ModeBasedExecHook.h File Reference

Hook headers for Mode-based execution. More...

Go to the source code of this file.

Classes
struct	MODE_BASED_RAM_REGIONS
	The RAM regions. More...

Macros
#define	MAX_PHYSICAL_RAM_RANGE_COUNT   32

Typedefs
typedef struct MODE_BASED_RAM_REGIONS	MODE_BASED_RAM_REGIONS
	The RAM regions.
typedef struct MODE_BASED_RAM_REGIONS *	PMODE_BASED_RAM_REGIONS

Functions
VOID	ModeBasedExecHookEnableOrDisable (VIRTUAL_MACHINE_STATE *VCpu, UINT32 State)
	Enable/disable MBEC.
VOID	ModeBasedExecHookUninitialize ()
	Uinitialize the needed structure for hooking mode execution.
BOOLEAN	ModeBasedExecHookInitialize ()
	Initialize the needed structure for hooking mode execution.
BOOLEAN	ModeBasedExecHookDisableUserModeExecution (PVMM_EPT_PAGE_TABLE EptTable)
	Adjust (unset) user-mode execution bit of target page-table.
BOOLEAN	ModeBasedExecHookDisableKernelModeExecution (PVMM_EPT_PAGE_TABLE EptTable)
	Adjust (unset) kernel-mode execution bit of target page-table but allow user-mode execution.

Variables
MODE_BASED_RAM_REGIONS	PhysicalRamRegions [MAX_PHYSICAL_RAM_RANGE_COUNT]

Detailed Description

Hook headers for Mode-based execution.

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.2

Date

2023-03-17

Copyright

This project is released under the GNU Public License v3.

Macro Definition Documentation

MAX_PHYSICAL_RAM_RANGE_COUNT

#define MAX_PHYSICAL_RAM_RANGE_COUNT   32

Typedef Documentation

MODE_BASED_RAM_REGIONS

typedef struct MODE_BASED_RAM_REGIONS MODE_BASED_RAM_REGIONS

The RAM regions.

PMODE_BASED_RAM_REGIONS

typedef struct MODE_BASED_RAM_REGIONS * PMODE_BASED_RAM_REGIONS

Function Documentation

ModeBasedExecHookDisableKernelModeExecution()

BOOLEAN ModeBasedExecHookDisableKernelModeExecution

(

PVMM_EPT_PAGE_TABLE

EptTable

)

Adjust (unset) kernel-mode execution bit of target page-table but allow user-mode execution.

should be called from vmx non-root mode

Parameters

EptTable

Returns

BOOLEAN

{
    //
    // From Intel Manual:
    // [Bit 2] If the "mode-based execute control for EPT" VM - execution control is 0, execute access;
    // indicates whether instruction fetches are allowed from the 2-MByte page controlled by this entry.
    // If that control is 1, execute access for supervisor-mode linear addresses; indicates whether instruction
    // fetches are allowed from supervisor - mode linear addresses in the 2 - MByte page controlled by this entry
    //
 
    //
    // Set execute access for PML4s
    //
    for (size_t i = 0; i < VMM_EPT_PML4E_COUNT; i++)
    {
        EptTable->PML4[i].UserModeExecute = TRUE;
 
        //
        // We only set the top-level PML4 for intercepting kernel-mode execution
        //
        EptTable->PML4[i].ExecuteAccess = FALSE;
    }
 
    //
    // Set execute access for PML3s
    //
    for (size_t i = 0; i < VMM_EPT_PML3E_COUNT; i++)
    {
        EptTable->PML3[i].UserModeExecute = TRUE;
    }
 
    //
    // Set execute access for PML2s
    //
    for (size_t i = 0; i < VMM_EPT_PML3E_COUNT; i++)
    {
        for (size_t j = 0; j < VMM_EPT_PML2E_COUNT; j++)
        {
            EptTable->PML2[i][j].UserModeExecute = TRUE;
        }
    }
 
    return TRUE;
}

ModeBasedExecHookDisableUserModeExecution()

BOOLEAN ModeBasedExecHookDisableUserModeExecution

(

PVMM_EPT_PAGE_TABLE

EptTable

)

Adjust (unset) user-mode execution bit of target page-table.

should be called from vmx non-root mode

Parameters

EptTable

Returns

BOOLEAN

{
    //
    // Set execute access for PML4s
    //
    for (size_t i = 0; i < VMM_EPT_PML4E_COUNT; i++)
    {
        //
        // We only set the top-level PML4 for intercepting user-mode execution
        //
        EptTable->PML4[i].UserModeExecute = FALSE;
    }
 
    //
    // Set execute access for PML3s
    //
    for (size_t i = 0; i < VMM_EPT_PML3E_COUNT; i++)
    {
        EptTable->PML3[i].UserModeExecute = TRUE;
    }
 
    //
    // Set execute access for PML2s
    //
    for (size_t i = 0; i < VMM_EPT_PML3E_COUNT; i++)
    {
        for (size_t j = 0; j < VMM_EPT_PML2E_COUNT; j++)
        {
            EptTable->PML2[i][j].UserModeExecute = TRUE;
        }
    }
 
    return TRUE;
}

ModeBasedExecHookEnableOrDisable()

VOID ModeBasedExecHookEnableOrDisable	(	VIRTUAL_MACHINE_STATE *	VCpu,
		UINT32	State )

Enable/disable MBEC.

Parameters

VCpu	The virtual processor's state

Returns

VOID

{
    if (State == 0x0)
    {
        HvSetModeBasedExecutionEnableFlag(FALSE);
 
        //
        // MBEC is not enabled anymore!
        //
        VCpu->MbecEnabled = FALSE;
    }
    else
    {
        HvSetModeBasedExecutionEnableFlag(TRUE);
    }
}

ModeBasedExecHookInitialize()

BOOLEAN ModeBasedExecHookInitialize

(

)

Initialize the needed structure for hooking mode execution.

should be called from vmx non-root mode

Returns

BOOLEAN

{
    ULONG ProcessorsCount;
 
    //
    // Get number of processors
    //
    ProcessorsCount = KeQueryActiveProcessorCount(0);
 
    //
    // Check if MBEC supported by this processors
    //
    if (!g_CompatibilityCheck.ModeBasedExecutionSupport)
    {
        return FALSE;
    }
 
    //
    // Check if execute-only feature is supported on this processor or not
    //
    if (!g_CompatibilityCheck.ExecuteOnlySupport)
    {
        return FALSE;
    }
 
    //
    // Check if it's already initialized or not
    //
    if (g_ModeBasedExecutionControlState)
    {
        return FALSE;
    }
 
    //
    // Enable EPT user-mode execution bit for the target EPTP
    //
    for (size_t i = 0; i < ProcessorsCount; i++)
    {
        ModeBasedExecHookEnableUsermodeExecution(g_GuestState[i].EptPageTable);
    }
 
    //
    // Invalidate ALL context on all cores (not necessary here because we will change
    // it later but let's respect memory primitives)
    //
    BroadcastNotifyAllToInvalidateEptAllCores();
 
    //
    // Indicate that MBEC is initialized
    //
    g_ModeBasedExecutionControlState = TRUE;
 
    return TRUE;
}

ModeBasedExecHookUninitialize()

VOID ModeBasedExecHookUninitialize

(

)

Uinitialize the needed structure for hooking mode execution.

should be called from vmx non-root mode

Returns

VOID

{
    //
    // Broadcast to disable MBEC on all cores
    //
    BroadcasDisableMbecOnAllProcessors();
 
    //
    // Indicate that MBEC is disabled
    //
    g_ModeBasedExecutionControlState = FALSE;
}

Variable Documentation

PhysicalRamRegions

MODE_BASED_RAM_REGIONS PhysicalRamRegions[MAX_PHYSICAL_RAM_RANGE_COUNT]