    // Set execute access for PML2s
    //
    for (SIZE_T i = 0; i < VMM_EPT_PML3E_COUNT; i++)
    {
        for (SIZE_T j = 0; j < VMM_EPT_PML2E_COUNT; j++)
        {
            EptTable->PML2[i][j].UserModeExecute = TRUE;
 
            //
            // If the PML2 entry is not a large page, we should set execute access for PML1s
            // It usually happens when the PML2 entry is not a large page and is previously
            // used for an EPT hook, so, it has PML1 entries
            //
            if (!EptTable->PML2[i][j].LargePage)
            {
                //
                // Shift to the left to get the PFN
                //
                MemoryMapperReadMemorySafeByPhysicalAddress(EptTable->PML2[i][j].PageFrameNumber << 12, (UINT64)Pml1Entries, PAGE_SIZE);
 
                //
                // Set execute access for PML1s
                //
                for (SIZE_T k = 0; k < VMM_EPT_PML1E_COUNT; k++)
                {
                    Pml1Entries[k].UserModeExecute = TRUE;
                }
 
                //
                // Write back the PML1 entries to the EPT page table
                //
                MemoryMapperWriteMemorySafeByPhysicalAddress(EptTable->PML2[i][j].PageFrameNumber << 12, (UINT64)Pml1Entries, PAGE_SIZE);
            }
        }
    }
 
    return TRUE;
}

ModeBasedExecHookInitialize()

BOOLEAN ModeBasedExecHookInitialize

(

)

Initialize the needed structure for hooking mode execution.

should be called from vmx non-root mode

Returns

BOOLEAN

{
    ULONG ProcessorsCount;
 
    //
    // Get number of processors
    //
    ProcessorsCount = KeQueryActiveProcessorCount(0);
 
    //
    // Check if MBEC supported by this processors
    //
    if (!g_CompatibilityCheck.ModeBasedExecutionSupport)
    {
        return FALSE;
    }
 
    //
    // Check if execute-only feature is supported on this processor or not
    //
    if (!g_CompatibilityCheck.ExecuteOnlySupport)
    {
        return FALSE;
    }
 
    //
    // Check if it's already initialized or not
    //
    if (g_ModeBasedExecutionControlState)
    {
        return FALSE;
    }
 
    //
    // Enable EPT user-mode execution bit for the target EPTP
    //
    for (SIZE_T i = 0; i < ProcessorsCount; i++)
    {
        ModeBasedExecHookEnableUsermodeExecution(g_GuestState[i].EptPageTable);
    }
 
    //
    // Invalidate ALL context on all cores (not necessary here because we will change
    // it later but let's respect memory primitives)
    //
    BroadcastNotifyAllToInvalidateEptAllCores();
 
    //
    // Indicate that MBEC is initialized
    //
    g_ModeBasedExecutionControlState = TRUE;
 
    return TRUE;
}

ModeBasedExecHookUninitialize()

VOID ModeBasedExecHookUninitialize

(

)

Uinitialize the needed structure for hooking mode execution.

should be called from vmx non-root mode

Returns

VOID

{
    //
    // Broadcast to disable MBEC on all cores
    //
    BroadcasDisableMbecOnAllProcessors();
 
    //
    // Indicate that MBEC is disabled
    //
    g_ModeBasedExecutionControlState = FALSE;
}