Vmx.h File Reference

VMX Instruction and operation headers. More...

Go to the source code of this file.

Classes
union	_HYPERCALL_INPUT_VALUE
	Hypercalls for Hyper-V. More...

Macros
#define	VMCS_SIZE   4096
	VMCS Region Size.
#define	VMXON_SIZE   4096
	VMXON Region Size.
#define	PIN_BASED_VM_EXECUTION_CONTROLS_EXTERNAL_INTERRUPT   0x00000001
	PIN-Based Execution.
#define	PIN_BASED_VM_EXECUTION_CONTROLS_NMI_EXITING   0x00000008
#define	PIN_BASED_VM_EXECUTION_CONTROLS_VIRTUAL_NMI   0x00000020
#define	PIN_BASED_VM_EXECUTION_CONTROLS_ACTIVE_VMX_TIMER   0x00000040
#define	PIN_BASED_VM_EXECUTION_CONTROLS_PROCESS_POSTED_INTERRUPTS   0x00000080
#define	CPU_BASED_VIRTUAL_INTR_PENDING   0x00000004
	CPU-Based Controls.
#define	CPU_BASED_USE_TSC_OFFSETTING   0x00000008
#define	CPU_BASED_HLT_EXITING   0x00000080
#define	CPU_BASED_INVLPG_EXITING   0x00000200
#define	CPU_BASED_MWAIT_EXITING   0x00000400
#define	CPU_BASED_RDPMC_EXITING   0x00000800
#define	CPU_BASED_RDTSC_EXITING   0x00001000
#define	CPU_BASED_CR3_LOAD_EXITING   0x00008000
#define	CPU_BASED_CR3_STORE_EXITING   0x00010000
#define	CPU_BASED_CR8_LOAD_EXITING   0x00080000
#define	CPU_BASED_CR8_STORE_EXITING   0x00100000
#define	CPU_BASED_TPR_SHADOW   0x00200000
#define	CPU_BASED_VIRTUAL_NMI_PENDING   0x00400000
#define	CPU_BASED_MOV_DR_EXITING   0x00800000
#define	CPU_BASED_UNCOND_IO_EXITING   0x01000000
#define	CPU_BASED_ACTIVATE_IO_BITMAP   0x02000000
#define	CPU_BASED_MONITOR_TRAP_FLAG   0x08000000
#define	CPU_BASED_ACTIVATE_MSR_BITMAP   0x10000000
#define	CPU_BASED_MONITOR_EXITING   0x20000000
#define	CPU_BASED_PAUSE_EXITING   0x40000000
#define	CPU_BASED_ACTIVATE_SECONDARY_CONTROLS   0x80000000
#define	CPU_BASED_CTL2_ENABLE_EPT   0x2
	Secondary CPU-Based Controls.
#define	CPU_BASED_CTL2_RDTSCP   0x8
#define	CPU_BASED_CTL2_ENABLE_VPID   0x20
#define	CPU_BASED_CTL2_UNRESTRICTED_GUEST   0x80
#define	CPU_BASED_CTL2_VIRTUAL_INTERRUPT_DELIVERY   0x200
#define	CPU_BASED_CTL2_ENABLE_INVPCID   0x1000
#define	CPU_BASED_CTL2_ENABLE_VMFUNC   0x2000
#define	CPU_BASED_CTL2_ENABLE_XSAVE_XRSTORS   0x100000
#define	VM_EXIT_SAVE_DEBUG_CONTROLS   0x00000004
	VM-exit Control Bits.
#define	VM_EXIT_HOST_ADDR_SPACE_SIZE   0x00000200
#define	VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL   0x00001000
#define	VM_EXIT_ACK_INTR_ON_EXIT   0x00008000
#define	VM_EXIT_SAVE_IA32_PAT   0x00040000
#define	VM_EXIT_LOAD_IA32_PAT   0x00080000
#define	VM_EXIT_SAVE_IA32_EFER   0x00100000
#define	VM_EXIT_LOAD_IA32_EFER   0x00200000
#define	VM_EXIT_SAVE_VMX_PREEMPTION_TIMER   0x00400000
#define	VM_ENTRY_LOAD_DEBUG_CONTROLS   0x00000004
	VM-entry Control Bits.
#define	VM_ENTRY_IA32E_MODE   0x00000200
#define	VM_ENTRY_SMM   0x00000400
#define	VM_ENTRY_DEACT_DUAL_MONITOR   0x00000800
#define	VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL   0x00002000
#define	VM_ENTRY_LOAD_IA32_PAT   0x00004000
#define	VM_ENTRY_LOAD_IA32_EFER   0x00008000
#define	HYPERV_CPUID_VENDOR_AND_MAX_FUNCTIONS   0x40000000
	CPUID RCX(s) - Based on Hyper-V.
#define	HYPERV_CPUID_INTERFACE   0x40000001
#define	HYPERV_CPUID_VERSION   0x40000002
#define	HYPERV_CPUID_FEATURES   0x40000003
#define	HYPERV_CPUID_ENLIGHTMENT_INFO   0x40000004
#define	HYPERV_CPUID_IMPLEMENT_LIMITS   0x40000005
#define	HYPERV_HYPERVISOR_PRESENT_BIT   0x80000000
#define	HYPERV_CPUID_MIN   0x40000005
#define	HYPERV_CPUID_MAX   0x4000ffff
#define	GUEST_INTR_STATE_STI   0x00000001
	GUEST_INTERRUPTIBILITY_INFO flags.
#define	GUEST_INTR_STATE_MOV_SS   0x00000002
#define	GUEST_INTR_STATE_SMI   0x00000004
#define	GUEST_INTR_STATE_NMI   0x00000008
#define	GUEST_INTR_STATE_ENCLAVE_INTR   0x00000010
#define	SHADOW_INT_MOV_SS   0x01
	Interrupt shadow states.
#define	SHADOW_INT_STI   0x02
#define	VMM_STACK_SIZE   0x8000
	Stack Size.
#define	IS_VALID_DEBUG_REGISTER(DebugRegister)    (((DebugRegister <= VMX_EXIT_QUALIFICATION_REGISTER_DR0) && (DebugRegister <= VMX_EXIT_QUALIFICATION_REGISTER_DR7)) && (DebugRegister != 0x00000004 && DebugRegister != 0x00000005))
#define	VMCS_GUEST_DEBUGCTL_HIGH   0x00002803
#define	VIRTUAL_PROCESSOR_ID   0x00000000

Typedefs
typedef union _HYPERCALL_INPUT_VALUE	HYPERCALL_INPUT_VALUE
	Hypercalls for Hyper-V.
typedef union _HYPERCALL_INPUT_VALUE *	PHYPERCALL_INPUT_VALUE
typedef enum _MOV_TO_DEBUG_REG	MOV_TO_DEBUG_REG
	MOV to debug registers states.

Enumerations
enum	HYPERCALL_CODE {   HvSwitchVirtualAddressSpace = 0x0001 , HvFlushVirtualAddressSpace = 0x0002 , HvFlushVirtualAddressList = 0x0003 , HvGetLogicalProcessorRunTime = 0x0004 ,   HvCallNotifyLongSpinWait = 0x0008 , HvCallParkedVirtualProcessors = 0x0009 , HvCallSyntheticClusterIpi = 0x000B , HvCallModifyVtlProtectionMask = 0x000C ,   HvCallEnablePartitionVtl = 0x000D , HvCallDisablePartitionVtl = 0x000E , HvCallEnableVpVtl = 0x000F , HvCallDisableVpVtl = 0x0010 ,   HvCallVtlCall = 0x0011 , HvCallVtlReturn = 0x0012 , HvCallFlushVirtualAddressSpaceEx = 0x0013 , HvCallFlushVirtualAddressListEx = 0x0014 ,   HvCallSendSyntheticClusterIpiEx = 0x0015 , HvCreatePartition = 0x0040 , HvInitializePartition = 0x0041 , HvFinalizePartition = 0x0042 ,   HvDeletePartition = 0x0043 , HvGetPartitionProperty = 0x0044 , HvSetPartitionProperty = 0x0045 , HvGetPartitionId = 0x0046 ,   HvGetNextChildPartition = 0x0047 , HvDepositMemory = 0x0048 , HvWithdrawMemory = 0x0049 , HvGetMemoryBalance = 0x004A ,   HvMapGpaPages = 0x004B , HvUnmapGpaPages = 0x004C , HvInstallIntercept = 0x004D , HvCreateVp = 0x004E ,   HvDeleteVp = 0x004F , HvGetVpRegisters = 0x0050 , HvSetVpRegisters = 0x0051 , HvTranslateVirtualAddress = 0x0052 ,   HvReadGpa = 0x0053 , HvWriteGpa = 0x0054 , HvClearVirtualInterrupt = 0x0056 , HvDeletePort = 0x0058 ,   HvConnectPort = 0x0059 , HvGetPortProperty = 0x005A , HvDisconnectPort = 0x005B , HvPostMessage = 0x005C ,   HvSignalEvent = 0x005D , HvSavePartitionState = 0x005E , HvRestorePartitionState = 0x005F , HvInitializeEventLogBufferGroup = 0x0060 ,   HvFinalizeEventLogBufferGroup = 0x0061 , HvCreateEventLogBuffer = 0x0062 , HvDeleteEventLogBuffer = 0x0063 , HvMapEventLogBuffer = 0x0064 ,   HvUnmapEventLogBuffer = 0x0065 , HvSetEventLogGroupSources = 0x0066 , HvReleaseEventLogBuffer = 0x0067 , HvFlushEventLogBuffer = 0x0068 ,   HvPostDebugData = 0x0069 , HvRetrieveDebugData = 0x006A , HvResetDebugSession = 0x006B , HvMapStatsPage = 0x006C ,   HvUnmapStatsPage = 0x006D , HvCallMapSparseGpaPages = 0x006E , HvCallSetSystemProperty = 0x006F , HvCallSetPortProperty = 0x0070 ,   HvCallAddLogicalProcessor = 0x0076 , HvCallRemoveLogicalProcessor = 0x0077 , HvCallQueryNumaDistance = 0x0078 , HvCallSetLogicalProcessorProperty = 0x0079 ,   HvCallGetLogicalProcessorProperty = 0x007A , HvCallGetSystemProperty = 0x007B , HvCallMapDeviceInterrupt = 0x007C , HvCallUnmapDeviceInterrupt = 0x007D ,   HvCallRetargetDeviceInterrupt = 0x007E , HvCallMapDevicePages = 0x0080 , HvCallUnmapDevicePages = 0x0081 , HvCallAttachDevice = 0x0082 ,   HvCallDetachDevice = 0x0083 , HvCallNotifyStandbyTransition = 0x0084 , HvCallPrepareForSleep = 0x0085 , HvCallPrepareForHibernate = 0x0086 ,   HvCallNotifyPartitionEvent = 0x0087 , HvCallGetLogicalProcessorRegisters = 0x0088 , HvCallSetLogicalProcessorRegisters = 0x0089 , HvCallQueryAssotiatedLpsforMca = 0x008A ,   HvCallNotifyRingEmpty = 0x008B , HvCallInjectSyntheticMachineCheck = 0x008C , HvCallScrubPartition = 0x008D , HvCallCollectLivedump = 0x008E ,   HvCallDisableHypervisor = 0x008F , HvCallModifySparseGpaPages = 0x0090 , HvCallRegisterInterceptResult = 0x0091 , HvCallUnregisterInterceptResult = 0x0092 ,   HvCallAssertVirtualInterrupt = 0x0094 , HvCallCreatePort = 0x0095 , HvCallConnectPort = 0x0096 , HvCallGetSpaPageList = 0x0097 ,   HvCallStartVirtualProcessor = 0x009A , HvCallGetVpIndexFromApicId = 0x009A , HvCallFlushGuestPhysicalAddressSpace = 0x00AF , HvCallFlushGuestPhysicalAddressList = 0x00B0 }
	Hyper-V Hypercalls. More...
enum	_MOV_TO_DEBUG_REG { AccessToDebugRegister = 0 , AccessFromDebugRegister = 1 }
	MOV to debug registers states. More...

Functions
UCHAR	VmxVmread64 (size_t Field, UINT64 FieldValue)
	VMX VMREAD instruction (64-bit)
UCHAR	VmxVmread32 (size_t Field, UINT32 FieldValue)
	VMX VMREAD instruction (32-bit)
UCHAR	VmxVmread16 (size_t Field, UINT16 FieldValue)
	VMX VMREAD instruction (16-bit)
UCHAR	VmxVmread64P (size_t Field, UINT64 *FieldValue)
	VMX VMREAD instruction (64-bit)
UCHAR	VmxVmread32P (size_t Field, UINT32 *FieldValue)
	VMX VMREAD instruction (32-bit)
UCHAR	VmxVmread16P (size_t Field, UINT16 *FieldValue)
	VMX VMREAD instruction (16-bit)
UCHAR	VmxVmwrite64 (size_t Field, UINT64 FieldValue)
	VMX VMWRITE instruction (64-bit)
UCHAR	VmxVmwrite32 (size_t Field, UINT32 FieldValue)
	VMX VMWRITE instruction (32-bit)
UCHAR	VmxVmwrite16 (size_t Field, UINT16 FieldValue)
	VMX VMWRITE instruction (16-bit)
VOID	VmxVmptrst ()
	Implementation of VMPTRST instruction.
VOID	VmxVmresume ()
	Resume VM using VMRESUME instruction.
VOID	VmxVmxoff (VIRTUAL_MACHINE_STATE *VCpu)
	Prepare and execute Vmxoff instruction.
BOOLEAN	VmxCheckVmxSupport ()
	Check whether VMX Feature is supported or not.
BOOLEAN	VmxInitialize ()
	Initialize the VMX operation.
BOOLEAN	VmxPerformVirtualizationOnAllCores ()
	Initialize essential VMX Operation tasks.
BOOLEAN	VmxTerminate ()
	Broadcast to terminate VMX on all logical cores.
VOID	VmxPerformTermination ()
	Terminate Vmx on all logical cores.
VOID	VmxHandleXsetbv (VIRTUAL_MACHINE_STATE *VCpu)
	Handling XSETBV Instruction vm-exits.
VOID	VmxHandleVmxPreemptionTimerVmexit (VIRTUAL_MACHINE_STATE *VCpu)
	Handling VMX Preemption Timer vm-exits.
VOID	VmxHandleTripleFaults (VIRTUAL_MACHINE_STATE *VCpu)
	Handling triple fault VM-exits.
BOOLEAN	VmxPerformVirtualizationOnSpecificCore ()
	Allocates Vmx regions for all logical cores (Vmxon region and Vmcs region)
VOID	VmxFixCr4AndCr0Bits ()
	Fix values for cr0 and cr4 bits.
BOOLEAN	VmxLoadVmcs (_In_ VIRTUAL_MACHINE_STATE *VCpu)
BOOLEAN	VmxClearVmcsState (_In_ VIRTUAL_MACHINE_STATE *VCpu)
BOOLEAN	VmxCheckIsOnVmxRoot ()
	It can deterministically check whether the caller is on vmx-root mode or not.
BOOLEAN	VmxVirtualizeCurrentSystem (PVOID GuestStack)
	Initialize VMX Operation.
BOOLEAN	VmxSetupVmcs (_In_ VIRTUAL_MACHINE_STATE *VCpu, _In_ PVOID GuestStack)
UINT64	VmxReturnStackPointerForVmxoff ()
	Get the RIP of guest (VMCS_GUEST_RIP) in the case of return from VMXOFF.
UINT64	VmxReturnInstructionPointerForVmxoff ()
	Get the RIP of guest (VMCS_GUEST_RIP) in the case of return from VMXOFF.
BOOLEAN	VmxGetCurrentExecutionMode ()
	Check current execution mode (vmx-root and non-root)
BOOLEAN	VmxGetCurrentLaunchState ()
	Check if the VMX is launched or not.
UINT32	VmxCompatibleStrlen (const CHAR *S)
	implementation of vmx-root mode compatible strlen
UINT32	VmxCompatibleWcslen (const wchar_t *S)
	implementation of vmx-root mode compatible wcslen
INT32	VmxCompatibleStrcmp (const CHAR *Address1, const CHAR *Address2, SIZE_T Num, BOOLEAN IsStrncmp)
	implementation of vmx-root mode compatible strcmp and strncmp
INT32	VmxCompatibleWcscmp (const wchar_t *Address1, const wchar_t *Address2, SIZE_T Num, BOOLEAN IsWcsncmp)
	implementation of vmx-root mode compatible wcscmp and wcsncmp
INT32	VmxCompatibleMemcmp (const CHAR *Address1, const CHAR *Address2, size_t Count)
	implementation of vmx-root mode compatible memcmp

Detailed Description

VMX Instruction and operation headers.

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.1

Date

2020-04-11

Copyright

This project is released under the GNU Public License v3.

Macro Definition Documentation

CPU_BASED_ACTIVATE_IO_BITMAP

#define CPU_BASED_ACTIVATE_IO_BITMAP   0x02000000

CPU_BASED_ACTIVATE_MSR_BITMAP

#define CPU_BASED_ACTIVATE_MSR_BITMAP   0x10000000

CPU_BASED_ACTIVATE_SECONDARY_CONTROLS

#define CPU_BASED_ACTIVATE_SECONDARY_CONTROLS   0x80000000

CPU_BASED_CR3_LOAD_EXITING

#define CPU_BASED_CR3_LOAD_EXITING   0x00008000

CPU_BASED_CR3_STORE_EXITING

#define CPU_BASED_CR3_STORE_EXITING   0x00010000

CPU_BASED_CR8_LOAD_EXITING

#define CPU_BASED_CR8_LOAD_EXITING   0x00080000

CPU_BASED_CR8_STORE_EXITING

#define CPU_BASED_CR8_STORE_EXITING   0x00100000

CPU_BASED_CTL2_ENABLE_EPT

#define CPU_BASED_CTL2_ENABLE_EPT   0x2

Secondary CPU-Based Controls.

CPU_BASED_CTL2_ENABLE_INVPCID

#define CPU_BASED_CTL2_ENABLE_INVPCID   0x1000

CPU_BASED_CTL2_ENABLE_VMFUNC

#define CPU_BASED_CTL2_ENABLE_VMFUNC   0x2000

CPU_BASED_CTL2_ENABLE_VPID

#define CPU_BASED_CTL2_ENABLE_VPID   0x20

CPU_BASED_CTL2_ENABLE_XSAVE_XRSTORS

#define CPU_BASED_CTL2_ENABLE_XSAVE_XRSTORS   0x100000

CPU_BASED_CTL2_RDTSCP

#define CPU_BASED_CTL2_RDTSCP   0x8

CPU_BASED_CTL2_UNRESTRICTED_GUEST

#define CPU_BASED_CTL2_UNRESTRICTED_GUEST   0x80

CPU_BASED_CTL2_VIRTUAL_INTERRUPT_DELIVERY

#define CPU_BASED_CTL2_VIRTUAL_INTERRUPT_DELIVERY   0x200

CPU_BASED_HLT_EXITING

#define CPU_BASED_HLT_EXITING   0x00000080

CPU_BASED_INVLPG_EXITING

#define CPU_BASED_INVLPG_EXITING   0x00000200

CPU_BASED_MONITOR_EXITING

#define CPU_BASED_MONITOR_EXITING   0x20000000

CPU_BASED_MONITOR_TRAP_FLAG

#define CPU_BASED_MONITOR_TRAP_FLAG   0x08000000

CPU_BASED_MOV_DR_EXITING

#define CPU_BASED_MOV_DR_EXITING   0x00800000

CPU_BASED_MWAIT_EXITING

#define CPU_BASED_MWAIT_EXITING   0x00000400

CPU_BASED_PAUSE_EXITING

#define CPU_BASED_PAUSE_EXITING   0x40000000

CPU_BASED_RDPMC_EXITING

#define CPU_BASED_RDPMC_EXITING   0x00000800

CPU_BASED_RDTSC_EXITING

#define CPU_BASED_RDTSC_EXITING   0x00001000

CPU_BASED_TPR_SHADOW

#define CPU_BASED_TPR_SHADOW   0x00200000

CPU_BASED_UNCOND_IO_EXITING

#define CPU_BASED_UNCOND_IO_EXITING   0x01000000

CPU_BASED_USE_TSC_OFFSETTING

#define CPU_BASED_USE_TSC_OFFSETTING   0x00000008

CPU_BASED_VIRTUAL_INTR_PENDING

#define CPU_BASED_VIRTUAL_INTR_PENDING   0x00000004

CPU-Based Controls.

CPU_BASED_VIRTUAL_NMI_PENDING

#define CPU_BASED_VIRTUAL_NMI_PENDING   0x00400000

GUEST_INTR_STATE_ENCLAVE_INTR

#define GUEST_INTR_STATE_ENCLAVE_INTR   0x00000010

GUEST_INTR_STATE_MOV_SS

#define GUEST_INTR_STATE_MOV_SS   0x00000002

GUEST_INTR_STATE_NMI

#define GUEST_INTR_STATE_NMI   0x00000008

GUEST_INTR_STATE_SMI

#define GUEST_INTR_STATE_SMI   0x00000004

GUEST_INTR_STATE_STI

#define GUEST_INTR_STATE_STI   0x00000001

GUEST_INTERRUPTIBILITY_INFO flags.

HYPERV_CPUID_ENLIGHTMENT_INFO

#define HYPERV_CPUID_ENLIGHTMENT_INFO   0x40000004

HYPERV_CPUID_FEATURES

#define HYPERV_CPUID_FEATURES   0x40000003

HYPERV_CPUID_IMPLEMENT_LIMITS

#define HYPERV_CPUID_IMPLEMENT_LIMITS   0x40000005

HYPERV_CPUID_INTERFACE

#define HYPERV_CPUID_INTERFACE   0x40000001

HYPERV_CPUID_MAX

#define HYPERV_CPUID_MAX   0x4000ffff

HYPERV_CPUID_MIN

#define HYPERV_CPUID_MIN   0x40000005

HYPERV_CPUID_VENDOR_AND_MAX_FUNCTIONS

#define HYPERV_CPUID_VENDOR_AND_MAX_FUNCTIONS   0x40000000

CPUID RCX(s) - Based on Hyper-V.

HYPERV_CPUID_VERSION

#define HYPERV_CPUID_VERSION   0x40000002

HYPERV_HYPERVISOR_PRESENT_BIT

#define HYPERV_HYPERVISOR_PRESENT_BIT   0x80000000

IS_VALID_DEBUG_REGISTER

#define IS_VALID_DEBUG_REGISTER

(

DebugRegister

)

(((DebugRegister <= VMX_EXIT_QUALIFICATION_REGISTER_DR0) && (DebugRegister <= VMX_EXIT_QUALIFICATION_REGISTER_DR7)) && (DebugRegister != 0x00000004 && DebugRegister != 0x00000005))

#define IS_VALID_DEBUG_REGISTER(DebugRegister) \
    (((DebugRegister <= VMX_EXIT_QUALIFICATION_REGISTER_DR0) && (DebugRegister <= VMX_EXIT_QUALIFICATION_REGISTER_DR7)) && (DebugRegister != 0x00000004 && DebugRegister != 0x00000005))

PIN_BASED_VM_EXECUTION_CONTROLS_ACTIVE_VMX_TIMER

#define PIN_BASED_VM_EXECUTION_CONTROLS_ACTIVE_VMX_TIMER   0x00000040

PIN_BASED_VM_EXECUTION_CONTROLS_EXTERNAL_INTERRUPT

#define PIN_BASED_VM_EXECUTION_CONTROLS_EXTERNAL_INTERRUPT   0x00000001

PIN-Based Execution.

PIN_BASED_VM_EXECUTION_CONTROLS_NMI_EXITING

#define PIN_BASED_VM_EXECUTION_CONTROLS_NMI_EXITING   0x00000008

PIN_BASED_VM_EXECUTION_CONTROLS_PROCESS_POSTED_INTERRUPTS

#define PIN_BASED_VM_EXECUTION_CONTROLS_PROCESS_POSTED_INTERRUPTS   0x00000080

PIN_BASED_VM_EXECUTION_CONTROLS_VIRTUAL_NMI

#define PIN_BASED_VM_EXECUTION_CONTROLS_VIRTUAL_NMI   0x00000020

SHADOW_INT_MOV_SS

#define SHADOW_INT_MOV_SS   0x01

Interrupt shadow states.

SHADOW_INT_STI

#define SHADOW_INT_STI   0x02

VIRTUAL_PROCESSOR_ID

#define VIRTUAL_PROCESSOR_ID   0x00000000

VM_ENTRY_DEACT_DUAL_MONITOR

#define VM_ENTRY_DEACT_DUAL_MONITOR   0x00000800

VM_ENTRY_IA32E_MODE

#define VM_ENTRY_IA32E_MODE   0x00000200

VM_ENTRY_LOAD_DEBUG_CONTROLS

#define VM_ENTRY_LOAD_DEBUG_CONTROLS   0x00000004

VM-entry Control Bits.

VM_ENTRY_LOAD_IA32_EFER

#define VM_ENTRY_LOAD_IA32_EFER   0x00008000

VM_ENTRY_LOAD_IA32_PAT

#define VM_ENTRY_LOAD_IA32_PAT   0x00004000

VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL

#define VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL   0x00002000

VM_ENTRY_SMM

#define VM_ENTRY_SMM   0x00000400

VM_EXIT_ACK_INTR_ON_EXIT

#define VM_EXIT_ACK_INTR_ON_EXIT   0x00008000

VM_EXIT_HOST_ADDR_SPACE_SIZE

#define VM_EXIT_HOST_ADDR_SPACE_SIZE   0x00000200

VM_EXIT_LOAD_IA32_EFER

#define VM_EXIT_LOAD_IA32_EFER   0x00200000

VM_EXIT_LOAD_IA32_PAT

#define VM_EXIT_LOAD_IA32_PAT   0x00080000

VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL

#define VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL   0x00001000

VM_EXIT_SAVE_DEBUG_CONTROLS

#define VM_EXIT_SAVE_DEBUG_CONTROLS   0x00000004

VM-exit Control Bits.

VM_EXIT_SAVE_IA32_EFER

#define VM_EXIT_SAVE_IA32_EFER   0x00100000

VM_EXIT_SAVE_IA32_PAT

#define VM_EXIT_SAVE_IA32_PAT   0x00040000

VM_EXIT_SAVE_VMX_PREEMPTION_TIMER

#define VM_EXIT_SAVE_VMX_PREEMPTION_TIMER   0x00400000

VMCS_GUEST_DEBUGCTL_HIGH

#define VMCS_GUEST_DEBUGCTL_HIGH   0x00002803

Guest IA32_DEBUGCTL.

VMCS_SIZE

#define VMCS_SIZE   4096

VMCS Region Size.

VMM_STACK_SIZE

#define VMM_STACK_SIZE   0x8000

Stack Size.

VMXON_SIZE

#define VMXON_SIZE   4096

VMXON Region Size.

Typedef Documentation

HYPERCALL_INPUT_VALUE

typedef union _HYPERCALL_INPUT_VALUE HYPERCALL_INPUT_VALUE

Hypercalls for Hyper-V.

MOV_TO_DEBUG_REG

typedef enum _MOV_TO_DEBUG_REG MOV_TO_DEBUG_REG

MOV to debug registers states.

PHYPERCALL_INPUT_VALUE

typedef union _HYPERCALL_INPUT_VALUE * PHYPERCALL_INPUT_VALUE

Enumeration Type Documentation

_MOV_TO_DEBUG_REG

enum _MOV_TO_DEBUG_REG

MOV to debug registers states.

Enumerator
AccessToDebugRegister
AccessFromDebugRegister

{
    AccessToDebugRegister   = 0,
    AccessFromDebugRegister = 1,
} MOV_TO_DEBUG_REG;

HYPERCALL_CODE

enum HYPERCALL_CODE

Hyper-V Hypercalls.

Enumerator
HvSwitchVirtualAddressSpace
HvFlushVirtualAddressSpace
HvFlushVirtualAddressList
HvGetLogicalProcessorRunTime
HvCallNotifyLongSpinWait
HvCallParkedVirtualProcessors
HvCallSyntheticClusterIpi
HvCallModifyVtlProtectionMask
HvCallEnablePartitionVtl
HvCallDisablePartitionVtl
HvCallEnableVpVtl
HvCallDisableVpVtl
HvCallVtlCall
HvCallVtlReturn
HvCallFlushVirtualAddressSpaceEx
HvCallFlushVirtualAddressListEx
HvCallSendSyntheticClusterIpiEx
HvCreatePartition
HvInitializePartition
HvFinalizePartition
HvDeletePartition
HvGetPartitionProperty
HvSetPartitionProperty
HvGetPartitionId
HvGetNextChildPartition
HvDepositMemory
HvWithdrawMemory
HvGetMemoryBalance
HvMapGpaPages
HvUnmapGpaPages
HvInstallIntercept
HvCreateVp
HvDeleteVp
HvGetVpRegisters
HvSetVpRegisters
HvTranslateVirtualAddress
HvReadGpa
HvWriteGpa
HvClearVirtualInterrupt
HvDeletePort
HvConnectPort
HvGetPortProperty
HvDisconnectPort
HvPostMessage
HvSignalEvent
HvSavePartitionState
HvRestorePartitionState
HvInitializeEventLogBufferGroup
HvFinalizeEventLogBufferGroup
HvCreateEventLogBuffer
HvDeleteEventLogBuffer
HvMapEventLogBuffer
HvUnmapEventLogBuffer
HvSetEventLogGroupSources
HvReleaseEventLogBuffer
HvFlushEventLogBuffer
HvPostDebugData
HvRetrieveDebugData
HvResetDebugSession
HvMapStatsPage
HvUnmapStatsPage
HvCallMapSparseGpaPages
HvCallSetSystemProperty
HvCallSetPortProperty
HvCallAddLogicalProcessor
HvCallRemoveLogicalProcessor
HvCallQueryNumaDistance
HvCallSetLogicalProcessorProperty
HvCallGetLogicalProcessorProperty
HvCallGetSystemProperty
HvCallMapDeviceInterrupt
HvCallUnmapDeviceInterrupt
HvCallRetargetDeviceInterrupt
HvCallMapDevicePages
HvCallUnmapDevicePages
HvCallAttachDevice
HvCallDetachDevice
HvCallNotifyStandbyTransition
HvCallPrepareForSleep
HvCallPrepareForHibernate
HvCallNotifyPartitionEvent
HvCallGetLogicalProcessorRegisters
HvCallSetLogicalProcessorRegisters
HvCallQueryAssotiatedLpsforMca
HvCallNotifyRingEmpty
HvCallInjectSyntheticMachineCheck
HvCallScrubPartition
HvCallCollectLivedump
HvCallDisableHypervisor
HvCallModifySparseGpaPages
HvCallRegisterInterceptResult
HvCallUnregisterInterceptResult
HvCallAssertVirtualInterrupt
HvCallCreatePort
HvCallConnectPort
HvCallGetSpaPageList
HvCallStartVirtualProcessor
HvCallGetVpIndexFromApicId
HvCallFlushGuestPhysicalAddressSpace
HvCallFlushGuestPhysicalAddressList

{
    HvSwitchVirtualAddressSpace  = 0x0001,
    HvFlushVirtualAddressSpace   = 0x0002,
    HvFlushVirtualAddressList    = 0x0003,
    HvGetLogicalProcessorRunTime = 0x0004,
    // 0x0005..0x0007 are reserved
    HvCallNotifyLongSpinWait         = 0x0008,
    HvCallParkedVirtualProcessors    = 0x0009,
    HvCallSyntheticClusterIpi        = 0x000B,
    HvCallModifyVtlProtectionMask    = 0x000C,
    HvCallEnablePartitionVtl         = 0x000D,
    HvCallDisablePartitionVtl        = 0x000E,
    HvCallEnableVpVtl                = 0x000F,
    HvCallDisableVpVtl               = 0x0010,
    HvCallVtlCall                    = 0x0011,
    HvCallVtlReturn                  = 0x0012,
    HvCallFlushVirtualAddressSpaceEx = 0x0013,
    HvCallFlushVirtualAddressListEx  = 0x0014,
    HvCallSendSyntheticClusterIpiEx  = 0x0015,
    // 0x0016..0x003F are reserved
    HvCreatePartition         = 0x0040,
    HvInitializePartition     = 0x0041,
    HvFinalizePartition       = 0x0042,
    HvDeletePartition         = 0x0043,
    HvGetPartitionProperty    = 0x0044,
    HvSetPartitionProperty    = 0x0045,
    HvGetPartitionId          = 0x0046,
    HvGetNextChildPartition   = 0x0047,
    HvDepositMemory           = 0x0048,
    HvWithdrawMemory          = 0x0049,
    HvGetMemoryBalance        = 0x004A,
    HvMapGpaPages             = 0x004B,
    HvUnmapGpaPages           = 0x004C,
    HvInstallIntercept        = 0x004D,
    HvCreateVp                = 0x004E,
    HvDeleteVp                = 0x004F,
    HvGetVpRegisters          = 0x0050,
    HvSetVpRegisters          = 0x0051,
    HvTranslateVirtualAddress = 0x0052,
    HvReadGpa                 = 0x0053,
    HvWriteGpa                = 0x0054,
    // 0x0055 is deprecated
    HvClearVirtualInterrupt = 0x0056,
    // 0x0057 is deprecated
    HvDeletePort                    = 0x0058,
    HvConnectPort                   = 0x0059,
    HvGetPortProperty               = 0x005A,
    HvDisconnectPort                = 0x005B,
    HvPostMessage                   = 0x005C,
    HvSignalEvent                   = 0x005D,
    HvSavePartitionState            = 0x005E,
    HvRestorePartitionState         = 0x005F,
    HvInitializeEventLogBufferGroup = 0x0060,
    HvFinalizeEventLogBufferGroup   = 0x0061,
    HvCreateEventLogBuffer          = 0x0062,
    HvDeleteEventLogBuffer          = 0x0063,
    HvMapEventLogBuffer             = 0x0064,
    HvUnmapEventLogBuffer           = 0x0065,
    HvSetEventLogGroupSources       = 0x0066,
    HvReleaseEventLogBuffer         = 0x0067,
    HvFlushEventLogBuffer           = 0x0068,
    HvPostDebugData                 = 0x0069,
    HvRetrieveDebugData             = 0x006A,
    HvResetDebugSession             = 0x006B,
    HvMapStatsPage                  = 0x006C,
    HvUnmapStatsPage                = 0x006D,
    HvCallMapSparseGpaPages         = 0x006E,
    HvCallSetSystemProperty         = 0x006F,
    HvCallSetPortProperty           = 0x0070,
    // 0x0071..0x0075 are reserved
    HvCallAddLogicalProcessor         = 0x0076,
    HvCallRemoveLogicalProcessor      = 0x0077,
    HvCallQueryNumaDistance           = 0x0078,
    HvCallSetLogicalProcessorProperty = 0x0079,
    HvCallGetLogicalProcessorProperty = 0x007A,
    HvCallGetSystemProperty           = 0x007B,
    HvCallMapDeviceInterrupt          = 0x007C,
    HvCallUnmapDeviceInterrupt        = 0x007D,
    HvCallRetargetDeviceInterrupt     = 0x007E,
    // 0x007F is reserved
    HvCallMapDevicePages               = 0x0080,
    HvCallUnmapDevicePages             = 0x0081,
    HvCallAttachDevice                 = 0x0082,
    HvCallDetachDevice                 = 0x0083,
    HvCallNotifyStandbyTransition      = 0x0084,
    HvCallPrepareForSleep              = 0x0085,
    HvCallPrepareForHibernate          = 0x0086,
    HvCallNotifyPartitionEvent         = 0x0087,
    HvCallGetLogicalProcessorRegisters = 0x0088,
    HvCallSetLogicalProcessorRegisters = 0x0089,
    HvCallQueryAssotiatedLpsforMca     = 0x008A,
    HvCallNotifyRingEmpty              = 0x008B,
    HvCallInjectSyntheticMachineCheck  = 0x008C,
    HvCallScrubPartition               = 0x008D,
    HvCallCollectLivedump              = 0x008E,
    HvCallDisableHypervisor            = 0x008F,
    HvCallModifySparseGpaPages         = 0x0090,
    HvCallRegisterInterceptResult      = 0x0091,
    HvCallUnregisterInterceptResult    = 0x0092,
    HvCallAssertVirtualInterrupt       = 0x0094,
    HvCallCreatePort                   = 0x0095,
    HvCallConnectPort                  = 0x0096,
    HvCallGetSpaPageList               = 0x0097,
    // 0x0098 is reserved
    HvCallStartVirtualProcessor = 0x009A,
    HvCallGetVpIndexFromApicId  = 0x009A,
    // 0x009A..0x00AE are reserved
    HvCallFlushGuestPhysicalAddressSpace = 0x00AF,
    HvCallFlushGuestPhysicalAddressList  = 0x00B0
};

Function Documentation

VmxCheckIsOnVmxRoot()

BOOLEAN VmxCheckIsOnVmxRoot

(

)

It can deterministically check whether the caller is on vmx-root mode or not.

Returns

BOOLEAN Returns true if current operation mode is vmx-root and false if current operation mode is vmx non-root

{
    UINT64 VmcsLink = 0;
 
    __try
    {
        if (!__vmx_vmread(VMCS_GUEST_VMCS_LINK_POINTER, &VmcsLink))
        {
            if (VmcsLink != 0)
            {
                return TRUE;
            }
        }
    }
    __except (1)
    {
    }
 
    return FALSE;
}

VmxCheckVmxSupport()

BOOLEAN VmxCheckVmxSupport

(

)

Check whether VMX Feature is supported or not.

Returns

BOOLEAN Returns true if vmx is supported or false if it's not supported

{
    CPUID                         Data              = {0};
    IA32_FEATURE_CONTROL_REGISTER FeatureControlMsr = {0};
 
    //
    // Gets Processor Info and Feature Bits
    //
    __cpuid((int *)&Data, 1);
 
    //
    // Check For VMX Bit CPUID.ECX[5]
    //
    if (!_bittest((const LONG *)&Data.ecx, 5))
    {
        //
        // returns FALSE if vmx is not supported
        //
        return FALSE;
    }
 
    FeatureControlMsr.AsUInt = __readmsr(IA32_FEATURE_CONTROL);
 
    //
    // Commented because of https://stackoverflow.com/questions/34900224/
    // and https://github.com/HyperDbg/HyperDbg/issues/24
    // the problem is when writing to IA32_FEATURE_CONTROL MSR, the lock bit
    // of this MSR Is not set to 0 on most computers, if the user enabled VT-X
    // from the BIOS the VMXON will be already set so checking lock bit and
    // then writing to EnableVmxon again is not meaningful since its already
    // there
    //
 
    //
    // if (FeatureControlMsr.Fields.Lock == 0)
    // {
    //     FeatureControlMsr.Fields.Lock        = TRUE;
    //     FeatureControlMsr.Fields.EnableVmxon = TRUE;
    //     __writemsr(IA32_FEATURE_CONTROL, FeatureControlMsr.Flags);
    // }
 
    if (FeatureControlMsr.EnableVmxOutsideSmx == FALSE)
    {
        LogError("Err, you should enable vt-x from BIOS");
        return FALSE;
    }
 
    return TRUE;
}

VmxClearVmcsState()

BOOLEAN VmxClearVmcsState

(

_In_ VIRTUAL_MACHINE_STATE *

VCpu

)

VmxCompatibleMemcmp()

INT32 VmxCompatibleMemcmp	(	const CHAR *	Address1,
		const CHAR *	Address2,
		size_t	Count )

implementation of vmx-root mode compatible memcmp

Parameters

Address1
Address2
Count

Returns

INT32 0x2 indicates error, otherwise the same result as memcmp in string.h

{
    CHAR     C1 = NULL_ZERO, C2 = NULL_ZERO;
    INT32    Result = 0;
    UINT64   AlignedAddress1, AlignedAddress2;
    CR3_TYPE GuestCr3;
    CR3_TYPE OriginalCr3;
 
    AlignedAddress1 = (UINT64)PAGE_ALIGN((UINT64)Address1);
    AlignedAddress2 = (UINT64)PAGE_ALIGN((UINT64)Address2);
 
    //
    // Find the current process cr3
    //
    GuestCr3.Flags = LayoutGetCurrentProcessCr3().Flags;
 
    //
    // Move to new cr3
    //
    OriginalCr3.Flags = __readcr3();
    __writecr3(GuestCr3.Flags);
 
    //
    // First check
    //
    if (!CheckAccessValidityAndSafety(AlignedAddress1, sizeof(wchar_t)) || !CheckAccessValidityAndSafety(AlignedAddress2, sizeof(wchar_t)))
    {
        //
        // Error
        //
 
        //
        // Move back to original cr3
        //
        __writecr3(OriginalCr3.Flags);
        return 0x2;
    }
 
    while (Count-- > 0 && !Result)
    {
        /*
        C1 = *Address1;
        */
        MemoryMapperReadMemorySafe((UINT64)Address1, &C1, sizeof(CHAR));
 
        /*
        C2 = *Address2;
        */
        MemoryMapperReadMemorySafe((UINT64)Address2, &C2, sizeof(CHAR));
 
        Address1++;
        Address2++;
 
        if (!((UINT64)AlignedAddress1 & (PAGE_SIZE - 1)))
        {
            if (!CheckAccessValidityAndSafety((UINT64)AlignedAddress1, sizeof(wchar_t)))
            {
                //
                // Error
                //
 
                //
                // Move back to original cr3
                //
                __writecr3(OriginalCr3.Flags);
                return 0x2;
            }
        }
 
        if (!((UINT64)AlignedAddress2 & (PAGE_SIZE - 1)))
        {
            if (!CheckAccessValidityAndSafety((UINT64)AlignedAddress2, sizeof(wchar_t)))
            {
                //
                // Error
                //
 
                //
                // Move back to original cr3
                //
                __writecr3(OriginalCr3.Flags);
                return 0x2;
            }
        }
 
        Result = C1 - C2;
    }
 
    if (Result < 0)
    {
        Result = -1;
    }
    else if (Result > 0)
    {
        Result = 1;
    }
 
    //
    // Move back to original cr3
    //
    __writecr3(OriginalCr3.Flags);
    return Result;
}

VmxCompatibleStrcmp()

INT32 VmxCompatibleStrcmp	(	const CHAR *	Address1,
		const CHAR *	Address2,
		SIZE_T	Num,
		BOOLEAN	IsStrncmp )

implementation of vmx-root mode compatible strcmp and strncmp

Parameters

Address1
Address2
Num	param IsStrncmp

Returns

INT32 0x2 indicates error, otherwise the same result as strcmp in string.h

{
    CHAR     C1 = NULL_ZERO, C2 = NULL_ZERO;
    INT32    Result = 0;
    UINT32   Count  = 0;
    UINT64   AlignedAddress1, AlignedAddress2;
    CR3_TYPE GuestCr3;
    CR3_TYPE OriginalCr3;
 
    AlignedAddress1 = (UINT64)PAGE_ALIGN((UINT64)Address1);
    AlignedAddress2 = (UINT64)PAGE_ALIGN((UINT64)Address2);
 
    //
    // Find the current process cr3
    //
    GuestCr3.Flags = LayoutGetCurrentProcessCr3().Flags;
 
    //
    // Move to new cr3
    //
    OriginalCr3.Flags = __readcr3();
    __writecr3(GuestCr3.Flags);
 
    //
    // First check
    //
    if (!CheckAccessValidityAndSafety(AlignedAddress1, sizeof(CHAR)) || !CheckAccessValidityAndSafety(AlignedAddress2, sizeof(CHAR)))
    {
        //
        // Error
        //
 
        //
        // Move back to original cr3
        //
        __writecr3(OriginalCr3.Flags);
        return 0x2;
    }
 
    do
    {
        //
        // Check to see if we have byte number constraints
        //
        if (IsStrncmp)
        {
            if (Count == Num)
            {
                //
                // Maximum number of bytes reached
                //
                break;
            }
            else
            {
                //
                // Maximum number of bytes not reached
                //
                Count++;
            }
        }
 
        /*
        C1 = *Address1;
        */
        MemoryMapperReadMemorySafe((UINT64)Address1, &C1, sizeof(CHAR));
 
        /*
        C2 = *Address2;
        */
        MemoryMapperReadMemorySafe((UINT64)Address2, &C2, sizeof(CHAR));
 
        Address1++;
        Address2++;
 
        if (!((UINT64)AlignedAddress1 & (PAGE_SIZE - 1)))
        {
            if (!CheckAccessValidityAndSafety((UINT64)AlignedAddress1, sizeof(CHAR)))
            {
                //
                // Error
                //
 
                //
                // Move back to original cr3
                //
                __writecr3(OriginalCr3.Flags);
                return 0x2;
            }
        }
 
        if (!((UINT64)AlignedAddress2 & (PAGE_SIZE - 1)))
        {
            if (!CheckAccessValidityAndSafety((UINT64)AlignedAddress2, sizeof(CHAR)))
            {
                //
                // Error
                //
 
                //
                // Move back to original cr3
                //
                __writecr3(OriginalCr3.Flags);
                return 0x2;
            }
        }
        Result = C1 - C2;
    } while (!Result && C2);
 
    if (Result < 0)
    {
        Result = -1;
    }
    else if (Result > 0)
    {
        Result = 1;
    }
 
    //
    // Move back to original cr3
    //
    __writecr3(OriginalCr3.Flags);
    return Result;
}

VmxCompatibleStrlen()

UINT32 VmxCompatibleStrlen

(

const CHAR *

S

)

implementation of vmx-root mode compatible strlen

Parameters

S

Returns

UINT32 If 0x0 indicates an error, otherwise length of the string

{
    CHAR     Temp  = NULL_ZERO;
    UINT32   Count = 0;
    UINT64   AlignedAddress;
    CR3_TYPE GuestCr3;
    CR3_TYPE OriginalCr3;
 
    AlignedAddress = (UINT64)PAGE_ALIGN((UINT64)S);
 
    //
    // Find the current process cr3
    //
    GuestCr3.Flags = LayoutGetCurrentProcessCr3().Flags;
 
    //
    // Move to new cr3
    //
    OriginalCr3.Flags = __readcr3();
    __writecr3(GuestCr3.Flags);
 
    //
    // First check
    //
    if (!CheckAccessValidityAndSafety(AlignedAddress, sizeof(CHAR)))
    {
        //
        // Error
        //
 
        //
        // Move back to original cr3
        //
        __writecr3(OriginalCr3.Flags);
        return 0;
    }
 
    while (TRUE)
    {
        /*
        Temp = *S;
        */
        MemoryMapperReadMemorySafe((UINT64)S, &Temp, sizeof(CHAR));
 
        if (Temp != '\0')
        {
            Count++;
            S++;
        }
        else
        {
            //
            // Move back to original cr3
            //
            __writecr3(OriginalCr3.Flags);
            return Count;
        }
 
        if (!((UINT64)S & (PAGE_SIZE - 1)))
        {
            if (!CheckAccessValidityAndSafety((UINT64)S, sizeof(CHAR)))
            {
                //
                // Error
                //
 
                //
                // Move back to original cr3
                //
                __writecr3(OriginalCr3.Flags);
                return 0;
            }
        }
    }
 
    //
    // Move back to original cr3
    //
    __writecr3(OriginalCr3.Flags);
}

VmxCompatibleWcscmp()

INT32 VmxCompatibleWcscmp	(	const wchar_t *	Address1,
		const wchar_t *	Address2,
		SIZE_T	Num,
		BOOLEAN	IsWcsncmp )

implementation of vmx-root mode compatible wcscmp and wcsncmp

Parameters

Address1
Address2
Num
IsWcsncmp

Returns

INT32 0x2 indicates error, otherwise the same result as wcscmp in string.h

{
    wchar_t  C1 = NULL_ZERO, C2 = NULL_ZERO;
    INT32    Result = 0;
    UINT32   Count  = 0;
    UINT64   AlignedAddress1, AlignedAddress2;
    CR3_TYPE GuestCr3;
    CR3_TYPE OriginalCr3;
 
    AlignedAddress1 = (UINT64)PAGE_ALIGN((UINT64)Address1);
    AlignedAddress2 = (UINT64)PAGE_ALIGN((UINT64)Address2);
 
    //
    // Find the current process cr3
    //
    GuestCr3.Flags = LayoutGetCurrentProcessCr3().Flags;
 
    //
    // Move to new cr3
    //
    OriginalCr3.Flags = __readcr3();
    __writecr3(GuestCr3.Flags);
 
    //
    // First check
    //
    if (!CheckAccessValidityAndSafety(AlignedAddress1, sizeof(wchar_t)) || !CheckAccessValidityAndSafety(AlignedAddress2, sizeof(wchar_t)))
    {
        //
        // Error
        //
 
        //
        // Move back to original cr3
        //
        __writecr3(OriginalCr3.Flags);
        return 0x2;
    }
 
    do
    {
        //
        // Check to see if we have byte number constraints
        //
        if (IsWcsncmp)
        {
            if (Count == Num)
            {
                //
                // Maximum number of bytes reached
                //
                break;
            }
            else
            {
                //
                // Maximum number of bytes not reached
                //
                Count++;
            }
        }
 
        /*
        C1 = *Address1;
        */
        MemoryMapperReadMemorySafe((UINT64)Address1, &C1, sizeof(wchar_t));
 
        /*
        C2 = *Address2;
        */
        MemoryMapperReadMemorySafe((UINT64)Address2, &C2, sizeof(wchar_t));
 
        Address1++;
        Address2++;
 
        if (!((UINT64)AlignedAddress1 & (PAGE_SIZE - 1)))
        {
            if (!CheckAccessValidityAndSafety((UINT64)AlignedAddress1, sizeof(wchar_t)))
            {
                //
                // Error
                //
 
                //
                // Move back to original cr3
                //
                __writecr3(OriginalCr3.Flags);
                return 0x2;
            }
        }
 
        if (!((UINT64)AlignedAddress2 & (PAGE_SIZE - 1)))
        {
            if (!CheckAccessValidityAndSafety((UINT64)AlignedAddress2, sizeof(wchar_t)))
            {
                //
                // Error
                //
 
                //
                // Move back to original cr3
                //
                __writecr3(OriginalCr3.Flags);
                return 0x2;
            }
        }
 
        Result = C1 - C2;
    } while (!Result && C2);
 
    if (Result < 0)
    {
        Result = -1;
    }
    else if (Result > 0)
    {
        Result = 1;
    }
 
    //
    // Move back to original cr3
    //
    __writecr3(OriginalCr3.Flags);
    return Result;
}

VmxCompatibleWcslen()

UINT32 VmxCompatibleWcslen

(

const wchar_t *

S

)

implementation of vmx-root mode compatible wcslen

Parameters

S

Returns

UINT32 If 0x0 indicates an error, otherwise length of the string

{
    wchar_t  Temp  = NULL_ZERO;
    UINT32   Count = 0;
    UINT64   AlignedAddress;
    CR3_TYPE GuestCr3;
    CR3_TYPE OriginalCr3;
 
    AlignedAddress = (UINT64)PAGE_ALIGN((UINT64)S);
 
    //
    // Find the current process cr3
    //
    GuestCr3.Flags = LayoutGetCurrentProcessCr3().Flags;
 
    //
    // Move to new cr3
    //
    OriginalCr3.Flags = __readcr3();
    __writecr3(GuestCr3.Flags);
 
    AlignedAddress = (UINT64)PAGE_ALIGN((UINT64)S);
 
    //
    // First check
    //
    if (!CheckAccessValidityAndSafety(AlignedAddress, sizeof(wchar_t)))
    {
        //
        // Error
        //
 
        //
        // Move back to original cr3
        //
        __writecr3(OriginalCr3.Flags);
        return 0;
    }
 
    while (TRUE)
    {
        /*
        Temp = *S;
        */
        MemoryMapperReadMemorySafe((UINT64)S, &Temp, sizeof(wchar_t));
 
        if (Temp != '\0\0')
        {
            Count++;
            S++;
        }
        else
        {
            //
            // Move back to original cr3
            //
            __writecr3(OriginalCr3.Flags);
            return Count;
        }
 
        if (!((UINT64)S & (PAGE_SIZE - 1)))
        {
            if (!CheckAccessValidityAndSafety((UINT64)S, sizeof(wchar_t)))
            {
                //
                // Error
                //
 
                //
                // Move back to original cr3
                //
                __writecr3(OriginalCr3.Flags);
                return 0;
            }
        }
    }
 
    //
    // Move back to original cr3
    //
    __writecr3(OriginalCr3.Flags);
}

VmxFixCr4AndCr0Bits()

VOID VmxFixCr4AndCr0Bits

(

)

Fix values for cr0 and cr4 bits.

The Cr4 And Cr0 Bits During VMX Operation Preventing Them From Any Change (https://revers.engineering/day-2-entering-vmx-operation/)

Returns

VOID

{
    CR_FIXED CrFixed = {0};
    CR4      Cr4     = {0};
    CR0      Cr0     = {0};
 
    //
    // Fix Cr0
    //
    CrFixed.Flags = __readmsr(IA32_VMX_CR0_FIXED0);
    Cr0.AsUInt    = __readcr0();
    Cr0.AsUInt |= CrFixed.Fields.Low;
    CrFixed.Flags = __readmsr(IA32_VMX_CR0_FIXED1);
    Cr0.AsUInt &= CrFixed.Fields.Low;
    __writecr0(Cr0.AsUInt);
 
    //
    // Fix Cr4
    //
    CrFixed.Flags = __readmsr(IA32_VMX_CR4_FIXED0);
    Cr4.AsUInt    = __readcr4();
    Cr4.AsUInt |= CrFixed.Fields.Low;
    CrFixed.Flags = __readmsr(IA32_VMX_CR4_FIXED1);
    Cr4.AsUInt &= CrFixed.Fields.Low;
    __writecr4(Cr4.AsUInt);
}

VmxGetCurrentExecutionMode()

BOOLEAN VmxGetCurrentExecutionMode

(

)

Check current execution mode (vmx-root and non-root)

Returns

BOOLEAN Returns true if the execution is on vmx-root, otherwise false

{
    if (g_GuestState)
    {
        ULONG                   CurrentCore    = KeGetCurrentProcessorNumberEx(NULL);
        VIRTUAL_MACHINE_STATE * CurrentVmState = &g_GuestState[CurrentCore];
 
        return CurrentVmState->IsOnVmxRootMode ? VmxExecutionModeRoot : VmxExecutionModeNonRoot;
    }
    else
    {
        //
        // The structure for guest state is not initialized, thus, we're in VMX non-root
        //
        return VmxExecutionModeNonRoot;
    }
}

VmxGetCurrentLaunchState()

BOOLEAN VmxGetCurrentLaunchState

(

)

Check if the VMX is launched or not.

Returns

BOOLEAN Returns true if it's launched, otherwise false

{
    ULONG                   CurrentCore    = KeGetCurrentProcessorNumberEx(NULL);
    VIRTUAL_MACHINE_STATE * CurrentVmState = &g_GuestState[CurrentCore];
 
    return CurrentVmState->HasLaunched;
}

VmxHandleTripleFaults()

VOID VmxHandleTripleFaults

(

VIRTUAL_MACHINE_STATE *

VCpu

)

Handling triple fault VM-exits.

Parameters

VCpu	The virtual processor's state

Returns

VOID

{
    LogError("Err, triple fault error occurred!");
 
    //
    // This error cannot be recovered, produce debug results
    //
    CommonWriteDebugInformation(VCpu);
 
    //
    // We won't further continue after this error
    //
    DbgBreakPoint();
}

VmxHandleVmxPreemptionTimerVmexit()

VOID VmxHandleVmxPreemptionTimerVmexit

(

VIRTUAL_MACHINE_STATE *

VCpu

)

Handling VMX Preemption Timer vm-exits.

Parameters

VCpu	The virtual processor's state

Returns

VOID

{
    LogError("Why vm-exit for VMX preemption timer happened?");
 
    //
    // Not increase the RIP by default
    //
    HvSuppressRipIncrement(VCpu);
}

VmxHandleXsetbv()

VOID VmxHandleXsetbv

(

VIRTUAL_MACHINE_STATE *

VCpu

)

Handling XSETBV Instruction vm-exits.

Parameters

VCpu

Returns

VOID

{
    _xsetbv(VCpu->Regs->rcx & 0xffffffff, VCpu->Regs->rdx << 32 | VCpu->Regs->rax);
}

VmxInitialize()

BOOLEAN VmxInitialize

(

)

Initialize the VMX operation.

Returns

BOOLEAN Returns true if vmx initialized successfully

{
    ULONG ProcessorsCount;
 
    //
    // ****** Start Virtualizing Current System ******
    //
 
    //
    // Initiating EPTP and VMX
    //
    if (!VmxPerformVirtualizationOnAllCores())
    {
        //
        // there was error somewhere in initializing
        //
        return FALSE;
    }
 
    ProcessorsCount = KeQueryActiveProcessorCount(0);
 
    for (size_t ProcessorID = 0; ProcessorID < ProcessorsCount; ProcessorID++)
    {
        //
        // *** Launching VM for Test (in the all logical processor) ***
        //
 
        VIRTUAL_MACHINE_STATE * GuestState = &g_GuestState[ProcessorID];
 
        //
        // Allocating VMM Stack
        //
        if (!VmxAllocateVmmStack(GuestState))
        {
            //
            // Some error in allocating Vmm Stack
            //
            return FALSE;
        }
 
        //
        // Allocating MSR Bit
        //
        if (!VmxAllocateMsrBitmap(GuestState))
        {
            //
            // Some error in allocating Msr Bitmaps
            //
            return FALSE;
        }
 
        //
        // Allocating I/O Bit
        //
        if (!VmxAllocateIoBitmaps(GuestState))
        {
            //
            // Some error in allocating I/O Bitmaps
            //
            return FALSE;
        }
 
#if USE_DEFAULT_OS_IDT_AS_HOST_IDT == FALSE
 
        //
        // Allocating Host IDT
        //
        if (!VmxAllocateHostIdt(GuestState))
        {
            //
            // Some error in allocating Host IDT
            //
            return FALSE;
        }
#endif // USE_DEFAULT_OS_IDT_AS_HOST_IDT == FALSE
 
#if USE_DEFAULT_OS_GDT_AS_HOST_GDT == FALSE
 
        //
        // Allocating Host GDT
        //
        if (!VmxAllocateHostGdt(GuestState))
        {
            //
            // Some error in allocating Host GDT
            //
            return FALSE;
        }
 
        //
        // Allocating Host TSS
        //
        if (!VmxAllocateHostTss(GuestState))
        {
            //
            // Some error in allocating Host TSS
            //
            return FALSE;
        }
 
#endif // USE_DEFAULT_OS_GDT_AS_HOST_GDT == FALSE
 
#if USE_INTERRUPT_STACK_TABLE == TRUE
 
        //
        // Allocating Host Interrupt Stack
        //
        if (!VmxAllocateHostInterruptStack(GuestState))
        {
            //
            // Some error in allocating Interrupt Stack
            //
            return FALSE;
        }
 
#endif // USE_INTERRUPT_STACK_TABLE == TRUE
    }
 
    //
    // Create a bitmap of the MSRs that cause #GP
    //
    g_MsrBitmapInvalidMsrs = VmxAllocateInvalidMsrBimap();
 
    if (g_MsrBitmapInvalidMsrs == NULL)
    {
        return FALSE;
    }
 
    //
    // As we want to support more than 32 processor (64 logical-core)
    // we let windows execute our routine for us
    //
    KeGenericCallDpc(DpcRoutineInitializeGuest, 0x0);
 
    //
    // Check if everything is ok then return true otherwise false
    //
    if (AsmVmxVmcall(VMCALL_TEST, 0x22, 0x333, 0x4444) == STATUS_SUCCESS)
    {
        return TRUE;
    }
    else
    {
        return FALSE;
    }
}

VmxLoadVmcs()

BOOLEAN VmxLoadVmcs

(

_In_ VIRTUAL_MACHINE_STATE *

VCpu

)

VmxPerformTermination()

VOID VmxPerformTermination

(

)

Terminate Vmx on all logical cores.

Returns

VOID

{
    ULONG ProcessorsCount;
 
    LogDebugInfo("Terminating VMX...\n");
 
    //
    // Get number of processors
    //
    ProcessorsCount = KeQueryActiveProcessorCount(0);
 
    //
    // ******* Terminating Vmx *******
    //
 
    //
    // Unhide (disable and de-allocate) transparent-mode
    //
    TransparentUnhideDebugger();
 
    //
    // Remove All the hooks if any
    //
    EptHookUnHookAll();
 
    //
    // Restore the state of execution trap hooks
    //
    ExecTrapUninitialize();
 
    //
    // Broadcast to terminate Vmx
    //
    KeGenericCallDpc(DpcRoutineTerminateGuest, 0x0);
 
    //
    // ****** De-allocatee global variables ******
    //
 
    //
    // Free the buffer related to MSRs that cause #GP
    //
    PlatformMemFreePool(g_MsrBitmapInvalidMsrs);
    g_MsrBitmapInvalidMsrs = NULL;
 
    //
    // Free Identity Page Table
    //
    for (size_t i = 0; i < ProcessorsCount; i++)
    {
        if (g_GuestState[i].EptPageTable != NULL)
        {
            MmFreeContiguousMemory(g_GuestState[i].EptPageTable);
        }
 
        g_GuestState[i].EptPageTable = NULL;
    }
 
    //
    // Free EptState
    //
    PlatformMemFreePool(g_EptState);
    g_EptState = NULL;
 
    //
    // Free the Pool manager
    //
    PoolManagerUninitialize();
 
    //
    // Uninitialize memory mapper
    //
    MemoryMapperUninitialize();
 
    //
    // Free g_GuestState
    //
    GlobalGuestStateFreeMemory();
 
    LogDebugInfo("VMX operation turned off successfully");
}

VmxPerformVirtualizationOnAllCores()

BOOLEAN VmxPerformVirtualizationOnAllCores

(

)

Initialize essential VMX Operation tasks.

Returns

BOOLEAN Returns true if vmx is successfully initialized

{
    PAGED_CODE();
 
    if (!VmxCheckVmxSupport())
    {
        LogError("Err, VMX is not supported in this machine");
        return FALSE;
    }
 
    //
    // Allocate global variable to hold Ept State
    //
    g_EptState = PlatformMemAllocateZeroedNonPagedPool(sizeof(EPT_STATE));
 
    if (!g_EptState)
    {
        LogError("Err, insufficient memory");
        return FALSE;
    }
 
    //
    // Initialize the list of hooked pages detail
    //
    InitializeListHead(&g_EptState->HookedPagesList);
 
    //
    // Check whether EPT is supported or not
    //
    if (!EptCheckFeatures())
    {
        LogError("Err, your processor doesn't support all EPT features");
        return FALSE;
    }
    else
    {
        //
        // Our processor supports EPT, now let's build MTRR
        //
        LogDebugInfo("Your processor supports all EPT features");
 
        //
        // Build MTRR Map
        //
        if (!EptBuildMtrrMap())
        {
            LogError("Err, could not build MTRR memory map");
            return FALSE;
        }
 
        LogDebugInfo("MTRR memory map built successfully");
    }
 
    //
    // Initialize Pool Manager
    //
    if (!PoolManagerInitialize())
    {
        LogError("Err, could not initialize pool manager");
        return FALSE;
    }
 
    if (!EptLogicalProcessorInitialize())
    {
        //
        // There were some errors in EptLogicalProcessorInitialize
        //
        return FALSE;
    }
 
    //
    // Broadcast to run vmx-specific task to virtualize cores
    //
    BroadcastVmxVirtualizationAllCores();
 
    //
    // Everything is ok, let's return true
    //
    return TRUE;
}

VmxPerformVirtualizationOnSpecificCore()

BOOLEAN VmxPerformVirtualizationOnSpecificCore

(

)

Allocates Vmx regions for all logical cores (Vmxon region and Vmcs region)

Returns

BOOLEAN

{
    ULONG                   CurrentCore = KeGetCurrentProcessorNumberEx(NULL);
    VIRTUAL_MACHINE_STATE * VCpu        = &g_GuestState[CurrentCore];
 
    LogDebugInfo("Allocating vmx regions for logical core %d", CurrentCore);
 
    //
    // Enabling VMX Operation
    //
    AsmEnableVmxOperation();
 
    //
    // Fix Cr4 and Cr0 bits during VMX operation
    //
    VmxFixCr4AndCr0Bits();
 
    LogDebugInfo("VMX-Operation enabled successfully");
 
    if (!VmxAllocateVmxonRegion(VCpu))
    {
        LogError("Err, allocating memory for vmxon region was not successful");
        return FALSE;
    }
    if (!VmxAllocateVmcsRegion(VCpu))
    {
        LogError("Err, allocating memory for vmcs region was not successful");
        return FALSE;
    }
 
    return TRUE;
}

VmxReturnInstructionPointerForVmxoff()

UINT64 VmxReturnInstructionPointerForVmxoff

(

)

Get the RIP of guest (VMCS_GUEST_RIP) in the case of return from VMXOFF.

Returns

UINT64 Returns the instruction pointer, to change in the case of Vmxoff

{
    return g_GuestState[KeGetCurrentProcessorNumberEx(NULL)].VmxoffState.GuestRip;
}

VmxReturnStackPointerForVmxoff()

UINT64 VmxReturnStackPointerForVmxoff

(

)

Get the RIP of guest (VMCS_GUEST_RIP) in the case of return from VMXOFF.

Returns

UINT64 Returns the stack pointer, to change in the case of Vmxoff

{
    return g_GuestState[KeGetCurrentProcessorNumberEx(NULL)].VmxoffState.GuestRsp;
}

VmxSetupVmcs()

BOOLEAN VmxSetupVmcs	(	_In_ VIRTUAL_MACHINE_STATE *	VCpu,
		_In_ PVOID	GuestStack )

VmxTerminate()

BOOLEAN VmxTerminate

(

)

Broadcast to terminate VMX on all logical cores.

Returns

BOOLEAN Returns true if vmxoff successfully executed in vmcall or otherwise returns false

{
    NTSTATUS                Status      = STATUS_SUCCESS;
    ULONG                   CurrentCore = KeGetCurrentProcessorNumberEx(NULL);
    VIRTUAL_MACHINE_STATE * VCpu        = &g_GuestState[CurrentCore];
 
    //
    // Execute Vmcall to to turn off vmx from Vmx root mode
    //
    Status = AsmVmxVmcall(VMCALL_VMXOFF, NULL64_ZERO, NULL64_ZERO, NULL64_ZERO);
 
    if (Status == STATUS_SUCCESS)
    {
        LogDebugInfo("VMX terminated on logical core %d\n", CurrentCore);
 
        //
        // Free the destination memory
        //
        MmFreeContiguousMemory((PVOID)VCpu->VmxonRegionVirtualAddress);
        MmFreeContiguousMemory((PVOID)VCpu->VmcsRegionVirtualAddress);
        PlatformMemFreePool((PVOID)VCpu->VmmStack);
        PlatformMemFreePool((PVOID)VCpu->MsrBitmapVirtualAddress);
        PlatformMemFreePool((PVOID)VCpu->IoBitmapVirtualAddressA);
        PlatformMemFreePool((PVOID)VCpu->IoBitmapVirtualAddressB);
#if USE_DEFAULT_OS_IDT_AS_HOST_IDT == FALSE
        PlatformMemFreePool((PVOID)VCpu->HostIdt);
#endif // USE_DEFAULT_OS_IDT_AS_HOST_IDT == FALSE
 
#if USE_DEFAULT_OS_GDT_AS_HOST_GDT == FALSE
        PlatformMemFreePool((PVOID)VCpu->HostGdt);
        PlatformMemFreePool((PVOID)VCpu->HostTss);
#endif // USE_DEFAULT_OS_GDT_AS_HOST_GDT == FALSE
 
#if USE_INTERRUPT_STACK_TABLE == TRUE
        PlatformMemFreePool((PVOID)VCpu->HostInterruptStack);
#endif // USE_INTERRUPT_STACK_TABLE == FALSE
 
        return TRUE;
    }
 
    return FALSE;
}

VmxVirtualizeCurrentSystem()

BOOLEAN VmxVirtualizeCurrentSystem

(

PVOID

GuestStack

)

Initialize VMX Operation.

Parameters

GuestStack

Guest stack for the this core (VMCS_GUEST_RSP)

Returns

BOOLEAN This function won't return true as when Vmlaunch is executed the rest of the function never executes but returning FALSE is an indication of error

{
    UINT64                  ErrorCode   = 0;
    ULONG                   CurrentCore = KeGetCurrentProcessorNumberEx(NULL);
    VIRTUAL_MACHINE_STATE * VCpu        = &g_GuestState[CurrentCore];
 
    LogDebugInfo("Virtualizing current system (logical core : 0x%x)", CurrentCore);
 
#if USE_DEFAULT_OS_IDT_AS_HOST_IDT == FALSE
 
    //
    // Prepare Host IDT
    //
    IdtEmulationPrepareHostIdt(VCpu);
#endif // USE_DEFAULT_OS_IDT_AS_HOST_IDT == FALSE
 
#if USE_DEFAULT_OS_GDT_AS_HOST_GDT == FALSE
 
    //
    // Prepare Host GDT and TSS
    //
    SegmentPrepareHostGdt((SEGMENT_DESCRIPTOR_32 *)AsmGetGdtBase(),
                          AsmGetGdtLimit(),
                          AsmGetTr(),
                          VCpu->HostInterruptStack,
                          (SEGMENT_DESCRIPTOR_32 *)VCpu->HostGdt,
                          (TASK_STATE_SEGMENT_64 *)VCpu->HostTss);
 
#endif // USE_DEFAULT_OS_GDT_AS_HOST_GDT == FALSE
 
    //
    // Clear the VMCS State
    //
    if (!VmxClearVmcsState(VCpu))
    {
        LogError("Err, failed to clear vmcs");
        return FALSE;
    }
 
    //
    // Load VMCS (Set the Current VMCS)
    //
    if (!VmxLoadVmcs(VCpu))
    {
        LogError("Err, failed to load vmcs");
        return FALSE;
    }
 
    LogDebugInfo("Setting up VMCS for current logical core");
 
    VmxSetupVmcs(VCpu, GuestStack);
 
    LogDebugInfo("Executing VMLAUNCH on logical core %d", CurrentCore);
 
    //
    // Setting the state to indicate current core is currently virtualized
    //
 
    VCpu->HasLaunched = TRUE;
 
    __vmx_vmlaunch();
 
    //
    // ******** if Vmlaunch succeed will never be here ! ********
    //
 
    //
    // If failed, then indicate that current core is not currently virtualized
    //
    VCpu->HasLaunched = FALSE;
 
    //
    // Read error code firstly
    //
    __vmx_vmread(VMCS_VM_INSTRUCTION_ERROR, &ErrorCode);
 
    LogError("Err, unable to execute VMLAUNCH, status : 0x%llx", ErrorCode);
 
    //
    // Then Execute Vmxoff
    //
    __vmx_off();
    LogError("Err, VMXOFF Executed Successfully but it was because of an error");
 
    return FALSE;
}

VmxVmptrst()

VOID VmxVmptrst

(

)

Implementation of VMPTRST instruction.

Returns

VOID

{
    PHYSICAL_ADDRESS VmcsPhysicalAddr;
    VmcsPhysicalAddr.QuadPart = 0;
    __vmx_vmptrst((unsigned __int64 *)&VmcsPhysicalAddr);
 
    LogDebugInfo("VMPTRST result : %llx", VmcsPhysicalAddr);
}

VmxVmread16()

UCHAR VmxVmread16 ( size_t Field, UINT16 FieldValue )

externinline

VMX VMREAD instruction (16-bit)

Parameters

Field
FieldValue

Returns

UCHAR

{
    UINT64 TargetField = 0ull;
 
    TargetField = FieldValue;
 
    return __vmx_vmread((size_t)Field, (size_t *)TargetField);
}

VmxVmread16P()

UCHAR VmxVmread16P ( size_t Field, UINT16 * FieldValue )

externinline

VMX VMREAD instruction (16-bit)

Parameters

Field
FieldValue

Returns

UCHAR

{
    UINT64 TargetField = 0ull;
 
    TargetField = (UINT64)FieldValue;
 
    return __vmx_vmread((size_t)Field, (size_t *)TargetField);
}

VmxVmread32()

UCHAR VmxVmread32 ( size_t Field, UINT32 FieldValue )

externinline

VMX VMREAD instruction (32-bit)

Parameters

Field
FieldValue

Returns

UCHAR

{
    UINT64 TargetField = 0ull;
 
    TargetField = FieldValue;
 
    return __vmx_vmread((size_t)Field, (size_t *)TargetField);
}

VmxVmread32P()

UCHAR VmxVmread32P ( size_t Field, UINT32 * FieldValue )

externinline

VMX VMREAD instruction (32-bit)

Parameters

Field
FieldValue

Returns

UCHAR

{
    UINT64 TargetField = 0ull;
 
    TargetField = (UINT64)FieldValue;
 
    return __vmx_vmread((size_t)Field, (size_t *)TargetField);
}

VmxVmread64()

UCHAR VmxVmread64 ( size_t Field, UINT64 FieldValue )

externinline

VMX VMREAD instruction (64-bit)

Parameters

Field
FieldValue

Returns

UCHAR

{
    return __vmx_vmread((size_t)Field, (size_t *)FieldValue);
}

VmxVmread64P()

UCHAR VmxVmread64P ( size_t Field, UINT64 * FieldValue )

externinline

VMX VMREAD instruction (64-bit)

Parameters

Field
FieldValue

Returns

UCHAR

{
    return __vmx_vmread((size_t)Field, (size_t *)FieldValue);
}

VmxVmresume()

VOID VmxVmresume

(

)

Resume VM using VMRESUME instruction.

Returns

VOID

{
    UINT64 ErrorCode = 0;
 
    __vmx_vmresume();
 
    //
    // if VMRESUME succeed will never be here !
    //
 
    __vmx_vmread(VMCS_VM_INSTRUCTION_ERROR, &ErrorCode);
    __vmx_off();
 
    //
    // It's such a bad error because we don't where to go !
    // prefer to break
    //
    LogError("Err,  in executing VMRESUME , status : 0x%llx", ErrorCode);
}

VmxVmwrite16()

UCHAR VmxVmwrite16 ( size_t Field, UINT16 FieldValue )

externinline

VMX VMWRITE instruction (16-bit)

Parameters

Field
FieldValue

Returns

UCHAR

{
    UINT64 TargetValue = NULL64_ZERO;
    TargetValue        = (UINT64)FieldValue;
    return __vmx_vmwrite((size_t)Field, (size_t)TargetValue);
}

VmxVmwrite32()

UCHAR VmxVmwrite32 ( size_t Field, UINT32 FieldValue )

externinline

VMX VMWRITE instruction (32-bit)

Parameters

Field
FieldValue

Returns

UCHAR

{
    UINT64 TargetValue = NULL64_ZERO;
    TargetValue        = (UINT64)FieldValue;
    return __vmx_vmwrite((size_t)Field, (size_t)TargetValue);
}

VmxVmwrite64()

UCHAR VmxVmwrite64 ( size_t Field, UINT64 FieldValue )

externinline

VMX VMWRITE instruction (64-bit)

Parameters

Field
FieldValue

Returns

UCHAR

{
    return __vmx_vmwrite((size_t)Field, (size_t)FieldValue);
}

VmxVmxoff()

VOID VmxVmxoff

(

VIRTUAL_MACHINE_STATE *

VCpu

)

Prepare and execute Vmxoff instruction.

Parameters

VCpu	The virtual processor's state

Returns

VOID

{
    UINT64 GuestRSP              = 0; // Save a pointer to guest rsp for times that we want to return to previous guest stateS
    UINT64 GuestRIP              = 0; // Save a pointer to guest rip for times that we want to return to previous guest state
    UINT64 GuestCr3              = 0;
    UINT64 ExitInstructionLength = 0;
 
    //
    // According to SimpleVisor :
    //      Our callback routine may have interrupted an arbitrary user process,
    //      and therefore not a thread running with a system-wide page directory.
    //      Therefore if we return back to the original caller after turning off
    //      VMX, it will keep our current "host" CR3 value which we set on entry
    //      to the PML4 of the SYSTEM process. We want to return back with the
    //      correct value of the "guest" CR3, so that the currently executing
    //      process continues to run with its expected address space mappings.
    //
 
    __vmx_vmread(VMCS_GUEST_CR3, &GuestCr3);
    __writecr3(GuestCr3);
 
    //
    // Read guest rsp and rip
    //
    __vmx_vmread(VMCS_GUEST_RIP, &GuestRIP);
    __vmx_vmread(VMCS_GUEST_RSP, &GuestRSP);
 
    //
    // Read instruction length
    //
    __vmx_vmread(VMCS_VMEXIT_INSTRUCTION_LENGTH, &ExitInstructionLength);
    GuestRIP += ExitInstructionLength;
 
    //
    // Set the previous register states
    //
    VCpu->VmxoffState.GuestRip = GuestRIP;
    VCpu->VmxoffState.GuestRsp = GuestRSP;
 
    //
    // Notify the Vmexit handler that VMX already turned off
    //
    VCpu->VmxoffState.IsVmxoffExecuted = TRUE;
 
    //
    // Restore the previous FS, GS , GDTR and IDTR register as patchguard might find the modified
    //
    HvRestoreRegisters();
 
    //
    // Before using vmxoff, you first need to use vmclear on any VMCSes that you want to be able to use again.
    // See sections 24.1 and 24.11 of the SDM.
    //
    VmxClearVmcsState(VCpu);
 
    //
    // Execute Vmxoff
    //
    __vmx_off();
 
    //
    // Indicate the current core is not currently virtualized
    //
    VCpu->HasLaunched = FALSE;
 
    //
    // Now that VMX is OFF, we have to unset vmx-enable bit on cr4
    //
    __writecr4(__readcr4() & (~X86_CR4_VMXE));
}