VmxRegions.c File Reference

Implement allocations for VMX Regions (VMXON Region, VMCS, MSR Bitmap and etc.). More...

#include "pch.h"

Functions
_Use_decl_annotations_ BOOLEAN	VmxAllocateVmxonRegion (VIRTUAL_MACHINE_STATE *VCpu)
	Allocates Vmxon region and set the Revision ID based on IA32_VMX_BASIC_MSR.
_Use_decl_annotations_ BOOLEAN	VmxAllocateVmcsRegion (VIRTUAL_MACHINE_STATE *VCpu)
	Allocate Vmcs region and set the Revision ID based on IA32_VMX_BASIC_MSR.
BOOLEAN	VmxAllocateVmmStack (_Inout_ VIRTUAL_MACHINE_STATE *VCpu)
	Allocate VMM Stack.
BOOLEAN	VmxAllocateMsrBitmap (_Inout_ VIRTUAL_MACHINE_STATE *VCpu)
	Allocate a buffer for Msr Bitmap.
BOOLEAN	VmxAllocateIoBitmaps (_Inout_ VIRTUAL_MACHINE_STATE *VCpu)
	Allocate a buffer for I/O Bitmap.
UINT64 *	VmxAllocateInvalidMsrBimap ()
	Allocates a buffer and tests for the MSRs that cause #GP.
BOOLEAN	VmxAllocateHostIdt (_Inout_ VIRTUAL_MACHINE_STATE *VCpu)
	Allocate a buffer for host IDT.
BOOLEAN	VmxAllocateHostGdt (_Inout_ VIRTUAL_MACHINE_STATE *VCpu)
	Allocate a buffer for host GDT.
BOOLEAN	VmxAllocateHostTss (_Inout_ VIRTUAL_MACHINE_STATE *VCpu)
	Allocate a buffer for host TSS.
BOOLEAN	VmxAllocateHostInterruptStack (_Inout_ VIRTUAL_MACHINE_STATE *VCpu)
	Allocate a buffer for host interrupt stack.

Detailed Description

Implement allocations for VMX Regions (VMXON Region, VMCS, MSR Bitmap and etc.).

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.1

Date

2020-04-11

Copyright

This project is released under the GNU Public License v3.

Function Documentation

VmxAllocateHostGdt()

BOOLEAN VmxAllocateHostGdt

(

_Inout_ VIRTUAL_MACHINE_STATE *

VCpu

)

Allocate a buffer for host GDT.

Parameters

VCpu

Returns

BOOLEAN Returns true if allocation was successful otherwise returns false

{
    UINT32 GdtSize = HOST_GDT_DESCRIPTOR_COUNT * sizeof(SEGMENT_DESCRIPTOR_64);
 
    //
    // Make sure the memory is aligned
    //
    if (PAGE_SIZE > GdtSize)
    {
        GdtSize = PAGE_SIZE;
    }
 
    //
    // Allocate aligned memory for host GDT
    //
    VCpu->HostGdt = (UINT64)PlatformMemAllocateZeroedNonPagedPool(GdtSize); // should be aligned
 
    if (VCpu->HostGdt == NULL64_ZERO)
    {
        LogError("Err, insufficient memory in allocating host GDT");
        return FALSE;
    }
 
    LogDebugInfo("Host GDT virtual address : 0x%llx", VCpu->HostGdt);
 
    return TRUE;
}

VmxAllocateHostIdt()

BOOLEAN VmxAllocateHostIdt

(

_Inout_ VIRTUAL_MACHINE_STATE *

VCpu

)

Allocate a buffer for host IDT.

Parameters

VCpu

Returns

BOOLEAN Returns true if allocation was successful otherwise returns false

{
    UINT32 IdtSize = HOST_IDT_DESCRIPTOR_COUNT * sizeof(SEGMENT_DESCRIPTOR_INTERRUPT_GATE_64);
 
    //
    // Make sure the memory is aligned
    //
    if (PAGE_SIZE > IdtSize)
    {
        IdtSize = PAGE_SIZE;
    }
 
    //
    // Allocate aligned memory for host IDT
    //
    VCpu->HostIdt = (UINT64)PlatformMemAllocateZeroedNonPagedPool(IdtSize); // should be aligned
 
    if (VCpu->HostIdt == NULL64_ZERO)
    {
        LogError("Err, insufficient memory in allocating host IDT");
        return FALSE;
    }
 
    LogDebugInfo("Host IDT virtual address : 0x%llx", VCpu->HostIdt);
 
    return TRUE;
}

VmxAllocateHostInterruptStack()

BOOLEAN VmxAllocateHostInterruptStack

(

_Inout_ VIRTUAL_MACHINE_STATE *

VCpu

)

Allocate a buffer for host interrupt stack.

Parameters

VCpu

Returns

BOOLEAN Returns true if allocation was successful otherwise returns false

{
    VCpu->HostInterruptStack = (UINT64)PlatformMemAllocateZeroedNonPagedPool(HOST_INTERRUPT_STACK_SIZE);
 
    if (VCpu->HostInterruptStack == NULL64_ZERO)
    {
        LogError("Err, insufficient memory in allocating host interrupt stack");
        return FALSE;
    }
 
    LogDebugInfo("Host interrupt stack virtual address : 0x%llx", VCpu->HostInterruptStack);
 
    return TRUE;
}

VmxAllocateHostTss()

BOOLEAN VmxAllocateHostTss

(

_Inout_ VIRTUAL_MACHINE_STATE *

VCpu

)

Allocate a buffer for host TSS.

Parameters

VCpu

Returns

BOOLEAN Returns true if allocation was successful otherwise returns false

{
    UINT32 TssSize = PAGE_SIZE; // Make sure the memory is aligned
 
    //
    // Allocate aligned memory for host TSS
    //
    VCpu->HostTss = (UINT64)PlatformMemAllocateZeroedNonPagedPool(TssSize); // should be aligned
 
    if (VCpu->HostTss == NULL64_ZERO)
    {
        LogError("Err, insufficient memory in allocating host TSS");
        return FALSE;
    }
 
    LogDebugInfo("Host TSS virtual address : 0x%llx", VCpu->HostTss);
 
    return TRUE;
}

VmxAllocateInvalidMsrBimap()

UINT64 * VmxAllocateInvalidMsrBimap

(

)

Allocates a buffer and tests for the MSRs that cause #GP.

Returns

UINT64 Allocated buffer for MSR Bitmap

{
    UINT64 * InvalidMsrBitmap;
 
    InvalidMsrBitmap = PlatformMemAllocateZeroedNonPagedPool(0x1000 / 0x8);
 
    if (InvalidMsrBitmap == NULL)
    {
        return NULL;
    }
 
    for (UINT32 i = 0; i < 0x1000; ++i)
    {
        __try
        {
            CpuReadMsr(i);
        }
        __except (EXCEPTION_EXECUTE_HANDLER)
        {
            SetBit(i, (ULONG *)InvalidMsrBitmap);
        }
    }
 
    return InvalidMsrBitmap;
}

VmxAllocateIoBitmaps()

BOOLEAN VmxAllocateIoBitmaps

(

_Inout_ VIRTUAL_MACHINE_STATE *

VCpu

)

Allocate a buffer for I/O Bitmap.

Parameters

VCpu

Returns

BOOLEAN Returns true if allocation was successful otherwise returns false

{
    //
    // Allocate memory for I/O Bitmap (A)
    //
    VCpu->IoBitmapVirtualAddressA = (UINT64)PlatformMemAllocateZeroedNonPagedPool(PAGE_SIZE); // should be aligned
 
    if (VCpu->IoBitmapVirtualAddressA == NULL64_ZERO)
    {
        LogError("Err, insufficient memory in allocating I/O Bitmaps A");
        return FALSE;
    }
 
    VCpu->IoBitmapPhysicalAddressA = VirtualAddressToPhysicalAddress((PVOID)VCpu->IoBitmapVirtualAddressA);
 
    LogDebugInfo("I/O Bitmap A Virtual Address  : 0x%llx", VCpu->IoBitmapVirtualAddressA);
    LogDebugInfo("I/O Bitmap A Physical Address : 0x%llx", VCpu->IoBitmapPhysicalAddressA);
 
    //
    // Allocate memory for I/O Bitmap (B)
    //
    VCpu->IoBitmapVirtualAddressB = (UINT64)PlatformMemAllocateZeroedNonPagedPool(PAGE_SIZE); // should be aligned
 
    if (VCpu->IoBitmapVirtualAddressB == NULL64_ZERO)
    {
        LogError("Err, insufficient memory in allocating I/O Bitmaps B");
        return FALSE;
    }
 
    VCpu->IoBitmapPhysicalAddressB = VirtualAddressToPhysicalAddress((PVOID)VCpu->IoBitmapVirtualAddressB);
 
    LogDebugInfo("I/O Bitmap B virtual address  : 0x%llx", VCpu->IoBitmapVirtualAddressB);
    LogDebugInfo("I/O Bitmap B physical address : 0x%llx", VCpu->IoBitmapPhysicalAddressB);
 
    return TRUE;
}

VmxAllocateMsrBitmap()

BOOLEAN VmxAllocateMsrBitmap

(

_Inout_ VIRTUAL_MACHINE_STATE *

VCpu

)

Allocate a buffer for Msr Bitmap.

Parameters

VCpu	The virtual processor's state

Returns

BOOLEAN Returns true if allocation was successful otherwise returns false

{
    //
    // Allocate memory for MSR Bitmap
    // Should be aligned
    //
    VCpu->MsrBitmapVirtualAddress = (UINT64)PlatformMemAllocateZeroedNonPagedPool(PAGE_SIZE);
 
    if (VCpu->MsrBitmapVirtualAddress == NULL64_ZERO)
    {
        LogError("Err, insufficient memory in allocating MSR Bitmaps");
        return FALSE;
    }
 
    VCpu->MsrBitmapPhysicalAddress = VirtualAddressToPhysicalAddress((PVOID)VCpu->MsrBitmapVirtualAddress);
 
    LogDebugInfo("MSR Bitmap virtual address  : 0x%llx", VCpu->MsrBitmapVirtualAddress);
    LogDebugInfo("MSR Bitmap physical address : 0x%llx", VCpu->MsrBitmapPhysicalAddress);
 
    return TRUE;
}

VmxAllocateVmcsRegion()

_Use_decl_annotations_ BOOLEAN VmxAllocateVmcsRegion

(

VIRTUAL_MACHINE_STATE *

VCpu

)

Allocate Vmcs region and set the Revision ID based on IA32_VMX_BASIC_MSR.

Parameters

CurrentGuestState

Returns

BOOLEAN Returns true if allocation was successful and vmptrld executed without error otherwise returns false

{
    IA32_VMX_BASIC_REGISTER VmxBasicMsr = {0};
    SIZE_T                  VmcsSize;
    UINT8 *                 VmcsRegion;
    UINT64                  VmcsPhysicalAddr;
    UINT64                  AlignedVmcsRegion;
    UINT64                  AlignedVmcsRegionPhysicalAddr;
 
#ifdef HYPERDBG_ENV_WINDOWS
    //
    // at IRQL > DISPATCH_LEVEL memory allocation routines don't work
    //
    if (KeGetCurrentIrql() > DISPATCH_LEVEL)
        KeRaiseIrqlToDpcLevel();
#endif // HYPERDBG_ENV_WINDOWS
 
    //
    // Allocating a 4-KByte Contiguous Memory region
    //
    VmcsSize   = 2 * VMCS_SIZE;
    VmcsRegion = PlatformMemAllocateContiguousZeroedMemory(VmcsSize + ALIGNMENT_PAGE_SIZE);
    if (VmcsRegion == NULL)
    {
        LogError("Err, couldn't allocate Buffer for VMCS region");
        return FALSE;
    }
 
    VmcsPhysicalAddr = VirtualAddressToPhysicalAddress(VmcsRegion);
 
    AlignedVmcsRegion = (UINT64)((ULONG_PTR)(VmcsRegion + ALIGNMENT_PAGE_SIZE - 1) & ~(ALIGNMENT_PAGE_SIZE - 1));
    LogDebugInfo("VMCS region address : %llx", AlignedVmcsRegion);
 
    AlignedVmcsRegionPhysicalAddr = (UINT64)((ULONG_PTR)(VmcsPhysicalAddr + ALIGNMENT_PAGE_SIZE - 1) & ~(ALIGNMENT_PAGE_SIZE - 1));
    LogDebugInfo("VMCS region physical address : %llx", AlignedVmcsRegionPhysicalAddr);
 
    //
    // get IA32_VMX_BASIC_MSR RevisionId
    //
    VmxBasicMsr.AsUInt = CpuReadMsr(IA32_VMX_BASIC);
    LogDebugInfo("Revision Identifier (IA32_VMX_BASIC - MSR 0x480) : 0x%x", VmxBasicMsr.VmcsRevisionId);
 
    //
    // Changing Revision Identifier
    //
    *(UINT64 *)AlignedVmcsRegion = VmxBasicMsr.VmcsRevisionId;
 
    VCpu->VmcsRegionPhysicalAddress = AlignedVmcsRegionPhysicalAddr;
    //
    // We save the allocated buffer (not the aligned buffer)
    // because we want to free it in vmx termination
    //
    VCpu->VmcsRegionVirtualAddress = (UINT64)VmcsRegion;
 
    return TRUE;
}

VmxAllocateVmmStack()

BOOLEAN VmxAllocateVmmStack

(

_Inout_ VIRTUAL_MACHINE_STATE *

VCpu

)

Allocate VMM Stack.

Parameters

VCpu	The virtual processor's state

Returns

BOOLEAN Returns true if allocation was successful otherwise returns false

{
    //
    // Allocate stack for the VM Exit Handler
    //
    VCpu->VmmStack = (UINT64)PlatformMemAllocateZeroedNonPagedPool(VMM_STACK_SIZE);
 
    if (VCpu->VmmStack == NULL64_ZERO)
    {
        LogError("Err, insufficient memory in allocating vmm stack");
        return FALSE;
    }
 
    LogDebugInfo("VMM Stack for logical processor : 0x%llx", VCpu->VmmStack);
 
    return TRUE;
}

VmxAllocateVmxonRegion()

_Use_decl_annotations_ BOOLEAN VmxAllocateVmxonRegion

(

VIRTUAL_MACHINE_STATE *

VCpu

)

Allocates Vmxon region and set the Revision ID based on IA32_VMX_BASIC_MSR.

Parameters

CurrentGuestState

Returns

BOOLEAN Returns true if allocation was successful and vmxon executed without error otherwise returns false

{
    IA32_VMX_BASIC_REGISTER VmxBasicMsr = {0};
    SIZE_T                  VmxonSize;
    UINT8                   VmxonStatus;
    UINT8 *                 VmxonRegion;
    UINT64                  VmxonRegionPhysicalAddr;
    UINT64                  AlignedVmxonRegion;
    UINT64                  AlignedVmxonRegionPhysicalAddr;
 
#ifdef HYPERDBG_ENV_WINDOWS
    //
    // at IRQL > DISPATCH_LEVEL memory allocation routines don't work
    //
    if (KeGetCurrentIrql() > DISPATCH_LEVEL)
        KeRaiseIrqlToDpcLevel();
#endif // HYPERDBG_ENV_WINDOWS
 
    //
    // Allocating a 4-KByte Contiguous Memory region
    //
    VmxonSize   = 2 * VMXON_SIZE;
    VmxonRegion = PlatformMemAllocateContiguousZeroedMemory(VmxonSize + ALIGNMENT_PAGE_SIZE);
    if (VmxonRegion == NULL)
    {
        LogError("Err, couldn't allocate buffer for VMXON region");
        return FALSE;
    }
 
    VmxonRegionPhysicalAddr = VirtualAddressToPhysicalAddress(VmxonRegion);
 
    AlignedVmxonRegion = (UINT64)((ULONG_PTR)(VmxonRegion + ALIGNMENT_PAGE_SIZE - 1) & ~(ALIGNMENT_PAGE_SIZE - 1));
    LogDebugInfo("VMXON Region Address : %llx", AlignedVmxonRegion);
 
    //
    // 4 kb >= buffers are aligned, just a double check to ensure if it's aligned
    //
    AlignedVmxonRegionPhysicalAddr = (UINT64)((ULONG_PTR)(VmxonRegionPhysicalAddr + ALIGNMENT_PAGE_SIZE - 1) & ~(ALIGNMENT_PAGE_SIZE - 1));
    LogDebugInfo("VMXON Region Physical Address : %llx", AlignedVmxonRegionPhysicalAddr);
 
    //
    // get IA32_VMX_BASIC_MSR RevisionId
    //
    VmxBasicMsr.AsUInt = CpuReadMsr(IA32_VMX_BASIC);
    LogDebugInfo("Revision Identifier (IA32_VMX_BASIC - MSR 0x480) : 0x%x", VmxBasicMsr.VmcsRevisionId);
 
    //
    // Changing Revision Identifier
    //
    *(UINT64 *)AlignedVmxonRegion = VmxBasicMsr.VmcsRevisionId;
 
    //
    // Execute Vmxon instruction
    //
    VmxonStatus = VmxVmxon(&AlignedVmxonRegionPhysicalAddr);
 
    if (VmxonStatus)
    {
        LogError("Err, executing vmxon instruction failed with status : %d", VmxonStatus);
        return FALSE;
    }
 
    VCpu->VmxonRegionPhysicalAddress = AlignedVmxonRegionPhysicalAddr;
 
    //
    // We save the allocated buffer (not the aligned buffer) because we want to free it in vmx termination
    //
    VCpu->VmxonRegionVirtualAddress = (UINT64)VmxonRegion;
 
    return TRUE;
}