Vmx.h File Reference

VMX Instruction and operation headers. More...

Go to the source code of this file.

Classes
union	_HYPERCALL_INPUT_VALUE
	Hypercalls for Hyper-V. More...

Macros
#define	VMCS_SIZE   4096
	VMCS Region Size.
#define	VMXON_SIZE   4096
	VMXON Region Size.
#define	HYPERV_CPUID_VENDOR_AND_MAX_FUNCTIONS   0x40000000
	CPUID RCX(s) - Based on Hyper-V.
#define	HYPERV_CPUID_INTERFACE   0x40000001
#define	HYPERV_CPUID_VERSION   0x40000002
#define	HYPERV_CPUID_FEATURES   0x40000003
#define	HYPERV_CPUID_ENLIGHTMENT_INFO   0x40000004
#define	HYPERV_CPUID_IMPLEMENT_LIMITS   0x40000005
#define	HYPERV_HYPERVISOR_PRESENT_BIT   0x80000000
#define	HYPERV_CPUID_MIN   0x40000005
#define	HYPERV_CPUID_MAX   0x4000ffff
#define	GUEST_INTR_STATE_STI   0x00000001
	GUEST_INTERRUPTIBILITY_INFO flags.
#define	GUEST_INTR_STATE_MOV_SS   0x00000002
#define	GUEST_INTR_STATE_SMI   0x00000004
#define	GUEST_INTR_STATE_NMI   0x00000008
#define	GUEST_INTR_STATE_ENCLAVE_INTR   0x00000010
#define	SHADOW_INT_MOV_SS   0x01
	Interrupt shadow states.
#define	SHADOW_INT_STI   0x02
#define	VMM_STACK_SIZE   0x8000
	Stack Size.
#define	IS_VALID_DEBUG_REGISTER(DebugRegister)
#define	HYPERV_CPUID_VENDOR_MICROSOFT_EBX   0x7263694d
	Hyper-V CPUID leaves.
#define	HYPERV_CPUID_VENDOR_MICROSOFT_ECX   0x666f736f
#define	HYPERV_CPUID_VENDOR_MICROSOFT_EDX   0x76482074
#define	VMCS_GUEST_DEBUGCTL_HIGH   0x00002803
#define	VIRTUAL_PROCESSOR_ID   0x00000000

Typedefs
typedef union _HYPERCALL_INPUT_VALUE	HYPERCALL_INPUT_VALUE
	Hypercalls for Hyper-V.
typedef union _HYPERCALL_INPUT_VALUE *	PHYPERCALL_INPUT_VALUE
typedef enum _MOV_TO_DEBUG_REG	MOV_TO_DEBUG_REG
	MOV to debug registers states.

Enumerations
enum	HYPERCALL_CODE {   HvSwitchVirtualAddressSpace = 0x0001 , HvFlushVirtualAddressSpace = 0x0002 , HvFlushVirtualAddressList = 0x0003 , HvGetLogicalProcessorRunTime = 0x0004 ,   HvCallNotifyLongSpinWait = 0x0008 , HvCallParkedVirtualProcessors = 0x0009 , HvCallSyntheticClusterIpi = 0x000B , HvCallModifyVtlProtectionMask = 0x000C ,   HvCallEnablePartitionVtl = 0x000D , HvCallDisablePartitionVtl = 0x000E , HvCallEnableVpVtl = 0x000F , HvCallDisableVpVtl = 0x0010 ,   HvCallVtlCall = 0x0011 , HvCallVtlReturn = 0x0012 , HvCallFlushVirtualAddressSpaceEx = 0x0013 , HvCallFlushVirtualAddressListEx = 0x0014 ,   HvCallSendSyntheticClusterIpiEx = 0x0015 , HvCreatePartition = 0x0040 , HvInitializePartition = 0x0041 , HvFinalizePartition = 0x0042 ,   HvDeletePartition = 0x0043 , HvGetPartitionProperty = 0x0044 , HvSetPartitionProperty = 0x0045 , HvGetPartitionId = 0x0046 ,   HvGetNextChildPartition = 0x0047 , HvDepositMemory = 0x0048 , HvWithdrawMemory = 0x0049 , HvGetMemoryBalance = 0x004A ,   HvMapGpaPages = 0x004B , HvUnmapGpaPages = 0x004C , HvInstallIntercept = 0x004D , HvCreateVp = 0x004E ,   HvDeleteVp = 0x004F , HvGetVpRegisters = 0x0050 , HvSetVpRegisters = 0x0051 , HvTranslateVirtualAddress = 0x0052 ,   HvReadGpa = 0x0053 , HvWriteGpa = 0x0054 , HvClearVirtualInterrupt = 0x0056 , HvDeletePort = 0x0058 ,   HvConnectPort = 0x0059 , HvGetPortProperty = 0x005A , HvDisconnectPort = 0x005B , HvPostMessage = 0x005C ,   HvSignalEvent = 0x005D , HvSavePartitionState = 0x005E , HvRestorePartitionState = 0x005F , HvInitializeEventLogBufferGroup = 0x0060 ,   HvFinalizeEventLogBufferGroup = 0x0061 , HvCreateEventLogBuffer = 0x0062 , HvDeleteEventLogBuffer = 0x0063 , HvMapEventLogBuffer = 0x0064 ,   HvUnmapEventLogBuffer = 0x0065 , HvSetEventLogGroupSources = 0x0066 , HvReleaseEventLogBuffer = 0x0067 , HvFlushEventLogBuffer = 0x0068 ,   HvPostDebugData = 0x0069 , HvRetrieveDebugData = 0x006A , HvResetDebugSession = 0x006B , HvMapStatsPage = 0x006C ,   HvUnmapStatsPage = 0x006D , HvCallMapSparseGpaPages = 0x006E , HvCallSetSystemProperty = 0x006F , HvCallSetPortProperty = 0x0070 ,   HvCallAddLogicalProcessor = 0x0076 , HvCallRemoveLogicalProcessor = 0x0077 , HvCallQueryNumaDistance = 0x0078 , HvCallSetLogicalProcessorProperty = 0x0079 ,   HvCallGetLogicalProcessorProperty = 0x007A , HvCallGetSystemProperty = 0x007B , HvCallMapDeviceInterrupt = 0x007C , HvCallUnmapDeviceInterrupt = 0x007D ,   HvCallRetargetDeviceInterrupt = 0x007E , HvCallMapDevicePages = 0x0080 , HvCallUnmapDevicePages = 0x0081 , HvCallAttachDevice = 0x0082 ,   HvCallDetachDevice = 0x0083 , HvCallNotifyStandbyTransition = 0x0084 , HvCallPrepareForSleep = 0x0085 , HvCallPrepareForHibernate = 0x0086 ,   HvCallNotifyPartitionEvent = 0x0087 , HvCallGetLogicalProcessorRegisters = 0x0088 , HvCallSetLogicalProcessorRegisters = 0x0089 , HvCallQueryAssotiatedLpsforMca = 0x008A ,   HvCallNotifyRingEmpty = 0x008B , HvCallInjectSyntheticMachineCheck = 0x008C , HvCallScrubPartition = 0x008D , HvCallCollectLivedump = 0x008E ,   HvCallDisableHypervisor = 0x008F , HvCallModifySparseGpaPages = 0x0090 , HvCallRegisterInterceptResult = 0x0091 , HvCallUnregisterInterceptResult = 0x0092 ,   HvCallAssertVirtualInterrupt = 0x0094 , HvCallCreatePort = 0x0095 , HvCallConnectPort = 0x0096 , HvCallGetSpaPageList = 0x0097 ,   HvCallStartVirtualProcessor = 0x009A , HvCallGetVpIndexFromApicId = 0x009A , HvCallFlushGuestPhysicalAddressSpace = 0x00AF , HvCallFlushGuestPhysicalAddressList = 0x00B0 }
	Hyper-V Hypercalls. More...
enum	_MOV_TO_DEBUG_REG { AccessToDebugRegister = 0 , AccessFromDebugRegister = 1 }
	MOV to debug registers states. More...

Functions
BOOLEAN	VmxIsTopLevelHypervisorHyperV ()
	checks if the current top level hypervisor is Hyper-V
BOOLEAN	VmxCheckVmxSupport ()
	Check whether VMX Feature is supported or not.
BOOLEAN	VmxInitialize ()
	Initialize the VMX operation.
BOOLEAN	VmxPerformVirtualizationOnAllCores ()
	Initialize essential VMX Operation tasks.
BOOLEAN	VmxTerminate ()
	Broadcast to terminate VMX on all logical cores.
BOOLEAN	VmxPerformVirtualizationOnSpecificCore ()
	Allocates Vmx regions for all logical cores (Vmxon region and Vmcs region).
BOOLEAN	VmxLoadVmcs (_In_ VIRTUAL_MACHINE_STATE *VCpu)
BOOLEAN	VmxClearVmcsState (_In_ VIRTUAL_MACHINE_STATE *VCpu)
BOOLEAN	VmxCheckIsOnVmxRoot ()
	It can deterministically check whether the caller is on vmx-root mode or not.
BOOLEAN	VmxVirtualizeCurrentSystem (PVOID GuestStack)
	Initialize VMX Operation.
BOOLEAN	VmxSetupVmcs (_In_ VIRTUAL_MACHINE_STATE *VCpu, _In_ PVOID GuestStack)
VOID	VmxPerformVmptrst ()
	Implementation of VMPTRST instruction.
VOID	VmxPerformVmresume ()
	Resume VM using the VMRESUME instruction.
VOID	VmxPerformVmxoff (VIRTUAL_MACHINE_STATE *VCpu)
	Prepare and execute Vmxoff instruction.
VOID	VmxPerformTermination ()
	Terminate Vmx on all logical cores.
VOID	VmxHandleXsetbv (VIRTUAL_MACHINE_STATE *VCpu)
	Handling XSETBV Instruction vm-exits.
VOID	VmxHandleVmxPreemptionTimerVmexit (VIRTUAL_MACHINE_STATE *VCpu)
	Handling VMX Preemption Timer vm-exits.
VOID	VmxHandleTripleFaults (VIRTUAL_MACHINE_STATE *VCpu)
	Handling triple fault VM-exits.
VOID	VmxFixCr4AndCr0Bits ()
	Fix values for cr0 and cr4 bits.
VOID	VmxCompatibleMicroSleep (UINT64 ns)
	VMX-root compatible micro sleep.
UINT64	VmxReturnStackPointerForVmxoff ()
	Get the RIP of guest (VMCS_GUEST_RIP) in the case of return from VMXOFF.
UINT64	VmxReturnInstructionPointerForVmxoff ()
	Get the RIP of guest (VMCS_GUEST_RIP) in the case of return from VMXOFF.
BOOLEAN	VmxGetCurrentExecutionMode ()
	Check current execution mode (vmx-root and non-root).
BOOLEAN	VmxGetCurrentLaunchState ()
	Check if the VMX is launched or not.
UINT32	VmxCompatibleStrlen (const CHAR *S)
	implementation of vmx-root mode compatible strlen
UINT32	VmxCompatibleWcslen (const WCHAR *S)
	implementation of vmx-root mode compatible wcslen
INT32	VmxCompatibleStrcmp (const CHAR *Address1, const CHAR *Address2, SIZE_T Num, BOOLEAN IsStrncmp)
	implementation of vmx-root mode compatible strcmp and strncmp
INT32	VmxCompatibleWcscmp (const WCHAR *Address1, const WCHAR *Address2, SIZE_T Num, BOOLEAN IsWcsncmp)
	implementation of vmx-root mode compatible wcscmp and wcsncmp
INT32	VmxCompatibleMemcmp (const CHAR *Address1, const CHAR *Address2, SIZE_T Count)
	implementation of vmx-root mode compatible memcmp

Detailed Description

VMX Instruction and operation headers.

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.1

Date

2020-04-11

Copyright

This project is released under the GNU Public License v3.

Macro Definition Documentation

GUEST_INTR_STATE_ENCLAVE_INTR

#define GUEST_INTR_STATE_ENCLAVE_INTR   0x00000010

GUEST_INTR_STATE_MOV_SS

#define GUEST_INTR_STATE_MOV_SS   0x00000002

GUEST_INTR_STATE_NMI

#define GUEST_INTR_STATE_NMI   0x00000008

GUEST_INTR_STATE_SMI

#define GUEST_INTR_STATE_SMI   0x00000004

GUEST_INTR_STATE_STI

#define GUEST_INTR_STATE_STI   0x00000001

GUEST_INTERRUPTIBILITY_INFO flags.

HYPERV_CPUID_ENLIGHTMENT_INFO

#define HYPERV_CPUID_ENLIGHTMENT_INFO   0x40000004

HYPERV_CPUID_FEATURES

#define HYPERV_CPUID_FEATURES   0x40000003

HYPERV_CPUID_IMPLEMENT_LIMITS

#define HYPERV_CPUID_IMPLEMENT_LIMITS   0x40000005

HYPERV_CPUID_INTERFACE

#define HYPERV_CPUID_INTERFACE   0x40000001

HYPERV_CPUID_MAX

#define HYPERV_CPUID_MAX   0x4000ffff

HYPERV_CPUID_MIN

#define HYPERV_CPUID_MIN   0x40000005

HYPERV_CPUID_VENDOR_AND_MAX_FUNCTIONS

#define HYPERV_CPUID_VENDOR_AND_MAX_FUNCTIONS   0x40000000

CPUID RCX(s) - Based on Hyper-V.

HYPERV_CPUID_VENDOR_MICROSOFT_EBX

#define HYPERV_CPUID_VENDOR_MICROSOFT_EBX   0x7263694d

Hyper-V CPUID leaves.

HYPERV_CPUID_VENDOR_MICROSOFT_ECX

#define HYPERV_CPUID_VENDOR_MICROSOFT_ECX   0x666f736f

HYPERV_CPUID_VENDOR_MICROSOFT_EDX

#define HYPERV_CPUID_VENDOR_MICROSOFT_EDX   0x76482074

HYPERV_CPUID_VERSION

#define HYPERV_CPUID_VERSION   0x40000002

HYPERV_HYPERVISOR_PRESENT_BIT

#define HYPERV_HYPERVISOR_PRESENT_BIT   0x80000000

IS_VALID_DEBUG_REGISTER

#define IS_VALID_DEBUG_REGISTER

(

DebugRegister

)

Value:

(((DebugRegister <= VMX_EXIT_QUALIFICATION_REGISTER_DR0) && (DebugRegister <= VMX_EXIT_QUALIFICATION_REGISTER_DR7)) && (DebugRegister != 0x00000004 && DebugRegister != 0x00000005))

#define IS_VALID_DEBUG_REGISTER(DebugRegister) \
    (((DebugRegister <= VMX_EXIT_QUALIFICATION_REGISTER_DR0) && (DebugRegister <= VMX_EXIT_QUALIFICATION_REGISTER_DR7)) && (DebugRegister != 0x00000004 && DebugRegister != 0x00000005))

SHADOW_INT_MOV_SS

#define SHADOW_INT_MOV_SS   0x01

Interrupt shadow states.

SHADOW_INT_STI

#define SHADOW_INT_STI   0x02

VIRTUAL_PROCESSOR_ID

#define VIRTUAL_PROCESSOR_ID   0x00000000

VMCS_GUEST_DEBUGCTL_HIGH

#define VMCS_GUEST_DEBUGCTL_HIGH   0x00002803

Guest IA32_DEBUGCTL.

VMCS_SIZE

#define VMCS_SIZE   4096

VMCS Region Size.

VMM_STACK_SIZE

#define VMM_STACK_SIZE   0x8000

Stack Size.

VMXON_SIZE

#define VMXON_SIZE   4096

VMXON Region Size.

Typedef Documentation

HYPERCALL_INPUT_VALUE

typedef union _HYPERCALL_INPUT_VALUE HYPERCALL_INPUT_VALUE

Hypercalls for Hyper-V.

MOV_TO_DEBUG_REG

typedef enum _MOV_TO_DEBUG_REG MOV_TO_DEBUG_REG

MOV to debug registers states.

PHYPERCALL_INPUT_VALUE

typedef union _HYPERCALL_INPUT_VALUE * PHYPERCALL_INPUT_VALUE

Enumeration Type Documentation

_MOV_TO_DEBUG_REG

enum _MOV_TO_DEBUG_REG

MOV to debug registers states.

Enumerator
AccessToDebugRegister
AccessFromDebugRegister

{
    AccessToDebugRegister   = 0,
    AccessFromDebugRegister = 1,
} MOV_TO_DEBUG_REG;

HYPERCALL_CODE

enum HYPERCALL_CODE

Hyper-V Hypercalls.

Enumerator
HvSwitchVirtualAddressSpace
HvFlushVirtualAddressSpace
HvFlushVirtualAddressList
HvGetLogicalProcessorRunTime
HvCallNotifyLongSpinWait
HvCallParkedVirtualProcessors
HvCallSyntheticClusterIpi
HvCallModifyVtlProtectionMask
HvCallEnablePartitionVtl
HvCallDisablePartitionVtl
HvCallEnableVpVtl
HvCallDisableVpVtl
HvCallVtlCall
HvCallVtlReturn
HvCallFlushVirtualAddressSpaceEx
HvCallFlushVirtualAddressListEx
HvCallSendSyntheticClusterIpiEx
HvCreatePartition
HvInitializePartition
HvFinalizePartition
HvDeletePartition
HvGetPartitionProperty
HvSetPartitionProperty
HvGetPartitionId
HvGetNextChildPartition
HvDepositMemory
HvWithdrawMemory
HvGetMemoryBalance
HvMapGpaPages
HvUnmapGpaPages
HvInstallIntercept
HvCreateVp
HvDeleteVp
HvGetVpRegisters
HvSetVpRegisters
HvTranslateVirtualAddress
HvReadGpa
HvWriteGpa
HvClearVirtualInterrupt
HvDeletePort
HvConnectPort
HvGetPortProperty
HvDisconnectPort
HvPostMessage
HvSignalEvent
HvSavePartitionState
HvRestorePartitionState
HvInitializeEventLogBufferGroup
HvFinalizeEventLogBufferGroup
HvCreateEventLogBuffer
HvDeleteEventLogBuffer
HvMapEventLogBuffer
HvUnmapEventLogBuffer
HvSetEventLogGroupSources
HvReleaseEventLogBuffer
HvFlushEventLogBuffer
HvPostDebugData
HvRetrieveDebugData
HvResetDebugSession
HvMapStatsPage
HvUnmapStatsPage
HvCallMapSparseGpaPages
HvCallSetSystemProperty
HvCallSetPortProperty
HvCallAddLogicalProcessor
HvCallRemoveLogicalProcessor
HvCallQueryNumaDistance
HvCallSetLogicalProcessorProperty
HvCallGetLogicalProcessorProperty
HvCallGetSystemProperty
HvCallMapDeviceInterrupt
HvCallUnmapDeviceInterrupt
HvCallRetargetDeviceInterrupt
HvCallMapDevicePages
HvCallUnmapDevicePages
HvCallAttachDevice
HvCallDetachDevice
HvCallNotifyStandbyTransition
HvCallPrepareForSleep
HvCallPrepareForHibernate
HvCallNotifyPartitionEvent
HvCallGetLogicalProcessorRegisters
HvCallSetLogicalProcessorRegisters
HvCallQueryAssotiatedLpsforMca
HvCallNotifyRingEmpty
HvCallInjectSyntheticMachineCheck
HvCallScrubPartition
HvCallCollectLivedump
HvCallDisableHypervisor
HvCallModifySparseGpaPages
HvCallRegisterInterceptResult
HvCallUnregisterInterceptResult
HvCallAssertVirtualInterrupt
HvCallCreatePort
HvCallConnectPort
HvCallGetSpaPageList
HvCallStartVirtualProcessor
HvCallGetVpIndexFromApicId
HvCallFlushGuestPhysicalAddressSpace
HvCallFlushGuestPhysicalAddressList

{
    HvSwitchVirtualAddressSpace  = 0x0001,
    HvFlushVirtualAddressSpace   = 0x0002,
    HvFlushVirtualAddressList    = 0x0003,
    HvGetLogicalProcessorRunTime = 0x0004,
    // 0x0005..0x0007 are reserved
    HvCallNotifyLongSpinWait         = 0x0008,
    HvCallParkedVirtualProcessors    = 0x0009,
    HvCallSyntheticClusterIpi        = 0x000B,
    HvCallModifyVtlProtectionMask    = 0x000C,
    HvCallEnablePartitionVtl         = 0x000D,
    HvCallDisablePartitionVtl        = 0x000E,
    HvCallEnableVpVtl                = 0x000F,
    HvCallDisableVpVtl               = 0x0010,
    HvCallVtlCall                    = 0x0011,
    HvCallVtlReturn                  = 0x0012,
    HvCallFlushVirtualAddressSpaceEx = 0x0013,
    HvCallFlushVirtualAddressListEx  = 0x0014,
    HvCallSendSyntheticClusterIpiEx  = 0x0015,
    // 0x0016..0x003F are reserved
    HvCreatePartition         = 0x0040,
    HvInitializePartition     = 0x0041,
    HvFinalizePartition       = 0x0042,
    HvDeletePartition         = 0x0043,
    HvGetPartitionProperty    = 0x0044,
    HvSetPartitionProperty    = 0x0045,
    HvGetPartitionId          = 0x0046,
    HvGetNextChildPartition   = 0x0047,
    HvDepositMemory           = 0x0048,
    HvWithdrawMemory          = 0x0049,
    HvGetMemoryBalance        = 0x004A,
    HvMapGpaPages             = 0x004B,
    HvUnmapGpaPages           = 0x004C,
    HvInstallIntercept        = 0x004D,
    HvCreateVp                = 0x004E,
    HvDeleteVp                = 0x004F,
    HvGetVpRegisters          = 0x0050,
    HvSetVpRegisters          = 0x0051,
    HvTranslateVirtualAddress = 0x0052,
    HvReadGpa                 = 0x0053,
    HvWriteGpa                = 0x0054,
    // 0x0055 is deprecated
    HvClearVirtualInterrupt = 0x0056,
    // 0x0057 is deprecated
    HvDeletePort                    = 0x0058,
    HvConnectPort                   = 0x0059,
    HvGetPortProperty               = 0x005A,
    HvDisconnectPort                = 0x005B,
    HvPostMessage                   = 0x005C,
    HvSignalEvent                   = 0x005D,
    HvSavePartitionState            = 0x005E,
    HvRestorePartitionState         = 0x005F,
    HvInitializeEventLogBufferGroup = 0x0060,
    HvFinalizeEventLogBufferGroup   = 0x0061,
    HvCreateEventLogBuffer          = 0x0062,
    HvDeleteEventLogBuffer          = 0x0063,
    HvMapEventLogBuffer             = 0x0064,
    HvUnmapEventLogBuffer           = 0x0065,
    HvSetEventLogGroupSources       = 0x0066,
    HvReleaseEventLogBuffer         = 0x0067,
    HvFlushEventLogBuffer           = 0x0068,
    HvPostDebugData                 = 0x0069,
    HvRetrieveDebugData             = 0x006A,
    HvResetDebugSession             = 0x006B,
    HvMapStatsPage                  = 0x006C,
    HvUnmapStatsPage                = 0x006D,
    HvCallMapSparseGpaPages         = 0x006E,
    HvCallSetSystemProperty         = 0x006F,
    HvCallSetPortProperty           = 0x0070,
    // 0x0071..0x0075 are reserved
    HvCallAddLogicalProcessor         = 0x0076,
    HvCallRemoveLogicalProcessor      = 0x0077,
    HvCallQueryNumaDistance           = 0x0078,
    HvCallSetLogicalProcessorProperty = 0x0079,
    HvCallGetLogicalProcessorProperty = 0x007A,
    HvCallGetSystemProperty           = 0x007B,
    HvCallMapDeviceInterrupt          = 0x007C,
    HvCallUnmapDeviceInterrupt        = 0x007D,
    HvCallRetargetDeviceInterrupt     = 0x007E,
    // 0x007F is reserved
    HvCallMapDevicePages               = 0x0080,
    HvCallUnmapDevicePages             = 0x0081,
    HvCallAttachDevice                 = 0x0082,
    HvCallDetachDevice                 = 0x0083,
    HvCallNotifyStandbyTransition      = 0x0084,
    HvCallPrepareForSleep              = 0x0085,
    HvCallPrepareForHibernate          = 0x0086,
    HvCallNotifyPartitionEvent         = 0x0087,
    HvCallGetLogicalProcessorRegisters = 0x0088,
    HvCallSetLogicalProcessorRegisters = 0x0089,
    HvCallQueryAssotiatedLpsforMca     = 0x008A,
    HvCallNotifyRingEmpty              = 0x008B,
    HvCallInjectSyntheticMachineCheck  = 0x008C,
    HvCallScrubPartition               = 0x008D,
    HvCallCollectLivedump              = 0x008E,
    HvCallDisableHypervisor            = 0x008F,
    HvCallModifySparseGpaPages         = 0x0090,
    HvCallRegisterInterceptResult      = 0x0091,
    HvCallUnregisterInterceptResult    = 0x0092,
    HvCallAssertVirtualInterrupt       = 0x0094,
    HvCallCreatePort                   = 0x0095,
    HvCallConnectPort                  = 0x0096,
    HvCallGetSpaPageList               = 0x0097,
    // 0x0098 is reserved
    HvCallStartVirtualProcessor = 0x009A,
    HvCallGetVpIndexFromApicId  = 0x009A,
    // 0x009A..0x00AE are reserved
    HvCallFlushGuestPhysicalAddressSpace = 0x00AF,
    HvCallFlushGuestPhysicalAddressList  = 0x00B0
};

Function Documentation

VmxCheckIsOnVmxRoot()

BOOLEAN VmxCheckIsOnVmxRoot

(

)

It can deterministically check whether the caller is on vmx-root mode or not.

Returns

BOOLEAN Returns true if current operation mode is vmx-root and false if current operation mode is vmx non-root

{
    UINT64 VmcsLink = 0;
 
    __try
    {
        if (!VmxVmread64P(VMCS_GUEST_VMCS_LINK_POINTER, &VmcsLink))
        {
            if (VmcsLink != 0)
            {
                return TRUE;
            }
        }
    }
    __except (1)
    {
    }
 
    return FALSE;
}

VmxCheckVmxSupport()

BOOLEAN VmxCheckVmxSupport

(

)

Check whether VMX Feature is supported or not.

Returns

BOOLEAN Returns true if vmx is supported or false if it's not supported

{
    CPUID                         Data              = {0};
    IA32_FEATURE_CONTROL_REGISTER FeatureControlMsr = {0};
 
    //
    // Gets Processor Info and Feature Bits
    //
    CpuCpuId((INT *)&Data, 1);
 
    //
    // Check For VMX Bit CPUID.ECX[5]
    //
    if (!_bittest((const LONG *)&Data.ecx, 5))
    {
        //
        // returns FALSE if vmx is not supported
        //
        return FALSE;
    }
 
    FeatureControlMsr.AsUInt = CpuReadMsr(IA32_FEATURE_CONTROL);
 
    //
    // Commented because of https://stackoverflow.com/questions/34900224/
    // and https://github.com/HyperDbg/HyperDbg/issues/24
    // the problem is when writing to IA32_FEATURE_CONTROL MSR, the lock bit
    // of this MSR Is not set to 0 on most computers, if the user enabled VT-X
    // from the BIOS the VMXON will be already set so checking lock bit and
    // then writing to EnableVmxon again is not meaningful since its already
    // there
    //
 
    //
    // if (FeatureControlMsr.Fields.Lock == 0)
    // {
    //     FeatureControlMsr.Fields.Lock        = TRUE;
    //     FeatureControlMsr.Fields.EnableVmxon = TRUE;
    //     CpuWriteMsr(IA32_FEATURE_CONTROL, FeatureControlMsr.Flags);
    // }
 
    if (FeatureControlMsr.EnableVmxOutsideSmx == FALSE)
    {
        LogError("Err, you should enable vt-x from BIOS");
        return FALSE;
    }
 
    return TRUE;
}

VmxClearVmcsState()

BOOLEAN VmxClearVmcsState

(

_In_ VIRTUAL_MACHINE_STATE *

VCpu

)

VmxCompatibleMemcmp()

INT32 VmxCompatibleMemcmp	(	const CHAR *	Address1,
		const CHAR *	Address2,
		SIZE_T	Count )

implementation of vmx-root mode compatible memcmp

Parameters

Address1
Address2
Count

Returns

INT32 0x2 indicates error, otherwise the same result as memcmp in string.h

{
    CHAR     C1 = NULL_ZERO, C2 = NULL_ZERO;
    INT32    Result = 0;
    UINT64   AlignedAddress1, AlignedAddress2;
    CR3_TYPE GuestCr3;
    CR3_TYPE OriginalCr3;
 
    AlignedAddress1 = (UINT64)PAGE_ALIGN((UINT64)Address1);
    AlignedAddress2 = (UINT64)PAGE_ALIGN((UINT64)Address2);
 
    //
    // Find the current process cr3
    //
    GuestCr3.Flags = LayoutGetCurrentProcessCr3().Flags;
 
    //
    // Move to new cr3
    //
    OriginalCr3.Flags = CpuReadCr3();
    CpuWriteCr3(GuestCr3.Flags);
 
    //
    // First check
    //
    if (!CheckAccessValidityAndSafety(AlignedAddress1, sizeof(WCHAR)) || !CheckAccessValidityAndSafety(AlignedAddress2, sizeof(WCHAR)))
    {
        //
        // Error
        //
 
        //
        // Move back to original cr3
        //
        CpuWriteCr3(OriginalCr3.Flags);
        return 0x2;
    }
 
    while (Count-- > 0 && !Result)
    {
        /*
        C1 = *Address1;
        */
        MemoryMapperReadMemorySafe((UINT64)Address1, &C1, sizeof(CHAR));
 
        /*
        C2 = *Address2;
        */
        MemoryMapperReadMemorySafe((UINT64)Address2, &C2, sizeof(CHAR));
 
        Address1++;
        Address2++;
 
        if (!((UINT64)AlignedAddress1 & (PAGE_SIZE - 1)))
        {
            if (!CheckAccessValidityAndSafety((UINT64)AlignedAddress1, sizeof(WCHAR)))
            {
                //
                // Error
                //
 
                //
                // Move back to original cr3
                //
                CpuWriteCr3(OriginalCr3.Flags);
                return 0x2;
            }
        }
 
        if (!((UINT64)AlignedAddress2 & (PAGE_SIZE - 1)))
        {
            if (!CheckAccessValidityAndSafety((UINT64)AlignedAddress2, sizeof(WCHAR)))
            {
                //
                // Error
                //
 
                //
                // Move back to original cr3
                //
                CpuWriteCr3(OriginalCr3.Flags);
                return 0x2;
            }
        }
 
        Result = C1 - C2;
    }
 
    if (Result < 0)
    {
        Result = -1;
    }
    else if (Result > 0)
    {
        Result = 1;
    }
 
    //
    // Move back to original cr3
    //
    CpuWriteCr3(OriginalCr3.Flags);
    return Result;
}

VmxCompatibleMicroSleep()

VOID VmxCompatibleMicroSleep

(

UINT64

Us

)

VMX-root compatible micro sleep.

Parameters

Us	Delay in micro seconds

Returns

VOID

{
    LARGE_INTEGER Start, End, Frequency;
    KeQueryPerformanceCounter(&Frequency);
 
    LONGLONG Ticks = (Frequency.QuadPart / 1000000) * Us;
 
    Start = KeQueryPerformanceCounter(NULL);
 
    while (TRUE)
    {
        End = KeQueryPerformanceCounter(NULL);
        if (End.QuadPart - Start.QuadPart > Ticks)
            break;
    }
}

VmxCompatibleStrcmp()

INT32 VmxCompatibleStrcmp	(	const CHAR *	Address1,
		const CHAR *	Address2,
		SIZE_T	Num,
		BOOLEAN	IsStrncmp )

implementation of vmx-root mode compatible strcmp and strncmp

Parameters

Address1
Address2
Num	param IsStrncmp

Returns

INT32 0x2 indicates error, otherwise the same result as strcmp in string.h

{
    CHAR     C1 = NULL_ZERO, C2 = NULL_ZERO;
    INT32    Result = 0;
    UINT32   Count  = 0;
    UINT64   AlignedAddress1, AlignedAddress2;
    CR3_TYPE GuestCr3;
    CR3_TYPE OriginalCr3;
 
    AlignedAddress1 = (UINT64)PAGE_ALIGN((UINT64)Address1);
    AlignedAddress2 = (UINT64)PAGE_ALIGN((UINT64)Address2);
 
    //
    // Find the current process cr3
    //
    GuestCr3.Flags = LayoutGetCurrentProcessCr3().Flags;
 
    //
    // Move to new cr3
    //
    OriginalCr3.Flags = CpuReadCr3();
    CpuWriteCr3(GuestCr3.Flags);
 
    //
    // First check
    //
    if (!CheckAccessValidityAndSafety(AlignedAddress1, sizeof(CHAR)) || !CheckAccessValidityAndSafety(AlignedAddress2, sizeof(CHAR)))
    {
        //
        // Error
        //
 
        //
        // Move back to original cr3
        //
        CpuWriteCr3(OriginalCr3.Flags);
        return 0x2;
    }
 
    do
    {
        //
        // Check to see if we have byte number constraints
        //
        if (IsStrncmp)
        {
            if (Count == Num)
            {
                //
                // Maximum number of bytes reached
                //
                break;
            }
            else
            {
                //
                // Maximum number of bytes not reached
                //
                Count++;
            }
        }
 
        /*
        C1 = *Address1;
        */
        MemoryMapperReadMemorySafe((UINT64)Address1, &C1, sizeof(CHAR));
 
        /*
        C2 = *Address2;
        */
        MemoryMapperReadMemorySafe((UINT64)Address2, &C2, sizeof(CHAR));
 
        Address1++;
        Address2++;
 
        if (!((UINT64)AlignedAddress1 & (PAGE_SIZE - 1)))
        {
            if (!CheckAccessValidityAndSafety((UINT64)AlignedAddress1, sizeof(CHAR)))
            {
                //
                // Error
                //
 
                //
                // Move back to original cr3
                //
                CpuWriteCr3(OriginalCr3.Flags);
                return 0x2;
            }
        }
 
        if (!((UINT64)AlignedAddress2 & (PAGE_SIZE - 1)))
        {
            if (!CheckAccessValidityAndSafety((UINT64)AlignedAddress2, sizeof(CHAR)))
            {
                //
                // Error
                //
 
                //
                // Move back to original cr3
                //
                CpuWriteCr3(OriginalCr3.Flags);
                return 0x2;
            }
        }
        Result = C1 - C2;
    } while (!Result && C2);
 
    if (Result < 0)
    {
        Result = -1;
    }
    else if (Result > 0)
    {
        Result = 1;
    }
 
    //
    // Move back to original cr3
    //
    CpuWriteCr3(OriginalCr3.Flags);
    return Result;
}

VmxCompatibleStrlen()

UINT32 VmxCompatibleStrlen

(

const CHAR *

S

)

implementation of vmx-root mode compatible strlen

Parameters

S

Returns

UINT32 If 0x0 indicates an error, otherwise length of the string

{
    CHAR     Temp  = NULL_ZERO;
    UINT32   Count = 0;
    UINT64   AlignedAddress;
    CR3_TYPE GuestCr3;
    CR3_TYPE OriginalCr3;
 
    AlignedAddress = (UINT64)PAGE_ALIGN((UINT64)S);
 
    //
    // Find the current process cr3
    //
    GuestCr3.Flags = LayoutGetCurrentProcessCr3().Flags;
 
    //
    // Move to new cr3
    //
    OriginalCr3.Flags = CpuReadCr3();
    CpuWriteCr3(GuestCr3.Flags);
 
    //
    // First check
    //
    if (!CheckAccessValidityAndSafety(AlignedAddress, sizeof(CHAR)))
    {
        //
        // Error
        //
 
        //
        // Move back to original cr3
        //
        CpuWriteCr3(OriginalCr3.Flags);
        return 0;
    }
 
    while (TRUE)
    {
        /*
        Temp = *S;
        */
        MemoryMapperReadMemorySafe((UINT64)S, &Temp, sizeof(CHAR));
 
        if (Temp != '\0')
        {
            Count++;
            S++;
        }
        else
        {
            //
            // Move back to original cr3
            //
            CpuWriteCr3(OriginalCr3.Flags);
            return Count;
        }
 
        if (!((UINT64)S & (PAGE_SIZE - 1)))
        {
            if (!CheckAccessValidityAndSafety((UINT64)S, sizeof(CHAR)))
            {
                //
                // Error
                //
 
                //
                // Move back to original cr3
                //
                CpuWriteCr3(OriginalCr3.Flags);
                return 0;
            }
        }
    }
 
    //
    // Move back to original cr3
    //
    CpuWriteCr3(OriginalCr3.Flags);
}

VmxCompatibleWcscmp()

INT32 VmxCompatibleWcscmp	(	const WCHAR *	Address1,
		const WCHAR *	Address2,
		SIZE_T	Num,
		BOOLEAN	IsWcsncmp )

implementation of vmx-root mode compatible wcscmp and wcsncmp

Parameters

Address1
Address2
Num
IsWcsncmp

Returns

INT32 0x2 indicates error, otherwise the same result as wcscmp in string.h

{
    WCHAR    C1 = NULL_ZERO, C2 = NULL_ZERO;
    INT32    Result = 0;
    UINT32   Count  = 0;
    UINT64   AlignedAddress1, AlignedAddress2;
    CR3_TYPE GuestCr3;
    CR3_TYPE OriginalCr3;
 
    AlignedAddress1 = (UINT64)PAGE_ALIGN((UINT64)Address1);
    AlignedAddress2 = (UINT64)PAGE_ALIGN((UINT64)Address2);
 
    //
    // Find the current process cr3
    //
    GuestCr3.Flags = LayoutGetCurrentProcessCr3().Flags;
 
    //
    // Move to new cr3
    //
    OriginalCr3.Flags = CpuReadCr3();
    CpuWriteCr3(GuestCr3.Flags);
 
    //
    // First check
    //
    if (!CheckAccessValidityAndSafety(AlignedAddress1, sizeof(WCHAR)) || !CheckAccessValidityAndSafety(AlignedAddress2, sizeof(WCHAR)))
    {
        //
        // Error
        //
 
        //
        // Move back to original cr3
        //
        CpuWriteCr3(OriginalCr3.Flags);
        return 0x2;
    }
 
    do
    {
        //
        // Check to see if we have byte number constraints
        //
        if (IsWcsncmp)
        {
            if (Count == Num)
            {
                //
                // Maximum number of bytes reached
                //
                break;
            }
            else
            {
                //
                // Maximum number of bytes not reached
                //
                Count++;
            }
        }
 
        /*
        C1 = *Address1;
        */
        MemoryMapperReadMemorySafe((UINT64)Address1, &C1, sizeof(WCHAR));
 
        /*
        C2 = *Address2;
        */
        MemoryMapperReadMemorySafe((UINT64)Address2, &C2, sizeof(WCHAR));
 
        Address1++;
        Address2++;
 
        if (!((UINT64)AlignedAddress1 & (PAGE_SIZE - 1)))
        {
            if (!CheckAccessValidityAndSafety((UINT64)AlignedAddress1, sizeof(WCHAR)))
            {
                //
                // Error
                //
 
                //
                // Move back to original cr3
                //
                CpuWriteCr3(OriginalCr3.Flags);
                return 0x2;
            }
        }
 
        if (!((UINT64)AlignedAddress2 & (PAGE_SIZE - 1)))
        {
            if (!CheckAccessValidityAndSafety((UINT64)AlignedAddress2, sizeof(WCHAR)))
            {
                //
                // Error
                //
 
                //
                // Move back to original cr3
                //
                CpuWriteCr3(OriginalCr3.Flags);
                return 0x2;
            }
        }
 
        Result = C1 - C2;
    } while (!Result && C2);
 
    if (Result < 0)
    {
        Result = -1;
    }
    else if (Result > 0)
    {
        Result = 1;
    }
 
    //
    // Move back to original cr3
    //
    CpuWriteCr3(OriginalCr3.Flags);
    return Result;
}

VmxCompatibleWcslen()

UINT32 VmxCompatibleWcslen

(

const WCHAR *

S

)

implementation of vmx-root mode compatible wcslen

Parameters

S

Returns

UINT32 If 0x0 indicates an error, otherwise length of the string

{
    WCHAR    Temp  = NULL_ZERO;
    UINT32   Count = 0;
    UINT64   AlignedAddress;
    CR3_TYPE GuestCr3;
    CR3_TYPE OriginalCr3;
 
    AlignedAddress = (UINT64)PAGE_ALIGN((UINT64)S);
 
    //
    // Find the current process cr3
    //
    GuestCr3.Flags = LayoutGetCurrentProcessCr3().Flags;
 
    //
    // Move to new cr3
    //
    OriginalCr3.Flags = CpuReadCr3();
    CpuWriteCr3(GuestCr3.Flags);
 
    AlignedAddress = (UINT64)PAGE_ALIGN((UINT64)S);
 
    //
    // First check
    //
    if (!CheckAccessValidityAndSafety(AlignedAddress, sizeof(WCHAR)))
    {
        //
        // Error
        //
 
        //
        // Move back to original cr3
        //
        CpuWriteCr3(OriginalCr3.Flags);
        return 0;
    }
 
    while (TRUE)
    {
        /*
        Temp = *S;
        */
        MemoryMapperReadMemorySafe((UINT64)S, &Temp, sizeof(WCHAR));
 
        if (Temp != '\0\0')
        {
            Count++;
            S++;
        }
        else
        {
            //
            // Move back to original cr3
            //
            CpuWriteCr3(OriginalCr3.Flags);
            return Count;
        }
 
        if (!((UINT64)S & (PAGE_SIZE - 1)))
        {
            if (!CheckAccessValidityAndSafety((UINT64)S, sizeof(WCHAR)))
            {
                //
                // Error
                //
 
                //
                // Move back to original cr3
                //
                CpuWriteCr3(OriginalCr3.Flags);
                return 0;
            }
        }
    }
 
    //
    // Move back to original cr3
    //
    CpuWriteCr3(OriginalCr3.Flags);
}

VmxFixCr4AndCr0Bits()

VOID VmxFixCr4AndCr0Bits

(

)

Fix values for cr0 and cr4 bits.

The Cr4 And Cr0 Bits During VMX Operation Preventing Them From Any Change (https://revers.engineering/day-2-entering-vmx-operation/)

Returns

VOID

{
    CR_FIXED CrFixed = {0};
    CR4      Cr4     = {0};
    CR0      Cr0     = {0};
 
    //
    // Fix Cr0
    //
    CrFixed.Flags = CpuReadMsr(IA32_VMX_CR0_FIXED0);
    Cr0.AsUInt    = CpuReadCr0();
    Cr0.AsUInt |= CrFixed.Fields.Low;
    CrFixed.Flags = CpuReadMsr(IA32_VMX_CR0_FIXED1);
    Cr0.AsUInt &= CrFixed.Fields.Low;
    CpuWriteCr0(Cr0.AsUInt);
 
    //
    // Fix Cr4
    //
    CrFixed.Flags = CpuReadMsr(IA32_VMX_CR4_FIXED0);
    Cr4.AsUInt    = CpuReadCr4();
    Cr4.AsUInt |= CrFixed.Fields.Low;
    CrFixed.Flags = CpuReadMsr(IA32_VMX_CR4_FIXED1);
    Cr4.AsUInt &= CrFixed.Fields.Low;
    CpuWriteCr4(Cr4.AsUInt);
}

VmxGetCurrentExecutionMode()

BOOLEAN VmxGetCurrentExecutionMode

(

)

Check current execution mode (vmx-root and non-root).

Returns

BOOLEAN Returns true if the execution is on vmx-root, otherwise false

{
    if (g_GuestState)
    {
        ULONG                   CurrentCore    = KeGetCurrentProcessorNumberEx(NULL);
        VIRTUAL_MACHINE_STATE * CurrentVmState = &g_GuestState[CurrentCore];
 
        return CurrentVmState->IsOnVmxRootMode ? VmxExecutionModeRoot : VmxExecutionModeNonRoot;
    }
    else
    {
        //
        // The structure for guest state is not initialized, thus, we're in VMX non-root
        //
        return VmxExecutionModeNonRoot;
    }
}

VmxGetCurrentLaunchState()

BOOLEAN VmxGetCurrentLaunchState

(

)

Check if the VMX is launched or not.

Returns

BOOLEAN Returns true if it's launched, otherwise false

{
    ULONG                   CurrentCore    = KeGetCurrentProcessorNumberEx(NULL);
    VIRTUAL_MACHINE_STATE * CurrentVmState = &g_GuestState[CurrentCore];
 
    return CurrentVmState->HasLaunched;
}

VmxHandleTripleFaults()

VOID VmxHandleTripleFaults

(

VIRTUAL_MACHINE_STATE *

VCpu

)

Handling triple fault VM-exits.

Parameters

VCpu	The virtual processor's state

Returns

VOID

{
    LogError("Err, triple fault error occurred!");
 
    //
    // This error cannot be recovered, produce debug results
    //
    CommonWriteDebugInformation(VCpu);
 
    //
    // We won't further continue after this error
    //
    DbgBreakPoint();
}

VmxHandleVmxPreemptionTimerVmexit()

VOID VmxHandleVmxPreemptionTimerVmexit

(

VIRTUAL_MACHINE_STATE *

VCpu

)

Handling VMX Preemption Timer vm-exits.

Parameters

VCpu	The virtual processor's state

Returns

VOID

{
    LogError("Why vm-exit for VMX preemption timer happened?");
 
    //
    // Not increase the RIP by default
    //
    HvSuppressRipIncrement(VCpu);
}

VmxHandleXsetbv()

VOID VmxHandleXsetbv

(

VIRTUAL_MACHINE_STATE *

VCpu

)

Handling XSETBV Instruction vm-exits.

Parameters

VCpu

Returns

VOID

{
    CPUID_EAX_01         CpuidInfo;
    VMX_SEGMENT_SELECTOR GuestCs  = GetGuestCs();
    UINT32               XCrIndex = VCpu->Regs->rcx & 0xffffffff;
    XCR0                 XCr0     = {.AsUInt = VCpu->Regs->rdx << 32 | VCpu->Regs->rax};
    CR4                  GuestCr4 = {.AsUInt = GetGuestCr4()};
 
    if (XCrIndex != 0 || GuestCs.Attributes.DescriptorPrivilegeLevel != 0 || !CommonIsXCr0Valid(XCr0))
    {
        EventInjectGeneralProtection();
        return;
    }
 
    CommonCpuidInstruction(CPUID_VERSION_INFORMATION, 0, (INT32 *)&CpuidInfo);
 
    if (CpuidInfo.CpuidFeatureInformationEcx.XsaveXrstorInstruction == 0 || GuestCr4.OsXsave == 0)
    {
        EventInjectUndefinedOpcode(VCpu);
        return;
    }
 
    _xsetbv(XCrIndex, XCr0.AsUInt);
}

VmxInitialize()

BOOLEAN VmxInitialize

(

)

Initialize the VMX operation.

Returns

BOOLEAN Returns true if vmx initialized successfully

{
    ULONG ProcessorsCount;
 
    //
    // ****** Start Virtualizing Current System ******
    //
 
    //
    // Initiating EPTP and VMX
    //
    if (!VmxPerformVirtualizationOnAllCores())
    {
        //
        // there was error somewhere in initializing
        //
        return FALSE;
    }
 
    ProcessorsCount = KeQueryActiveProcessorCount(0);
 
    for (SIZE_T ProcessorID = 0; ProcessorID < ProcessorsCount; ProcessorID++)
    {
        //
        // *** Launching VM for Test (in the all logical processor) ***
        //
 
        VIRTUAL_MACHINE_STATE * GuestState = &g_GuestState[ProcessorID];
 
        //
        // Allocating VMM Stack
        //
        if (!VmxAllocateVmmStack(GuestState))
        {
            //
            // Some error in allocating Vmm Stack
            //
            return FALSE;
        }
 
        //
        // Allocating MSR Bit
        //
        if (!VmxAllocateMsrBitmap(GuestState))
        {
            //
            // Some error in allocating Msr Bitmaps
            //
            return FALSE;
        }
 
        //
        // Allocating I/O Bit
        //
        if (!VmxAllocateIoBitmaps(GuestState))
        {
            //
            // Some error in allocating I/O Bitmaps
            //
            return FALSE;
        }
 
#if USE_DEFAULT_OS_IDT_AS_HOST_IDT == FALSE
 
        //
        // Allocating Host IDT
        //
        if (!VmxAllocateHostIdt(GuestState))
        {
            //
            // Some error in allocating Host IDT
            //
            return FALSE;
        }
#endif // USE_DEFAULT_OS_IDT_AS_HOST_IDT == FALSE
 
#if USE_DEFAULT_OS_GDT_AS_HOST_GDT == FALSE
 
        //
        // Allocating Host GDT
        //
        if (!VmxAllocateHostGdt(GuestState))
        {
            //
            // Some error in allocating Host GDT
            //
            return FALSE;
        }
 
        //
        // Allocating Host TSS
        //
        if (!VmxAllocateHostTss(GuestState))
        {
            //
            // Some error in allocating Host TSS
            //
            return FALSE;
        }
 
#endif // USE_DEFAULT_OS_GDT_AS_HOST_GDT == FALSE
 
#if USE_INTERRUPT_STACK_TABLE == TRUE
 
        //
        // Allocating Host Interrupt Stack
        //
        if (!VmxAllocateHostInterruptStack(GuestState))
        {
            //
            // Some error in allocating Interrupt Stack
            //
            return FALSE;
        }
 
#endif // USE_INTERRUPT_STACK_TABLE == TRUE
    }
 
    //
    // Create a bitmap of the MSRs that cause #GP
    //
    g_MsrBitmapInvalidMsrs = VmxAllocateInvalidMsrBimap();
 
    if (g_MsrBitmapInvalidMsrs == NULL)
    {
        return FALSE;
    }
 
    //
    // As we want to support more than 32 processor (64 logical-core)
    // we let windows execute our routine for us
    //
    KeGenericCallDpc(DpcRoutineInitializeGuest, 0x0);
 
    //
    // Check if everything is ok then return true otherwise false
    //
    if (AsmVmxVmcall(VMCALL_TEST, 0x22, 0x333, 0x4444) == STATUS_SUCCESS)
    {
        return TRUE;
    }
    else
    {
        return FALSE;
    }
}

VmxIsTopLevelHypervisorHyperV()

BOOLEAN VmxIsTopLevelHypervisorHyperV

(

)

checks if the current top level hypervisor is Hyper-V

Returns

BOOLEAN TRUE indicates that the current top level hypervisor is Hyper-V, FALSE otherwise.

{
    INT32 ProcessorFeatures[4] = {0};
    CpuCpuIdEx(ProcessorFeatures, CPUID_PROCESSOR_AND_PROCESSOR_FEATURE_IDENTIFIERS, 0);
 
    if (!((ULONG)(ProcessorFeatures[2]) & HYPERV_HYPERVISOR_PRESENT_BIT))
    {
        return FALSE;
    }
 
    INT32 HypervisorVendor[4] = {0};
    CpuCpuIdEx(HypervisorVendor, HYPERV_CPUID_VENDOR_AND_MAX_FUNCTIONS, 0);
 
    return (ULONG)(HypervisorVendor[1]) == HYPERV_CPUID_VENDOR_MICROSOFT_EBX &&
           (ULONG)(HypervisorVendor[2]) == HYPERV_CPUID_VENDOR_MICROSOFT_ECX &&
           (ULONG)(HypervisorVendor[3]) == HYPERV_CPUID_VENDOR_MICROSOFT_EDX;
}

VmxLoadVmcs()

BOOLEAN VmxLoadVmcs

(

_In_ VIRTUAL_MACHINE_STATE *

VCpu

)

VmxPerformTermination()

VOID VmxPerformTermination

(

)

Terminate Vmx on all logical cores.

Returns

VOID

{
    ULONG ProcessorsCount;
 
    LogDebugInfo("Terminating VMX...\n");
 
    //
    // Get number of processors
    //
    ProcessorsCount = KeQueryActiveProcessorCount(0);
 
    //
    // ******* Terminating Vmx *******
    //
 
    //
    // Unhide (disable and de-allocate) transparent-mode
    //
    if (g_CheckForFootprints)
    {
        TransparentUnhideDebuggerWrapper(NULL);
    }
 
    //
    // Remove All the hooks if any
    //
    EptHookUnHookAll();
 
    //
    // Restore the state of execution trap hooks
    //
    ExecTrapUninitialize();
 
    //
    // Broadcast to terminate Vmx
    //
    KeGenericCallDpc(DpcRoutineTerminateGuest, 0x0);
 
    //
    // ****** De-allocatee global variables ******
    //
 
    //
    // Free the buffer related to MSRs that cause #GP
    //
    PlatformMemFreePool(g_MsrBitmapInvalidMsrs);
    g_MsrBitmapInvalidMsrs = NULL;
 
    //
    // Free Identity Page Table
    //
    for (SIZE_T i = 0; i < ProcessorsCount; i++)
    {
        if (g_GuestState[i].EptPageTable != NULL)
        {
            MmFreeContiguousMemory(g_GuestState[i].EptPageTable);
        }
 
        g_GuestState[i].EptPageTable = NULL;
    }
 
    //
    // Free EptState
    //
    PlatformMemFreePool(g_EptState);
    g_EptState = NULL;
 
    //
    // Uninitialize memory mapper
    //
    MemoryMapperUninitialize();
 
    //
    // Free g_GuestState
    //
    GlobalGuestStateFreeMemory();
 
    LogDebugInfo("VMX operation turned off successfully");
}

VmxPerformVirtualizationOnAllCores()

BOOLEAN VmxPerformVirtualizationOnAllCores

(

)

Initialize essential VMX Operation tasks.

Returns

BOOLEAN Returns true if vmx is successfully initialized

{
    PAGED_CODE();
 
    if (!VmxCheckVmxSupport())
    {
        LogError("Err, VMX is not supported in this machine");
        return FALSE;
    }
 
    //
    // Check if the top level hypervisor is Hyper-V or not
    //
    if (VmxIsTopLevelHypervisorHyperV())
    {
        //
        // The top-level hypervisor is hyper-v
        //
        g_IsTopLevelHypervisorHyperV = TRUE;
 
        LogDebugInfo(" Hyper-V is detected as the top-level hypervisor");
    }
    else
    {
        LogDebugInfo(" Hyper-V is not detected as the top-level hypervisor");
    }
 
    //
    // Allocate global variable to hold Ept State
    //
    g_EptState = PlatformMemAllocateZeroedNonPagedPool(sizeof(EPT_STATE));
 
    if (!g_EptState)
    {
        LogError("Err, insufficient memory");
        return FALSE;
    }
 
    //
    // Initialize the list of hooked pages detail
    //
    InitializeListHead(&g_EptState->HookedPagesList);
 
    //
    // Check whether EPT is supported or not
    //
    if (!EptCheckFeatures())
    {
        LogError("Err, your processor doesn't support all EPT features");
        return FALSE;
    }
    else
    {
        //
        // Our processor supports EPT, now let's build MTRR
        //
        LogDebugInfo("Your processor supports all EPT features");
 
        //
        // Build MTRR Map
        //
        if (!EptBuildMtrrMap())
        {
            LogError("Err, could not build MTRR memory map");
            return FALSE;
        }
 
        LogDebugInfo("MTRR memory map built successfully");
    }
 
    if (!EptLogicalProcessorInitialize())
    {
        //
        // There were some errors in EptLogicalProcessorInitialize
        //
        return FALSE;
    }
 
    //
    // Broadcast to run vmx-specific task to virtualize cores
    //
    BroadcastVmxVirtualizationAllCores();
 
    //
    // Everything is ok, let's return true
    //
    return TRUE;
}

VmxPerformVirtualizationOnSpecificCore()

BOOLEAN VmxPerformVirtualizationOnSpecificCore

(

)

Allocates Vmx regions for all logical cores (Vmxon region and Vmcs region).

Returns

BOOLEAN

{
    ULONG                   CurrentCore = KeGetCurrentProcessorNumberEx(NULL);
    VIRTUAL_MACHINE_STATE * VCpu        = &g_GuestState[CurrentCore];
 
    LogDebugInfo("Allocating vmx regions for logical core %d", CurrentCore);
 
    //
    // Enabling VMX Operation
    //
    AsmEnableVmxOperation();
 
    //
    // Fix Cr4 and Cr0 bits during VMX operation
    //
    VmxFixCr4AndCr0Bits();
 
    LogDebugInfo("VMX-Operation enabled successfully");
 
    if (!VmxAllocateVmxonRegion(VCpu))
    {
        LogError("Err, allocating memory for vmxon region was not successful");
        return FALSE;
    }
    if (!VmxAllocateVmcsRegion(VCpu))
    {
        LogError("Err, allocating memory for vmcs region was not successful");
        return FALSE;
    }
 
    return TRUE;
}

VmxPerformVmptrst()

VOID VmxPerformVmptrst

(

)

Implementation of VMPTRST instruction.

Returns

VOID

{
    PHYSICAL_ADDRESS VmcsPhysicalAddr;
    VmcsPhysicalAddr.QuadPart = 0;
    VmxVmptrst((UINT64 *)&VmcsPhysicalAddr);
 
    LogDebugInfo("VMPTRST result : %llx", VmcsPhysicalAddr);
}

VmxPerformVmresume()

VOID VmxPerformVmresume

(

)

Resume VM using the VMRESUME instruction.

Returns

VOID

{
    UINT32 ErrorCode = 0;
 
    VmxVmresume();
 
    //
    // if VMRESUME succeed will never be here !
    //
 
    VmxVmread32P(VMCS_VM_INSTRUCTION_ERROR, &ErrorCode);
 
    VmxVmxoff();
 
    //
    // It's such a bad error because we don't where to go !
    // prefer to break
    //
 
    LogError("Err, in executing VMRESUME, status : 0x%llx, last VM-exit reason: 0x%x",
             ErrorCode,
             g_GuestState[KeGetCurrentProcessorNumberEx(NULL)].ExitReason);
}

VmxPerformVmxoff()

VOID VmxPerformVmxoff

(

VIRTUAL_MACHINE_STATE *

VCpu

)

Prepare and execute Vmxoff instruction.

Parameters

VCpu	The virtual processor's state

Returns

VOID

{
    UINT64 GuestRSP              = 0; // Save a pointer to guest rsp for times that we want to return to previous guest stateS
    UINT64 GuestRIP              = 0; // Save a pointer to guest rip for times that we want to return to previous guest state
    UINT64 GuestCr3              = 0;
    UINT64 ExitInstructionLength = 0;
 
    //
    // According to SimpleVisor :
    //      Our callback routine may have interrupted an arbitrary user process,
    //      and therefore not a thread running with a system-wide page directory.
    //      Therefore if we return back to the original caller after turning off
    //      VMX, it will keep our current "host" CR3 value which we set on entry
    //      to the PML4 of the SYSTEM process. We want to return back with the
    //      correct value of the "guest" CR3, so that the currently executing
    //      process continues to run with its expected address space mappings.
    //
 
    VmxVmread64P(VMCS_GUEST_CR3, &GuestCr3);
    CpuWriteCr3(GuestCr3);
 
    //
    // Read guest rsp and rip
    //
    VmxVmread64P(VMCS_GUEST_RIP, &GuestRIP);
    VmxVmread64P(VMCS_GUEST_RSP, &GuestRSP);
 
    //
    // Read instruction length
    //
    VmxVmread64P(VMCS_VMEXIT_INSTRUCTION_LENGTH, &ExitInstructionLength);
    GuestRIP += ExitInstructionLength;
 
    //
    // Set the previous register states
    //
    VCpu->VmxoffState.GuestRip = GuestRIP;
    VCpu->VmxoffState.GuestRsp = GuestRSP;
 
    //
    // Notify the Vmexit handler that VMX already turned off
    //
    VCpu->VmxoffState.IsVmxoffExecuted = TRUE;
 
    //
    // Restore the previous FS, GS , GDTR and IDTR register as patchguard might find the modified
    //
    HvRestoreRegisters();
 
    //
    // Restore XMM registers
    // We restore XMM registers here because we are going to execute vmxoff instruction
    // which enables interrupts and we don't want to lose the XMM registers
    // since immediately after vmxoff, an interrupt might occur and context switch
    // might change the XMM registers
    //
    AsmVmxoffRestoreXmmRegs((UINT64)VCpu->XmmRegs);
 
    //
    // Before using vmxoff, you first need to use vmclear on any VMCSes that you want to be able to use again.
    // See sections 24.1 and 24.11 of the SDM.
    //
    VmxClearVmcsState(VCpu);
 
    //
    // Execute Vmxoff
    //
    VmxVmxoff();
 
    //
    // *** Note: After executing VMXOFF, XMM registers should not be used anymore
    // Since we already restored them ***
    //
 
    //
    // Indicate the current core is not currently virtualized
    //
    VCpu->HasLaunched = FALSE;
 
    //
    // Now that VMX is OFF, we have to unset vmx-enable bit on cr4
    //
    CpuWriteCr4(CpuReadCr4() & (~REG_CR4_VMXE));
}

VmxReturnInstructionPointerForVmxoff()

UINT64 VmxReturnInstructionPointerForVmxoff

(

)

Get the RIP of guest (VMCS_GUEST_RIP) in the case of return from VMXOFF.

Returns

UINT64 Returns the instruction pointer, to change in the case of Vmxoff

{
    return g_GuestState[KeGetCurrentProcessorNumberEx(NULL)].VmxoffState.GuestRip;
}

VmxReturnStackPointerForVmxoff()

UINT64 VmxReturnStackPointerForVmxoff

(

)

Get the RIP of guest (VMCS_GUEST_RIP) in the case of return from VMXOFF.

Returns

UINT64 Returns the stack pointer, to change in the case of Vmxoff

{
    return g_GuestState[KeGetCurrentProcessorNumberEx(NULL)].VmxoffState.GuestRsp;
}

VmxSetupVmcs()

BOOLEAN VmxSetupVmcs	(	_In_ VIRTUAL_MACHINE_STATE *	VCpu,
		_In_ PVOID	GuestStack )

VmxTerminate()

BOOLEAN VmxTerminate

(

)

Broadcast to terminate VMX on all logical cores.

Returns

BOOLEAN Returns true if vmxoff successfully executed in vmcall or otherwise returns false

{
    NTSTATUS                Status      = STATUS_SUCCESS;
    ULONG                   CurrentCore = KeGetCurrentProcessorNumberEx(NULL);
    VIRTUAL_MACHINE_STATE * VCpu        = &g_GuestState[CurrentCore];
 
    //
    // Execute Vmcall to to turn off vmx from Vmx root mode
    //
    Status = AsmVmxVmcall(VMCALL_VMXOFF, NULL64_ZERO, NULL64_ZERO, NULL64_ZERO);
 
    if (Status == STATUS_SUCCESS)
    {
        LogDebugInfo("VMX terminated on logical core %d\n", CurrentCore);
 
        //
        // Free the destination memory
        //
        MmFreeContiguousMemory((PVOID)VCpu->VmxonRegionVirtualAddress);
        MmFreeContiguousMemory((PVOID)VCpu->VmcsRegionVirtualAddress);
        PlatformMemFreePool((PVOID)VCpu->VmmStack);
        PlatformMemFreePool((PVOID)VCpu->MsrBitmapVirtualAddress);
        PlatformMemFreePool((PVOID)VCpu->IoBitmapVirtualAddressA);
        PlatformMemFreePool((PVOID)VCpu->IoBitmapVirtualAddressB);
#if USE_DEFAULT_OS_IDT_AS_HOST_IDT == FALSE
        PlatformMemFreePool((PVOID)VCpu->HostIdt);
#endif // USE_DEFAULT_OS_IDT_AS_HOST_IDT == FALSE
 
#if USE_DEFAULT_OS_GDT_AS_HOST_GDT == FALSE
        PlatformMemFreePool((PVOID)VCpu->HostGdt);
        PlatformMemFreePool((PVOID)VCpu->HostTss);
#endif // USE_DEFAULT_OS_GDT_AS_HOST_GDT == FALSE
 
#if USE_INTERRUPT_STACK_TABLE == TRUE
        PlatformMemFreePool((PVOID)VCpu->HostInterruptStack);
#endif // USE_INTERRUPT_STACK_TABLE == FALSE
 
        return TRUE;
    }
 
    return FALSE;
}

VmxVirtualizeCurrentSystem()

BOOLEAN VmxVirtualizeCurrentSystem

(

PVOID

GuestStack

)

Initialize VMX Operation.

Parameters

GuestStack

Guest stack for the this core (VMCS_GUEST_RSP)

Returns

BOOLEAN This function won't return true as when Vmlaunch is executed the rest of the function never executes but returning FALSE is an indication of error

{
    UINT64                  ErrorCode   = 0;
    ULONG                   CurrentCore = KeGetCurrentProcessorNumberEx(NULL);
    VIRTUAL_MACHINE_STATE * VCpu        = &g_GuestState[CurrentCore];
 
    LogDebugInfo("Virtualizing current system (logical core : 0x%x)", CurrentCore);
 
#if USE_DEFAULT_OS_IDT_AS_HOST_IDT == FALSE
 
    //
    // Prepare Host IDT
    //
    IdtEmulationPrepareHostIdt(VCpu);
#endif // USE_DEFAULT_OS_IDT_AS_HOST_IDT == FALSE
 
#if USE_DEFAULT_OS_GDT_AS_HOST_GDT == FALSE
 
    //
    // Prepare Host GDT and TSS
    //
    SegmentPrepareHostGdt((SEGMENT_DESCRIPTOR_32 *)AsmGetGdtBase(),
                          AsmGetGdtLimit(),
                          AsmGetTr(),
                          VCpu->HostInterruptStack,
                          (SEGMENT_DESCRIPTOR_32 *)VCpu->HostGdt,
                          (TASK_STATE_SEGMENT_64 *)VCpu->HostTss);
 
#endif // USE_DEFAULT_OS_GDT_AS_HOST_GDT == FALSE
 
    //
    // Clear the VMCS State
    //
    if (!VmxClearVmcsState(VCpu))
    {
        LogError("Err, failed to clear vmcs");
        return FALSE;
    }
 
    //
    // Load VMCS (Set the Current VMCS)
    //
    if (!VmxLoadVmcs(VCpu))
    {
        LogError("Err, failed to load vmcs");
        return FALSE;
    }
 
    LogDebugInfo("Setting up VMCS for current logical core");
 
    VmxSetupVmcs(VCpu, GuestStack);
 
    LogDebugInfo("Executing VMLAUNCH on logical core %d", CurrentCore);
 
    //
    // Setting the state to indicate current core is currently virtualized
    //
 
    VCpu->HasLaunched = TRUE;
 
    VmxVmlaunch();
 
    //
    // ******** if Vmlaunch succeed will never be here ! ********
    //
 
    //
    // If failed, then indicate that current core is not currently virtualized
    //
    VCpu->HasLaunched = FALSE;
 
    //
    // Read error code firstly
    //
    VmxVmread64P(VMCS_VM_INSTRUCTION_ERROR, &ErrorCode);
 
    LogError("Err, unable to execute VMLAUNCH, status : 0x%llx", ErrorCode);
 
    //
    // Then Execute Vmxoff
    //
    VmxVmxoff();
    LogError("Err, VMXOFF Executed Successfully but it was because of an error");
 
    return FALSE;
}