Vmx.c File Reference

VMX Instructions and VMX Related Functions. More...

#include "pch.h"

Functions
BOOLEAN	VmxCheckVmxSupport ()
	Check whether VMX Feature is supported or not.
BOOLEAN	VmxGetCurrentExecutionMode ()
	Check current execution mode (vmx-root and non-root).
BOOLEAN	VmxGetCurrentLaunchState ()
	Check if the VMX is launched or not.
BOOLEAN	VmxInitialize ()
	Initialize the VMX operation.
BOOLEAN	VmxPerformVirtualizationOnAllCores ()
	Initialize essential VMX Operation tasks.
BOOLEAN	VmxPerformVirtualizationOnSpecificCore ()
	Allocates Vmx regions for all logical cores (Vmxon region and Vmcs region).
VOID	VmxFixCr4AndCr0Bits ()
	Fix values for cr0 and cr4 bits.
BOOLEAN	VmxCheckIsOnVmxRoot ()
	It can deterministically check whether the caller is on vmx-root mode or not.
BOOLEAN	VmxVirtualizeCurrentSystem (PVOID GuestStack)
	Initialize VMX Operation.
BOOLEAN	VmxTerminate ()
	Broadcast to terminate VMX on all logical cores.
VOID	VmxPerformVmptrst ()
	Implementation of VMPTRST instruction.
_Use_decl_annotations_ BOOLEAN	VmxClearVmcsState (VIRTUAL_MACHINE_STATE *VCpu)
	Clearing Vmcs status using vmclear instruction.
_Use_decl_annotations_ BOOLEAN	VmxLoadVmcs (VIRTUAL_MACHINE_STATE *VCpu)
	Implementation of VMPTRLD instruction.
_Use_decl_annotations_ BOOLEAN	VmxSetupVmcs (VIRTUAL_MACHINE_STATE *VCpu, PVOID GuestStack)
	Create and Configure a Vmcs Layout.
VOID	VmxPerformVmresume ()
	Resume VM using the VMRESUME instruction.
UINT64	VmxVmfunc (UINT32 EptpIndex, UINT32 Function)
	VMFUNC instruction.
VOID	VmxPerformVmxoff (VIRTUAL_MACHINE_STATE *VCpu)
	Prepare and execute Vmxoff instruction.
UINT64	VmxReturnStackPointerForVmxoff ()
	Get the RIP of guest (VMCS_GUEST_RIP) in the case of return from VMXOFF.
UINT64	VmxReturnInstructionPointerForVmxoff ()
	Get the RIP of guest (VMCS_GUEST_RIP) in the case of return from VMXOFF.
VOID	VmxPerformTermination ()
	Terminate Vmx on all logical cores.
UINT32	VmxCompatibleStrlen (const CHAR *S)
	implementation of vmx-root mode compatible strlen
UINT32	VmxCompatibleWcslen (const WCHAR *S)
	implementation of vmx-root mode compatible wcslen
VOID	VmxCompatibleMicroSleep (UINT64 Us)
	VMX-root compatible micro sleep.
INT32	VmxCompatibleStrcmp (const CHAR *Address1, const CHAR *Address2, SIZE_T Num, BOOLEAN IsStrncmp)
	implementation of vmx-root mode compatible strcmp and strncmp
INT32	VmxCompatibleWcscmp (const WCHAR *Address1, const WCHAR *Address2, SIZE_T Num, BOOLEAN IsWcsncmp)
	implementation of vmx-root mode compatible wcscmp and wcsncmp
INT32	VmxCompatibleMemcmp (const CHAR *Address1, const CHAR *Address2, SIZE_T Count)
	implementation of vmx-root mode compatible memcmp
BOOLEAN	VmxIsTopLevelHypervisorHyperV ()
	checks if the current top level hypervisor is Hyper-V

Detailed Description

VMX Instructions and VMX Related Functions.

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.1

Date

2020-04-11

Copyright

This project is released under the GNU Public License v3.

Function Documentation

VmxCheckIsOnVmxRoot()

BOOLEAN VmxCheckIsOnVmxRoot

(

)

It can deterministically check whether the caller is on vmx-root mode or not.

Returns

BOOLEAN Returns true if current operation mode is vmx-root and false if current operation mode is vmx non-root

{
    UINT64 VmcsLink = 0;
 
    __try
    {
        if (!VmxVmread64P(VMCS_GUEST_VMCS_LINK_POINTER, &VmcsLink))
        {
            if (VmcsLink != 0)
            {
                return TRUE;
            }
        }
    }
    __except (1)
    {
    }
 
    return FALSE;
}

VmxCheckVmxSupport()

BOOLEAN VmxCheckVmxSupport

(

)

Check whether VMX Feature is supported or not.

Returns

BOOLEAN Returns true if vmx is supported or false if it's not supported

{
    CPUID                         Data              = {0};
    IA32_FEATURE_CONTROL_REGISTER FeatureControlMsr = {0};
 
    //
    // Gets Processor Info and Feature Bits
    //
    CpuCpuId((INT *)&Data, 1);
 
    //
    // Check For VMX Bit CPUID.ECX[5]
    //
    if (!_bittest((const LONG *)&Data.ecx, 5))
    {
        //
        // returns FALSE if vmx is not supported
        //
        return FALSE;
    }
 
    FeatureControlMsr.AsUInt = CpuReadMsr(IA32_FEATURE_CONTROL);
 
    //
    // Commented because of https://stackoverflow.com/questions/34900224/
    // and https://github.com/HyperDbg/HyperDbg/issues/24
    // the problem is when writing to IA32_FEATURE_CONTROL MSR, the lock bit
    // of this MSR Is not set to 0 on most computers, if the user enabled VT-X
    // from the BIOS the VMXON will be already set so checking lock bit and
    // then writing to EnableVmxon again is not meaningful since its already
    // there
    //
 
    //
    // if (FeatureControlMsr.Fields.Lock == 0)
    // {
    //     FeatureControlMsr.Fields.Lock        = TRUE;
    //     FeatureControlMsr.Fields.EnableVmxon = TRUE;
    //     CpuWriteMsr(IA32_FEATURE_CONTROL, FeatureControlMsr.Flags);
    // }
 
    if (FeatureControlMsr.EnableVmxOutsideSmx == FALSE)
    {
        LogError("Err, you should enable vt-x from BIOS");
        return FALSE;
    }
 
    return TRUE;
}

VmxClearVmcsState()

_Use_decl_annotations_ BOOLEAN VmxClearVmcsState

(

VIRTUAL_MACHINE_STATE *

VCpu

)

Clearing Vmcs status using vmclear instruction.

Parameters

VCpu

Returns

BOOLEAN If vmclear execution was successful it returns true otherwise and if there was error with vmclear then it returns false

{
    UINT8 VmclearStatus;
 
    //
    // Clear the state of the VMCS to inactive
    //
    VmclearStatus = VmxVmclear(&VCpu->VmcsRegionPhysicalAddress);
 
    LogDebugInfo("VMCS VMCLEAR status : 0x%x", VmclearStatus);
 
    if (VmclearStatus)
    {
        //
        // Otherwise terminate the VMX
        //
        LogDebugInfo("VMCS failed to clear, status : 0x%x", VmclearStatus);
        VmxVmxoff();
 
        return FALSE;
    }
    return TRUE;
}

VmxCompatibleMemcmp()

INT32 VmxCompatibleMemcmp	(	const CHAR *	Address1,
		const CHAR *	Address2,
		SIZE_T	Count )

implementation of vmx-root mode compatible memcmp

Parameters

Address1
Address2
Count

Returns

INT32 0x2 indicates error, otherwise the same result as memcmp in string.h

{
    CHAR     C1 = NULL_ZERO, C2 = NULL_ZERO;
    INT32    Result = 0;
    UINT64   AlignedAddress1, AlignedAddress2;
    CR3_TYPE GuestCr3;
    CR3_TYPE OriginalCr3;
 
    AlignedAddress1 = (UINT64)PAGE_ALIGN((UINT64)Address1);
    AlignedAddress2 = (UINT64)PAGE_ALIGN((UINT64)Address2);
 
    //
    // Find the current process cr3
    //
    GuestCr3.Flags = LayoutGetCurrentProcessCr3().Flags;
 
    //
    // Move to new cr3
    //
    OriginalCr3.Flags = CpuReadCr3();
    CpuWriteCr3(GuestCr3.Flags);
 
    //
    // First check
    //
    if (!CheckAccessValidityAndSafety(AlignedAddress1, sizeof(WCHAR)) || !CheckAccessValidityAndSafety(AlignedAddress2, sizeof(WCHAR)))
    {
        //
        // Error
        //
 
        //
        // Move back to original cr3
        //
        CpuWriteCr3(OriginalCr3.Flags);
        return 0x2;
    }
 
    while (Count-- > 0 && !Result)
    {
        /*
        C1 = *Address1;
        */
        MemoryMapperReadMemorySafe((UINT64)Address1, &C1, sizeof(CHAR));
 
        /*
        C2 = *Address2;
        */
        MemoryMapperReadMemorySafe((UINT64)Address2, &C2, sizeof(CHAR));
 
        Address1++;
        Address2++;
 
        if (!((UINT64)AlignedAddress1 & (PAGE_SIZE - 1)))
        {
            if (!CheckAccessValidityAndSafety((UINT64)AlignedAddress1, sizeof(WCHAR)))
            {
                //
                // Error
                //
 
                //
                // Move back to original cr3
                //
                CpuWriteCr3(OriginalCr3.Flags);
                return 0x2;
            }
        }
 
        if (!((UINT64)AlignedAddress2 & (PAGE_SIZE - 1)))
        {
            if (!CheckAccessValidityAndSafety((UINT64)AlignedAddress2, sizeof(WCHAR)))
            {
                //
                // Error
                //
 
                //
                // Move back to original cr3
                //
                CpuWriteCr3(OriginalCr3.Flags);
                return 0x2;
            }
        }
 
        Result = C1 - C2;
    }
 
    if (Result < 0)
    {
        Result = -1;
    }
    else if (Result > 0)
    {
        Result = 1;
    }
 
    //
    // Move back to original cr3
    //
    CpuWriteCr3(OriginalCr3.Flags);
    return Result;
}

VmxCompatibleMicroSleep()

VOID VmxCompatibleMicroSleep

(

UINT64

Us

)

VMX-root compatible micro sleep.

Parameters

Us	Delay in micro seconds

Returns

VOID

{
    LARGE_INTEGER Start, End, Frequency;
    KeQueryPerformanceCounter(&Frequency);
 
    LONGLONG Ticks = (Frequency.QuadPart / 1000000) * Us;
 
    Start = KeQueryPerformanceCounter(NULL);
 
    while (TRUE)
    {
        End = KeQueryPerformanceCounter(NULL);
        if (End.QuadPart - Start.QuadPart > Ticks)
            break;
    }
}

VmxCompatibleStrcmp()

INT32 VmxCompatibleStrcmp	(	const CHAR *	Address1,
		const CHAR *	Address2,
		SIZE_T	Num,
		BOOLEAN	IsStrncmp )

implementation of vmx-root mode compatible strcmp and strncmp

Parameters

Address1
Address2
Num	param IsStrncmp

Returns

INT32 0x2 indicates error, otherwise the same result as strcmp in string.h

{
    CHAR     C1 = NULL_ZERO, C2 = NULL_ZERO;
    INT32    Result = 0;
    UINT32   Count  = 0;
    UINT64   AlignedAddress1, AlignedAddress2;
    CR3_TYPE GuestCr3;
    CR3_TYPE OriginalCr3;
 
    AlignedAddress1 = (UINT64)PAGE_ALIGN((UINT64)Address1);
    AlignedAddress2 = (UINT64)PAGE_ALIGN((UINT64)Address2);
 
    //
    // Find the current process cr3
    //
    GuestCr3.Flags = LayoutGetCurrentProcessCr3().Flags;
 
    //
    // Move to new cr3
    //
    OriginalCr3.Flags = CpuReadCr3();
    CpuWriteCr3(GuestCr3.Flags);
 
    //
    // First check
    //
    if (!CheckAccessValidityAndSafety(AlignedAddress1, sizeof(CHAR)) || !CheckAccessValidityAndSafety(AlignedAddress2, sizeof(CHAR)))
    {
        //
        // Error
        //
 
        //
        // Move back to original cr3
        //
        CpuWriteCr3(OriginalCr3.Flags);
        return 0x2;
    }
 
    do
    {
        //
        // Check to see if we have byte number constraints
        //
        if (IsStrncmp)
        {
            if (Count == Num)
            {
                //
                // Maximum number of bytes reached
                //
                break;
            }
            else
            {
                //
                // Maximum number of bytes not reached
                //
                Count++;
            }
        }
 
        /*
        C1 = *Address1;
        */
        MemoryMapperReadMemorySafe((UINT64)Address1, &C1, sizeof(CHAR));
 
        /*
        C2 = *Address2;
        */
        MemoryMapperReadMemorySafe((UINT64)Address2, &C2, sizeof(CHAR));
 
        Address1++;
        Address2++;
 
        if (!((UINT64)AlignedAddress1 & (PAGE_SIZE - 1)))
        {
            if (!CheckAccessValidityAndSafety((UINT64)AlignedAddress1, sizeof(CHAR)))
            {
                //
                // Error
                //
 
                //
                // Move back to original cr3
                //
                CpuWriteCr3(OriginalCr3.Flags);
                return 0x2;
            }
        }
 
        if (!((UINT64)AlignedAddress2 & (PAGE_SIZE - 1)))
        {
            if (!CheckAccessValidityAndSafety((UINT64)AlignedAddress2, sizeof(CHAR)))
            {
                //
                // Error
                //
 
                //
                // Move back to original cr3
                //
                CpuWriteCr3(OriginalCr3.Flags);
                return 0x2;
            }
        }
        Result = C1 - C2;
    } while (!Result && C2);
 
    if (Result < 0)
    {
        Result = -1;
    }
    else if (Result > 0)
    {
        Result = 1;
    }
 
    //
    // Move back to original cr3
    //
    CpuWriteCr3(OriginalCr3.Flags);
    return Result;
}

VmxCompatibleStrlen()

UINT32 VmxCompatibleStrlen

(

const CHAR *

S

)

implementation of vmx-root mode compatible strlen

Parameters

S

Returns

UINT32 If 0x0 indicates an error, otherwise length of the string

{
    CHAR     Temp  = NULL_ZERO;
    UINT32   Count = 0;
    UINT64   AlignedAddress;
    CR3_TYPE GuestCr3;
    CR3_TYPE OriginalCr3;
 
    AlignedAddress = (UINT64)PAGE_ALIGN((UINT64)S);
 
    //
    // Find the current process cr3
    //
    GuestCr3.Flags = LayoutGetCurrentProcessCr3().Flags;
 
    //
    // Move to new cr3
    //
    OriginalCr3.Flags = CpuReadCr3();
    CpuWriteCr3(GuestCr3.Flags);
 
    //
    // First check
    //
    if (!CheckAccessValidityAndSafety(AlignedAddress, sizeof(CHAR)))
    {
        //
        // Error
        //
 
        //
        // Move back to original cr3
        //
        CpuWriteCr3(OriginalCr3.Flags);
        return 0;
    }
 
    while (TRUE)
    {
        /*
        Temp = *S;
        */
        MemoryMapperReadMemorySafe((UINT64)S, &Temp, sizeof(CHAR));
 
        if (Temp != '\0')
        {
            Count++;
            S++;
        }
        else
        {
            //
            // Move back to original cr3
            //
            CpuWriteCr3(OriginalCr3.Flags);
            return Count;
        }
 
        if (!((UINT64)S & (PAGE_SIZE - 1)))
        {
            if (!CheckAccessValidityAndSafety((UINT64)S, sizeof(CHAR)))
            {
                //
                // Error
                //
 
                //
                // Move back to original cr3
                //
                CpuWriteCr3(OriginalCr3.Flags);
                return 0;
            }
        }
    }
 
    //
    // Move back to original cr3
    //
    CpuWriteCr3(OriginalCr3.Flags);
}

VmxCompatibleWcscmp()

INT32 VmxCompatibleWcscmp	(	const WCHAR *	Address1,
		const WCHAR *	Address2,
		SIZE_T	Num,
		BOOLEAN	IsWcsncmp )

implementation of vmx-root mode compatible wcscmp and wcsncmp

Parameters

Address1
Address2
Num
IsWcsncmp

Returns

INT32 0x2 indicates error, otherwise the same result as wcscmp in string.h

{
    WCHAR    C1 = NULL_ZERO, C2 = NULL_ZERO;
    INT32    Result = 0;
    UINT32   Count  = 0;
    UINT64   AlignedAddress1, AlignedAddress2;
    CR3_TYPE GuestCr3;
    CR3_TYPE OriginalCr3;
 
    AlignedAddress1 = (UINT64)PAGE_ALIGN((UINT64)Address1);
    AlignedAddress2 = (UINT64)PAGE_ALIGN((UINT64)Address2);
 
    //
    // Find the current process cr3
    //
    GuestCr3.Flags = LayoutGetCurrentProcessCr3().Flags;
 
    //
    // Move to new cr3
    //
    OriginalCr3.Flags = CpuReadCr3();
    CpuWriteCr3(GuestCr3.Flags);
 
    //
    // First check
    //
    if (!CheckAccessValidityAndSafety(AlignedAddress1, sizeof(WCHAR)) || !CheckAccessValidityAndSafety(AlignedAddress2, sizeof(WCHAR)))
    {
        //
        // Error
        //
 
        //
        // Move back to original cr3
        //
        CpuWriteCr3(OriginalCr3.Flags);
        return 0x2;
    }
 
    do
    {
        //
        // Check to see if we have byte number constraints
        //
        if (IsWcsncmp)
        {
            if (Count == Num)
            {
                //
                // Maximum number of bytes reached
                //
                break;
            }
            else
            {
                //
                // Maximum number of bytes not reached
                //
                Count++;
            }
        }
 
        /*
        C1 = *Address1;
        */
        MemoryMapperReadMemorySafe((UINT64)Address1, &C1, sizeof(WCHAR));
 
        /*
        C2 = *Address2;
        */
        MemoryMapperReadMemorySafe((UINT64)Address2, &C2, sizeof(WCHAR));
 
        Address1++;
        Address2++;
 
        if (!((UINT64)AlignedAddress1 & (PAGE_SIZE - 1)))
        {
            if (!CheckAccessValidityAndSafety((UINT64)AlignedAddress1, sizeof(WCHAR)))
            {
                //
                // Error
                //
 
                //
                // Move back to original cr3
                //
                CpuWriteCr3(OriginalCr3.Flags);
                return 0x2;
            }
        }
 
        if (!((UINT64)AlignedAddress2 & (PAGE_SIZE - 1)))
        {
            if (!CheckAccessValidityAndSafety((UINT64)AlignedAddress2, sizeof(WCHAR)))
            {
                //
                // Error
                //
 
                //
                // Move back to original cr3
                //
                CpuWriteCr3(OriginalCr3.Flags);
                return 0x2;
            }
        }
 
        Result = C1 - C2;
    } while (!Result && C2);
 
    if (Result < 0)
    {
        Result = -1;
    }
    else if (Result > 0)
    {
        Result = 1;
    }
 
    //
    // Move back to original cr3
    //
    CpuWriteCr3(OriginalCr3.Flags);
    return Result;
}

VmxCompatibleWcslen()

UINT32 VmxCompatibleWcslen

(

const WCHAR *

S

)

implementation of vmx-root mode compatible wcslen

Parameters

S

Returns

UINT32 If 0x0 indicates an error, otherwise length of the string

{
    WCHAR    Temp  = NULL_ZERO;
    UINT32   Count = 0;
    UINT64   AlignedAddress;
    CR3_TYPE GuestCr3;
    CR3_TYPE OriginalCr3;
 
    AlignedAddress = (UINT64)PAGE_ALIGN((UINT64)S);
 
    //
    // Find the current process cr3
    //
    GuestCr3.Flags = LayoutGetCurrentProcessCr3().Flags;
 
    //
    // Move to new cr3
    //
    OriginalCr3.Flags = CpuReadCr3();
    CpuWriteCr3(GuestCr3.Flags);
 
    AlignedAddress = (UINT64)PAGE_ALIGN((UINT64)S);
 
    //
    // First check
    //
    if (!CheckAccessValidityAndSafety(AlignedAddress, sizeof(WCHAR)))
    {
        //
        // Error
        //
 
        //
        // Move back to original cr3
        //
        CpuWriteCr3(OriginalCr3.Flags);
        return 0;
    }
 
    while (TRUE)
    {
        /*
        Temp = *S;
        */
        MemoryMapperReadMemorySafe((UINT64)S, &Temp, sizeof(WCHAR));
 
        if (Temp != '\0\0')
        {
            Count++;
            S++;
        }
        else
        {
            //
            // Move back to original cr3
            //
            CpuWriteCr3(OriginalCr3.Flags);
            return Count;
        }
 
        if (!((UINT64)S & (PAGE_SIZE - 1)))
        {
            if (!CheckAccessValidityAndSafety((UINT64)S, sizeof(WCHAR)))
            {
                //
                // Error
                //
 
                //
                // Move back to original cr3
                //
                CpuWriteCr3(OriginalCr3.Flags);
                return 0;
            }
        }
    }
 
    //
    // Move back to original cr3
    //
    CpuWriteCr3(OriginalCr3.Flags);
}

VmxFixCr4AndCr0Bits()

VOID VmxFixCr4AndCr0Bits

(

)

Fix values for cr0 and cr4 bits.

The Cr4 And Cr0 Bits During VMX Operation Preventing Them From Any Change (https://revers.engineering/day-2-entering-vmx-operation/)

Returns

VOID

{
    CR_FIXED CrFixed = {0};
    CR4      Cr4     = {0};
    CR0      Cr0     = {0};
 
    //
    // Fix Cr0
    //
    CrFixed.Flags = CpuReadMsr(IA32_VMX_CR0_FIXED0);
    Cr0.AsUInt    = CpuReadCr0();
    Cr0.AsUInt |= CrFixed.Fields.Low;
    CrFixed.Flags = CpuReadMsr(IA32_VMX_CR0_FIXED1);
    Cr0.AsUInt &= CrFixed.Fields.Low;
    CpuWriteCr0(Cr0.AsUInt);
 
    //
    // Fix Cr4
    //
    CrFixed.Flags = CpuReadMsr(IA32_VMX_CR4_FIXED0);
    Cr4.AsUInt    = CpuReadCr4();
    Cr4.AsUInt |= CrFixed.Fields.Low;
    CrFixed.Flags = CpuReadMsr(IA32_VMX_CR4_FIXED1);
    Cr4.AsUInt &= CrFixed.Fields.Low;
    CpuWriteCr4(Cr4.AsUInt);
}

VmxGetCurrentExecutionMode()

BOOLEAN VmxGetCurrentExecutionMode

(

)

Check current execution mode (vmx-root and non-root).

Returns

BOOLEAN Returns true if the execution is on vmx-root, otherwise false

{
    if (g_GuestState)
    {
        ULONG                   CurrentCore    = KeGetCurrentProcessorNumberEx(NULL);
        VIRTUAL_MACHINE_STATE * CurrentVmState = &g_GuestState[CurrentCore];
 
        return CurrentVmState->IsOnVmxRootMode ? VmxExecutionModeRoot : VmxExecutionModeNonRoot;
    }
    else
    {
        //
        // The structure for guest state is not initialized, thus, we're in VMX non-root
        //
        return VmxExecutionModeNonRoot;
    }
}

VmxGetCurrentLaunchState()

BOOLEAN VmxGetCurrentLaunchState

(

)

Check if the VMX is launched or not.

Returns

BOOLEAN Returns true if it's launched, otherwise false

{
    ULONG                   CurrentCore    = KeGetCurrentProcessorNumberEx(NULL);
    VIRTUAL_MACHINE_STATE * CurrentVmState = &g_GuestState[CurrentCore];
 
    return CurrentVmState->HasLaunched;
}

VmxInitialize()

BOOLEAN VmxInitialize

(

)

Initialize the VMX operation.

Returns

BOOLEAN Returns true if vmx initialized successfully

{
    ULONG ProcessorsCount;
 
    //
    // ****** Start Virtualizing Current System ******
    //
 
    //
    // Initiating EPTP and VMX
    //
    if (!VmxPerformVirtualizationOnAllCores())
    {
        //
        // there was error somewhere in initializing
        //
        return FALSE;
    }
 
    ProcessorsCount = KeQueryActiveProcessorCount(0);
 
    for (SIZE_T ProcessorID = 0; ProcessorID < ProcessorsCount; ProcessorID++)
    {
        //
        // *** Launching VM for Test (in the all logical processor) ***
        //
 
        VIRTUAL_MACHINE_STATE * GuestState = &g_GuestState[ProcessorID];
 
        //
        // Allocating VMM Stack
        //
        if (!VmxAllocateVmmStack(GuestState))
        {
            //
            // Some error in allocating Vmm Stack
            //
            return FALSE;
        }
 
        //
        // Allocating MSR Bit
        //
        if (!VmxAllocateMsrBitmap(GuestState))
        {
            //
            // Some error in allocating Msr Bitmaps
            //
            return FALSE;
        }
 
        //
        // Allocating I/O Bit
        //
        if (!VmxAllocateIoBitmaps(GuestState))
        {
            //
            // Some error in allocating I/O Bitmaps
            //
            return FALSE;
        }
 
#if USE_DEFAULT_OS_IDT_AS_HOST_IDT == FALSE
 
        //
        // Allocating Host IDT
        //
        if (!VmxAllocateHostIdt(GuestState))
        {
            //
            // Some error in allocating Host IDT
            //
            return FALSE;
        }
#endif // USE_DEFAULT_OS_IDT_AS_HOST_IDT == FALSE
 
#if USE_DEFAULT_OS_GDT_AS_HOST_GDT == FALSE
 
        //
        // Allocating Host GDT
        //
        if (!VmxAllocateHostGdt(GuestState))
        {
            //
            // Some error in allocating Host GDT
            //
            return FALSE;
        }
 
        //
        // Allocating Host TSS
        //
        if (!VmxAllocateHostTss(GuestState))
        {
            //
            // Some error in allocating Host TSS
            //
            return FALSE;
        }
 
#endif // USE_DEFAULT_OS_GDT_AS_HOST_GDT == FALSE
 
#if USE_INTERRUPT_STACK_TABLE == TRUE
 
        //
        // Allocating Host Interrupt Stack
        //
        if (!VmxAllocateHostInterruptStack(GuestState))
        {
            //
            // Some error in allocating Interrupt Stack
            //
            return FALSE;
        }
 
#endif // USE_INTERRUPT_STACK_TABLE == TRUE
    }
 
    //
    // Create a bitmap of the MSRs that cause #GP
    //
    g_MsrBitmapInvalidMsrs = VmxAllocateInvalidMsrBimap();
 
    if (g_MsrBitmapInvalidMsrs == NULL)
    {
        return FALSE;
    }
 
    //
    // As we want to support more than 32 processor (64 logical-core)
    // we let windows execute our routine for us
    //
    KeGenericCallDpc(DpcRoutineInitializeGuest, 0x0);
 
    //
    // Check if everything is ok then return true otherwise false
    //
    if (AsmVmxVmcall(VMCALL_TEST, 0x22, 0x333, 0x4444) == STATUS_SUCCESS)
    {
        return TRUE;
    }
    else
    {
        return FALSE;
    }
}

VmxIsTopLevelHypervisorHyperV()

BOOLEAN VmxIsTopLevelHypervisorHyperV

(

)

checks if the current top level hypervisor is Hyper-V

Returns

BOOLEAN TRUE indicates that the current top level hypervisor is Hyper-V, FALSE otherwise.

{
    INT32 ProcessorFeatures[4] = {0};
    CpuCpuIdEx(ProcessorFeatures, CPUID_PROCESSOR_AND_PROCESSOR_FEATURE_IDENTIFIERS, 0);
 
    if (!((ULONG)(ProcessorFeatures[2]) & HYPERV_HYPERVISOR_PRESENT_BIT))
    {
        return FALSE;
    }
 
    INT32 HypervisorVendor[4] = {0};
    CpuCpuIdEx(HypervisorVendor, HYPERV_CPUID_VENDOR_AND_MAX_FUNCTIONS, 0);
 
    return (ULONG)(HypervisorVendor[1]) == HYPERV_CPUID_VENDOR_MICROSOFT_EBX &&
           (ULONG)(HypervisorVendor[2]) == HYPERV_CPUID_VENDOR_MICROSOFT_ECX &&
           (ULONG)(HypervisorVendor[3]) == HYPERV_CPUID_VENDOR_MICROSOFT_EDX;
}

VmxLoadVmcs()

_Use_decl_annotations_ BOOLEAN VmxLoadVmcs

(

VIRTUAL_MACHINE_STATE *

VCpu

)

Implementation of VMPTRLD instruction.

Parameters

VCpu

Returns

BOOLEAN If vmptrld was unsuccessful then it returns false otherwise it returns false

{
    int VmptrldStatus;
 
    VmptrldStatus = VmxVmptrld(&VCpu->VmcsRegionPhysicalAddress);
 
    if (VmptrldStatus)
    {
        LogDebugInfo("VMCS failed to load, status : 0x%x", VmptrldStatus);
        return FALSE;
    }
    return TRUE;
}

VmxPerformTermination()

VOID VmxPerformTermination

(

)

Terminate Vmx on all logical cores.

Returns

VOID

{
    ULONG ProcessorsCount;
 
    LogDebugInfo("Terminating VMX...\n");
 
    //
    // Get number of processors
    //
    ProcessorsCount = KeQueryActiveProcessorCount(0);
 
    //
    // ******* Terminating Vmx *******
    //
 
    //
    // Unhide (disable and de-allocate) transparent-mode
    //
    if (g_CheckForFootprints)
    {
        TransparentUnhideDebuggerWrapper(NULL);
    }
 
    //
    // Remove All the hooks if any
    //
    EptHookUnHookAll();
 
    //
    // Restore the state of execution trap hooks
    //
    ExecTrapUninitialize();
 
    //
    // Broadcast to terminate Vmx
    //
    KeGenericCallDpc(DpcRoutineTerminateGuest, 0x0);
 
    //
    // ****** De-allocatee global variables ******
    //
 
    //
    // Free the buffer related to MSRs that cause #GP
    //
    PlatformMemFreePool(g_MsrBitmapInvalidMsrs);
    g_MsrBitmapInvalidMsrs = NULL;
 
    //
    // Free Identity Page Table
    //
    for (SIZE_T i = 0; i < ProcessorsCount; i++)
    {
        if (g_GuestState[i].EptPageTable != NULL)
        {
            MmFreeContiguousMemory(g_GuestState[i].EptPageTable);
        }
 
        g_GuestState[i].EptPageTable = NULL;
    }
 
    //
    // Free EptState
    //
    PlatformMemFreePool(g_EptState);
    g_EptState = NULL;
 
    //
    // Uninitialize memory mapper
    //
    MemoryMapperUninitialize();
 
    //
    // Free g_GuestState
    //
    GlobalGuestStateFreeMemory();
 
    LogDebugInfo("VMX operation turned off successfully");
}

VmxPerformVirtualizationOnAllCores()

BOOLEAN VmxPerformVirtualizationOnAllCores

(

)

Initialize essential VMX Operation tasks.

Returns

BOOLEAN Returns true if vmx is successfully initialized

{
    PAGED_CODE();
 
    if (!VmxCheckVmxSupport())
    {
        LogError("Err, VMX is not supported in this machine");
        return FALSE;
    }
 
    //
    // Check if the top level hypervisor is Hyper-V or not
    //
    if (VmxIsTopLevelHypervisorHyperV())
    {
        //
        // The top-level hypervisor is hyper-v
        //
        g_IsTopLevelHypervisorHyperV = TRUE;
 
        LogDebugInfo(" Hyper-V is detected as the top-level hypervisor");
    }
    else
    {
        LogDebugInfo(" Hyper-V is not detected as the top-level hypervisor");
    }
 
    //
    // Allocate global variable to hold Ept State
    //
    g_EptState = PlatformMemAllocateZeroedNonPagedPool(sizeof(EPT_STATE));
 
    if (!g_EptState)
    {
        LogError("Err, insufficient memory");
        return FALSE;
    }
 
    //
    // Initialize the list of hooked pages detail
    //
    InitializeListHead(&g_EptState->HookedPagesList);
 
    //
    // Check whether EPT is supported or not
    //
    if (!EptCheckFeatures())
    {
        LogError("Err, your processor doesn't support all EPT features");
        return FALSE;
    }
    else
    {
        //
        // Our processor supports EPT, now let's build MTRR
        //
        LogDebugInfo("Your processor supports all EPT features");
 
        //
        // Build MTRR Map
        //
        if (!EptBuildMtrrMap())
        {
            LogError("Err, could not build MTRR memory map");
            return FALSE;
        }
 
        LogDebugInfo("MTRR memory map built successfully");
    }
 
    if (!EptLogicalProcessorInitialize())
    {
        //
        // There were some errors in EptLogicalProcessorInitialize
        //
        return FALSE;
    }
 
    //
    // Broadcast to run vmx-specific task to virtualize cores
    //
    BroadcastVmxVirtualizationAllCores();
 
    //
    // Everything is ok, let's return true
    //
    return TRUE;
}

VmxPerformVirtualizationOnSpecificCore()

BOOLEAN VmxPerformVirtualizationOnSpecificCore

(

)

Allocates Vmx regions for all logical cores (Vmxon region and Vmcs region).

Returns

BOOLEAN

{
    ULONG                   CurrentCore = KeGetCurrentProcessorNumberEx(NULL);
    VIRTUAL_MACHINE_STATE * VCpu        = &g_GuestState[CurrentCore];
 
    LogDebugInfo("Allocating vmx regions for logical core %d", CurrentCore);
 
    //
    // Enabling VMX Operation
    //
    AsmEnableVmxOperation();
 
    //
    // Fix Cr4 and Cr0 bits during VMX operation
    //
    VmxFixCr4AndCr0Bits();
 
    LogDebugInfo("VMX-Operation enabled successfully");
 
    if (!VmxAllocateVmxonRegion(VCpu))
    {
        LogError("Err, allocating memory for vmxon region was not successful");
        return FALSE;
    }
    if (!VmxAllocateVmcsRegion(VCpu))
    {
        LogError("Err, allocating memory for vmcs region was not successful");
        return FALSE;
    }
 
    return TRUE;
}

VmxPerformVmptrst()

VOID VmxPerformVmptrst

(

)

Implementation of VMPTRST instruction.

Returns

VOID

{
    PHYSICAL_ADDRESS VmcsPhysicalAddr;
    VmcsPhysicalAddr.QuadPart = 0;
    VmxVmptrst((UINT64 *)&VmcsPhysicalAddr);
 
    LogDebugInfo("VMPTRST result : %llx", VmcsPhysicalAddr);
}

VmxPerformVmresume()

VOID VmxPerformVmresume

(

)

Resume VM using the VMRESUME instruction.

Returns

VOID

{
    UINT32 ErrorCode = 0;
 
    VmxVmresume();
 
    //
    // if VMRESUME succeed will never be here !
    //
 
    VmxVmread32P(VMCS_VM_INSTRUCTION_ERROR, &ErrorCode);
 
    VmxVmxoff();
 
    //
    // It's such a bad error because we don't where to go !
    // prefer to break
    //
 
    LogError("Err, in executing VMRESUME, status : 0x%llx, last VM-exit reason: 0x%x",
             ErrorCode,
             g_GuestState[KeGetCurrentProcessorNumberEx(NULL)].ExitReason);
}

VmxPerformVmxoff()

VOID VmxPerformVmxoff

(

VIRTUAL_MACHINE_STATE *

VCpu

)

Prepare and execute Vmxoff instruction.

Parameters

VCpu	The virtual processor's state

Returns

VOID

{
    UINT64 GuestRSP              = 0; // Save a pointer to guest rsp for times that we want to return to previous guest stateS
    UINT64 GuestRIP              = 0; // Save a pointer to guest rip for times that we want to return to previous guest state
    UINT64 GuestCr3              = 0;
    UINT64 ExitInstructionLength = 0;
 
    //
    // According to SimpleVisor :
    //      Our callback routine may have interrupted an arbitrary user process,
    //      and therefore not a thread running with a system-wide page directory.
    //      Therefore if we return back to the original caller after turning off
    //      VMX, it will keep our current "host" CR3 value which we set on entry
    //      to the PML4 of the SYSTEM process. We want to return back with the
    //      correct value of the "guest" CR3, so that the currently executing
    //      process continues to run with its expected address space mappings.
    //
 
    VmxVmread64P(VMCS_GUEST_CR3, &GuestCr3);
    CpuWriteCr3(GuestCr3);
 
    //
    // Read guest rsp and rip
    //
    VmxVmread64P(VMCS_GUEST_RIP, &GuestRIP);
    VmxVmread64P(VMCS_GUEST_RSP, &GuestRSP);
 
    //
    // Read instruction length
    //
    VmxVmread64P(VMCS_VMEXIT_INSTRUCTION_LENGTH, &ExitInstructionLength);
    GuestRIP += ExitInstructionLength;
 
    //
    // Set the previous register states
    //
    VCpu->VmxoffState.GuestRip = GuestRIP;
    VCpu->VmxoffState.GuestRsp = GuestRSP;
 
    //
    // Notify the Vmexit handler that VMX already turned off
    //
    VCpu->VmxoffState.IsVmxoffExecuted = TRUE;
 
    //
    // Restore the previous FS, GS , GDTR and IDTR register as patchguard might find the modified
    //
    HvRestoreRegisters();
 
    //
    // Restore XMM registers
    // We restore XMM registers here because we are going to execute vmxoff instruction
    // which enables interrupts and we don't want to lose the XMM registers
    // since immediately after vmxoff, an interrupt might occur and context switch
    // might change the XMM registers
    //
    AsmVmxoffRestoreXmmRegs((UINT64)VCpu->XmmRegs);
 
    //
    // Before using vmxoff, you first need to use vmclear on any VMCSes that you want to be able to use again.
    // See sections 24.1 and 24.11 of the SDM.
    //
    VmxClearVmcsState(VCpu);
 
    //
    // Execute Vmxoff
    //
    VmxVmxoff();
 
    //
    // *** Note: After executing VMXOFF, XMM registers should not be used anymore
    // Since we already restored them ***
    //
 
    //
    // Indicate the current core is not currently virtualized
    //
    VCpu->HasLaunched = FALSE;
 
    //
    // Now that VMX is OFF, we have to unset vmx-enable bit on cr4
    //
    CpuWriteCr4(CpuReadCr4() & (~REG_CR4_VMXE));
}

VmxReturnInstructionPointerForVmxoff()

UINT64 VmxReturnInstructionPointerForVmxoff

(

)

Get the RIP of guest (VMCS_GUEST_RIP) in the case of return from VMXOFF.

Returns

UINT64 Returns the instruction pointer, to change in the case of Vmxoff

{
    return g_GuestState[KeGetCurrentProcessorNumberEx(NULL)].VmxoffState.GuestRip;
}

VmxReturnStackPointerForVmxoff()

UINT64 VmxReturnStackPointerForVmxoff

(

)

Get the RIP of guest (VMCS_GUEST_RIP) in the case of return from VMXOFF.

Returns

UINT64 Returns the stack pointer, to change in the case of Vmxoff

{
    return g_GuestState[KeGetCurrentProcessorNumberEx(NULL)].VmxoffState.GuestRsp;
}

VmxSetupVmcs()

_Use_decl_annotations_ BOOLEAN VmxSetupVmcs	(	VIRTUAL_MACHINE_STATE *	VCpu,
		PVOID	GuestStack )

Create and Configure a Vmcs Layout.

Parameters

VCpu
GuestStack

Returns

BOOLEAN

{
    UINT32                  CpuBasedVmExecControls;
    UINT32                  SecondaryProcBasedVmExecControls;
    PVOID                   HostRsp;
    UINT64                  GdtBase         = 0;
    IA32_VMX_BASIC_REGISTER VmxBasicMsr     = {0};
    VMX_SEGMENT_SELECTOR    SegmentSelector = {0};
 
    //
    // Reading IA32_VMX_BASIC_MSR
    //
    VmxBasicMsr.AsUInt = CpuReadMsr(IA32_VMX_BASIC);
 
    VmxVmwrite64(VMCS_HOST_ES_SELECTOR, AsmGetEs() & 0xF8);
    VmxVmwrite64(VMCS_HOST_CS_SELECTOR, AsmGetCs() & 0xF8);
    VmxVmwrite64(VMCS_HOST_SS_SELECTOR, AsmGetSs() & 0xF8);
    VmxVmwrite64(VMCS_HOST_DS_SELECTOR, AsmGetDs() & 0xF8);
    VmxVmwrite64(VMCS_HOST_FS_SELECTOR, AsmGetFs() & 0xF8);
    VmxVmwrite64(VMCS_HOST_GS_SELECTOR, AsmGetGs() & 0xF8);
    VmxVmwrite64(VMCS_HOST_TR_SELECTOR, AsmGetTr() & 0xF8);
 
    //
    // Setting the link pointer to the required value for 4KB VMCS
    //
    VmxVmwrite64(VMCS_GUEST_VMCS_LINK_POINTER, ~0ULL);
 
    VmxVmwrite64(VMCS_GUEST_DEBUGCTL, CpuReadMsr(IA32_DEBUGCTL) & 0xFFFFFFFF);
    VmxVmwrite64(VMCS_GUEST_DEBUGCTL_HIGH, CpuReadMsr(IA32_DEBUGCTL) >> 32);
 
    //
    // ******* Time-stamp counter offset *******
    //
    VmxVmwrite64(VMCS_CTRL_TSC_OFFSET, 0);
 
    VmxVmwrite64(VMCS_CTRL_PAGEFAULT_ERROR_CODE_MASK, 0);
    VmxVmwrite64(VMCS_CTRL_PAGEFAULT_ERROR_CODE_MATCH, 0);
 
    VmxVmwrite64(VMCS_CTRL_VMEXIT_MSR_STORE_COUNT, 0);
    VmxVmwrite64(VMCS_CTRL_VMEXIT_MSR_LOAD_COUNT, 0);
 
    VmxVmwrite64(VMCS_CTRL_VMENTRY_MSR_LOAD_COUNT, 0);
    VmxVmwrite64(VMCS_CTRL_VMENTRY_INTERRUPTION_INFORMATION_FIELD, 0);
 
    GdtBase = AsmGetGdtBase();
 
    HvFillGuestSelectorData((PVOID)GdtBase, ES, AsmGetEs());
    HvFillGuestSelectorData((PVOID)GdtBase, CS, AsmGetCs());
    HvFillGuestSelectorData((PVOID)GdtBase, SS, AsmGetSs());
    HvFillGuestSelectorData((PVOID)GdtBase, DS, AsmGetDs());
    HvFillGuestSelectorData((PVOID)GdtBase, FS, AsmGetFs());
    HvFillGuestSelectorData((PVOID)GdtBase, GS, AsmGetGs());
    HvFillGuestSelectorData((PVOID)GdtBase, LDTR, AsmGetLdtr());
    HvFillGuestSelectorData((PVOID)GdtBase, TR, AsmGetTr());
 
    VmxVmwrite64(VMCS_GUEST_FS_BASE, CpuReadMsr(IA32_FS_BASE));
    VmxVmwrite64(VMCS_GUEST_GS_BASE, CpuReadMsr(IA32_GS_BASE));
 
    CpuBasedVmExecControls = HvAdjustControls(
        IA32_VMX_PROCBASED_CTLS_USE_IO_BITMAPS_FLAG |
            IA32_VMX_PROCBASED_CTLS_USE_MSR_BITMAPS_FLAG |
            IA32_VMX_PROCBASED_CTLS_ACTIVATE_SECONDARY_CONTROLS_FLAG,
        VmxBasicMsr.VmxControls ? IA32_VMX_TRUE_PROCBASED_CTLS : IA32_VMX_PROCBASED_CTLS);
 
    VmxVmwrite64(VMCS_CTRL_PROCESSOR_BASED_VM_EXECUTION_CONTROLS, CpuBasedVmExecControls);
 
    LogDebugInfo("CPU Based VM Exec Controls (Based on %s) : 0x%x",
                 VmxBasicMsr.VmxControls ? "IA32_VMX_TRUE_PROCBASED_CTLS" : "IA32_VMX_PROCBASED_CTLS",
                 CpuBasedVmExecControls);
    UINT32 SecondaryProcBasedVmExecControlsFlags = IA32_VMX_PROCBASED_CTLS2_ENABLE_RDTSCP_FLAG |
                                                   IA32_VMX_PROCBASED_CTLS2_ENABLE_EPT_FLAG |
                                                   IA32_VMX_PROCBASED_CTLS2_ENABLE_INVPCID_FLAG |
                                                   IA32_VMX_PROCBASED_CTLS2_ENABLE_XSAVES_FLAG |
                                                   IA32_VMX_PROCBASED_CTLS2_ENABLE_USER_WAIT_PAUSE_FLAG;
 
    if (g_IsVpidSupported)
    {
        SecondaryProcBasedVmExecControlsFlags |= IA32_VMX_PROCBASED_CTLS2_ENABLE_VPID_FLAG;
    }
    SecondaryProcBasedVmExecControls = HvAdjustControls(SecondaryProcBasedVmExecControlsFlags, IA32_VMX_PROCBASED_CTLS2);
 
    VmxVmwrite64(VMCS_CTRL_SECONDARY_PROCESSOR_BASED_VM_EXECUTION_CONTROLS, SecondaryProcBasedVmExecControls);
 
    LogDebugInfo("Secondary Proc Based VM Exec Controls (IA32_VMX_PROCBASED_CTLS2) : 0x%x", SecondaryProcBasedVmExecControls);
 
    VmxVmwrite64(VMCS_CTRL_PIN_BASED_VM_EXECUTION_CONTROLS,
                 HvAdjustControls(
                     0,
                     VmxBasicMsr.VmxControls ? IA32_VMX_TRUE_PINBASED_CTLS : IA32_VMX_PINBASED_CTLS));
 
    VmxVmwrite64(VMCS_CTRL_PRIMARY_VMEXIT_CONTROLS,
                 HvAdjustControls(
                     IA32_VMX_EXIT_CTLS_HOST_ADDRESS_SPACE_SIZE_FLAG |
                         IA32_VMX_EXIT_CTLS_LOAD_IA32_CET_STATE_FLAG,
                     VmxBasicMsr.VmxControls ? IA32_VMX_TRUE_EXIT_CTLS : IA32_VMX_EXIT_CTLS));
 
    VmxVmwrite64(VMCS_CTRL_VMENTRY_CONTROLS,
                 HvAdjustControls(
                     IA32_VMX_ENTRY_CTLS_IA32E_MODE_GUEST_FLAG |
                         IA32_VMX_ENTRY_CTLS_LOAD_CET_STATE_FLAG,
                     VmxBasicMsr.VmxControls ? IA32_VMX_TRUE_ENTRY_CTLS : IA32_VMX_ENTRY_CTLS));
 
    VmxVmwrite64(VMCS_CTRL_CR0_GUEST_HOST_MASK, 0);
    VmxVmwrite64(VMCS_CTRL_CR4_GUEST_HOST_MASK, 0);
 
    VmxVmwrite64(VMCS_CTRL_CR0_READ_SHADOW, 0);
    VmxVmwrite64(VMCS_CTRL_CR4_READ_SHADOW, 0);
 
    VmxVmwrite64(VMCS_GUEST_CR0, CpuReadCr0());
    VmxVmwrite64(VMCS_GUEST_CR3, CpuReadCr3());
    VmxVmwrite64(VMCS_GUEST_CR4, CpuReadCr4());
 
    VmxVmwrite64(VMCS_GUEST_DR7, 0x400);
 
    VmxVmwrite64(VMCS_HOST_CR0, CpuReadCr0());
    VmxVmwrite64(VMCS_HOST_CR4, CpuReadCr4());
 
    //
    // Because we may be executing in an arbitrary user-mode, process as part
    // of the DPC interrupt we execute in We have to save Cr3, for VMCS_HOST_CR3
    //
 
    VmxVmwrite64(VMCS_HOST_CR3, LayoutGetSystemDirectoryTableBase());
 
    VmxVmwrite64(VMCS_GUEST_GDTR_BASE, AsmGetGdtBase());
    VmxVmwrite64(VMCS_GUEST_IDTR_BASE, AsmGetIdtBase());
 
    VmxVmwrite64(VMCS_GUEST_GDTR_LIMIT, AsmGetGdtLimit());
    VmxVmwrite64(VMCS_GUEST_IDTR_LIMIT, AsmGetIdtLimit());
 
    VmxVmwrite64(VMCS_GUEST_RFLAGS, AsmGetRflags());
 
    VmxVmwrite64(VMCS_GUEST_SYSENTER_CS, CpuReadMsr(IA32_SYSENTER_CS));
    VmxVmwrite64(VMCS_GUEST_SYSENTER_EIP, CpuReadMsr(IA32_SYSENTER_EIP));
    VmxVmwrite64(VMCS_GUEST_SYSENTER_ESP, CpuReadMsr(IA32_SYSENTER_ESP));
 
#if USE_DEFAULT_OS_GDT_AS_HOST_GDT == FALSE
 
    SegmentGetDescriptor((PUCHAR)VCpu->HostGdt, AsmGetTr(), &SegmentSelector);
 
    VmxVmwrite64(VMCS_HOST_TR_BASE, SegmentSelector.Base);
    VmxVmwrite64(VMCS_HOST_GDTR_BASE, VCpu->HostGdt);
 
#else
 
    SegmentGetDescriptor((PUCHAR)AsmGetGdtBase(), AsmGetTr(), &SegmentSelector);
 
    VmxVmwrite64(VMCS_HOST_TR_BASE, SegmentSelector.Base);
    VmxVmwrite64(VMCS_HOST_GDTR_BASE, AsmGetGdtBase());
 
#endif // USE_DEFAULT_OS_GDT_AS_HOST_GDT == FALSE
 
    VmxVmwrite64(VMCS_HOST_FS_BASE, CpuReadMsr(IA32_FS_BASE));
    VmxVmwrite64(VMCS_HOST_GS_BASE, CpuReadMsr(IA32_GS_BASE));
 
#if USE_DEFAULT_OS_IDT_AS_HOST_IDT == FALSE
 
    VmxVmwrite64(VMCS_HOST_IDTR_BASE, VCpu->HostIdt);
 
#else
 
    VmxVmwrite64(VMCS_HOST_IDTR_BASE, AsmGetIdtBase());
 
#endif // USE_DEFAULT_OS_IDT_AS_HOST_IDT == FALSE
 
    VmxVmwrite64(VMCS_HOST_SYSENTER_CS, CpuReadMsr(IA32_SYSENTER_CS));
    VmxVmwrite64(VMCS_HOST_SYSENTER_EIP, CpuReadMsr(IA32_SYSENTER_EIP));
    VmxVmwrite64(VMCS_HOST_SYSENTER_ESP, CpuReadMsr(IA32_SYSENTER_ESP));
 
    //
    // Set MSR Bitmaps
    //
    VmxVmwrite64(VMCS_CTRL_MSR_BITMAP_ADDRESS, VCpu->MsrBitmapPhysicalAddress);
 
    //
    // Set I/O Bitmaps
    //
    VmxVmwrite64(VMCS_CTRL_IO_BITMAP_A_ADDRESS, VCpu->IoBitmapPhysicalAddressA);
    VmxVmwrite64(VMCS_CTRL_IO_BITMAP_B_ADDRESS, VCpu->IoBitmapPhysicalAddressB);
 
    //
    // Set up EPT
    //
    VmxVmwrite64(VMCS_CTRL_EPT_POINTER, VCpu->EptPointer.AsUInt);
 
    //
    // Set up VPID
 
    //
    // For all processors, we will use a VPID = 1. This allows the processor to separate caching
    //  of EPT structures away from the regular OS page translation tables in the TLB.
    //
    VmxVmwrite64(VIRTUAL_PROCESSOR_ID, VPID_TAG);
 
    //
    // setup guest rsp
    //
    VmxVmwrite64(VMCS_GUEST_RSP, (UINT64)GuestStack);
 
    //
    // setup guest rip
    //
    VmxVmwrite64(VMCS_GUEST_RIP, (UINT64)AsmVmxRestoreState);
 
    //
    // Stack should be aligned to 16 because we wanna save XMM and FPU registers and those instructions
    // needs alignment to 16
    //
    HostRsp = (PVOID)((UINT64)VCpu->VmmStack + VMM_STACK_SIZE - 1);
    HostRsp = ((PVOID)((ULONG_PTR)(HostRsp) & ~(16 - 1)));
    VmxVmwrite64(VMCS_HOST_RSP, (UINT64)HostRsp);
    VmxVmwrite64(VMCS_HOST_RIP, (UINT64)AsmVmexitHandler);
 
    return TRUE;
}

VmxTerminate()

BOOLEAN VmxTerminate

(

)

Broadcast to terminate VMX on all logical cores.

Returns

BOOLEAN Returns true if vmxoff successfully executed in vmcall or otherwise returns false

{
    NTSTATUS                Status      = STATUS_SUCCESS;
    ULONG                   CurrentCore = KeGetCurrentProcessorNumberEx(NULL);
    VIRTUAL_MACHINE_STATE * VCpu        = &g_GuestState[CurrentCore];
 
    //
    // Execute Vmcall to to turn off vmx from Vmx root mode
    //
    Status = AsmVmxVmcall(VMCALL_VMXOFF, NULL64_ZERO, NULL64_ZERO, NULL64_ZERO);
 
    if (Status == STATUS_SUCCESS)
    {
        LogDebugInfo("VMX terminated on logical core %d\n", CurrentCore);
 
        //
        // Free the destination memory
        //
        MmFreeContiguousMemory((PVOID)VCpu->VmxonRegionVirtualAddress);
        MmFreeContiguousMemory((PVOID)VCpu->VmcsRegionVirtualAddress);
        PlatformMemFreePool((PVOID)VCpu->VmmStack);
        PlatformMemFreePool((PVOID)VCpu->MsrBitmapVirtualAddress);
        PlatformMemFreePool((PVOID)VCpu->IoBitmapVirtualAddressA);
        PlatformMemFreePool((PVOID)VCpu->IoBitmapVirtualAddressB);
#if USE_DEFAULT_OS_IDT_AS_HOST_IDT == FALSE
        PlatformMemFreePool((PVOID)VCpu->HostIdt);
#endif // USE_DEFAULT_OS_IDT_AS_HOST_IDT == FALSE
 
#if USE_DEFAULT_OS_GDT_AS_HOST_GDT == FALSE
        PlatformMemFreePool((PVOID)VCpu->HostGdt);
        PlatformMemFreePool((PVOID)VCpu->HostTss);
#endif // USE_DEFAULT_OS_GDT_AS_HOST_GDT == FALSE
 
#if USE_INTERRUPT_STACK_TABLE == TRUE
        PlatformMemFreePool((PVOID)VCpu->HostInterruptStack);
#endif // USE_INTERRUPT_STACK_TABLE == FALSE
 
        return TRUE;
    }
 
    return FALSE;
}

VmxVirtualizeCurrentSystem()

BOOLEAN VmxVirtualizeCurrentSystem

(

PVOID

GuestStack

)

Initialize VMX Operation.

Parameters

GuestStack

Guest stack for the this core (VMCS_GUEST_RSP)

Returns

BOOLEAN This function won't return true as when Vmlaunch is executed the rest of the function never executes but returning FALSE is an indication of error

{
    UINT64                  ErrorCode   = 0;
    ULONG                   CurrentCore = KeGetCurrentProcessorNumberEx(NULL);
    VIRTUAL_MACHINE_STATE * VCpu        = &g_GuestState[CurrentCore];
 
    LogDebugInfo("Virtualizing current system (logical core : 0x%x)", CurrentCore);
 
#if USE_DEFAULT_OS_IDT_AS_HOST_IDT == FALSE
 
    //
    // Prepare Host IDT
    //
    IdtEmulationPrepareHostIdt(VCpu);
#endif // USE_DEFAULT_OS_IDT_AS_HOST_IDT == FALSE
 
#if USE_DEFAULT_OS_GDT_AS_HOST_GDT == FALSE
 
    //
    // Prepare Host GDT and TSS
    //
    SegmentPrepareHostGdt((SEGMENT_DESCRIPTOR_32 *)AsmGetGdtBase(),
                          AsmGetGdtLimit(),
                          AsmGetTr(),
                          VCpu->HostInterruptStack,
                          (SEGMENT_DESCRIPTOR_32 *)VCpu->HostGdt,
                          (TASK_STATE_SEGMENT_64 *)VCpu->HostTss);
 
#endif // USE_DEFAULT_OS_GDT_AS_HOST_GDT == FALSE
 
    //
    // Clear the VMCS State
    //
    if (!VmxClearVmcsState(VCpu))
    {
        LogError("Err, failed to clear vmcs");
        return FALSE;
    }
 
    //
    // Load VMCS (Set the Current VMCS)
    //
    if (!VmxLoadVmcs(VCpu))
    {
        LogError("Err, failed to load vmcs");
        return FALSE;
    }
 
    LogDebugInfo("Setting up VMCS for current logical core");
 
    VmxSetupVmcs(VCpu, GuestStack);
 
    LogDebugInfo("Executing VMLAUNCH on logical core %d", CurrentCore);
 
    //
    // Setting the state to indicate current core is currently virtualized
    //
 
    VCpu->HasLaunched = TRUE;
 
    VmxVmlaunch();
 
    //
    // ******** if Vmlaunch succeed will never be here ! ********
    //
 
    //
    // If failed, then indicate that current core is not currently virtualized
    //
    VCpu->HasLaunched = FALSE;
 
    //
    // Read error code firstly
    //
    VmxVmread64P(VMCS_VM_INSTRUCTION_ERROR, &ErrorCode);
 
    LogError("Err, unable to execute VMLAUNCH, status : 0x%llx", ErrorCode);
 
    //
    // Then Execute Vmxoff
    //
    VmxVmxoff();
    LogError("Err, VMXOFF Executed Successfully but it was because of an error");
 
    return FALSE;
}

VmxVmfunc()

UINT64 VmxVmfunc	(	UINT32	EptpIndex,
		UINT32	Function )

VMFUNC instruction.

Should be executed in VMX NON-root

Parameters

EptpIndex
Function

Returns

UINT64

{
    //
    // *** To be executed in VMX non-root ***
    //
 
    //
    // Description from : https://users.cs.utah.edu/~aburtsev/lls-sem/index.php?n=Main.VMFUNCNotes
    //
    // VMFUNC is a new Intel primitive that allows to change an EPT page table underneath a VT-x VM without exiting into the hypervisor
    // Effectively, it's a page table switch in hardware and thus it allows one to build a fast context switch
    //
 
    //
    // Each VT-x virtual machine is configured with a Virtual Machine Control Structure (VMCS)
    //  This is a page of memory in which the VMM writes configuration data for things like how interrupts are handled,
    //  initial control register values during guest entry, and a whole bunch of other things
    //
    // One of those other things is a pointer to a page of candidate EPT pointers. These are pointers to different EPT
    //  page table hierarchies, each one giving a possibly different physical -> machine mapping. The VMM sets up this page
    //  of EPT pointers and has to also turn on a couple other settings in the VMCS to fully enable EPT switching via VMFUNC
    //
    // In non-root operation (inside a VM) code running in any privilege level can switch EPT hierarchies through the following
    //  steps:
    //
    // Storing 0 in %rax (EPT switching is VMFUNC 0)
    // Storing the index into the candidate EPT table in %rcx
    // Invoking the VMFUNC instruction
    // The processor will switch EPTs. Invoking VMFUNC will not cause a VM Exit
    //
    // All of this is detailed in the Intel SDM Volume 3, 25.5.5.3 "EPT Switching"
    //
    // It is worth noting that this will not change/save values in control registers (e.g. %cr3), general purpose registers,
    //  and so on. It's up to the code and VMM to set things up so it all works gracefully
    //
 
    //
    // Are TLBs flushed ? No, unless VPIDs are not being used(which I, Charlie, would say is rare)
    // See Intel SDM Volume 3, 25.5.5.3 "EPT Switching" and 28.3.3.1 "Operations that Invalidate Cached Mappings"
    //
 
    return AsmVmfunc(EptpIndex, Function);
}