HyperDbg Debugger
Loading...
Searching...
No Matches
DpcRoutines.h File Reference

headers of all the dpc routines which relates to executing on a single core More...

Go to the source code of this file.

Functions

NTSTATUS DpcRoutineRunTaskOnSingleCore (UINT32 CoreNumber, PVOID Routine, PVOID DeferredContext)
 This function synchronize the function execution for a single core You should only used it for one core, not in multiple threads simultaneously The function that needs to use this feature (Routine parameter function) should have the when it ends :
BOOLEAN DpcRoutinePerformVirtualization (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 Broadcast VmxPerformVirtualizationOnSpecificCore.
VOID DpcRoutinePerformChangeMsrBitmapReadOnSingleCore (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 change msr bitmap read on a single core
VOID DpcRoutinePerformChangeMsrBitmapWriteOnSingleCore (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 change msr bitmap write on a single core
VOID DpcRoutinePerformEnableRdtscExitingOnSingleCore (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 set rdtsc/rdtscp exiting
VOID DpcRoutinePerformEnableRdpmcExitingOnSingleCore (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 set rdpmc exiting
VOID DpcRoutinePerformSetExceptionBitmapOnSingleCore (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 change exception bitmap on a single core
VOID DpcRoutinePerformEnableMovToDebugRegistersExiting (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 Set the Mov to Debug Registers Exitings.
VOID DpcRoutinePerformSetExternalInterruptExitingOnSingleCore (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 Enable external interrupt exiting on a single core.
VOID DpcRoutinePerformEnableEferSyscallHookOnSingleCore (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 Enable syscall hook EFER on a single core.
VOID DpcRoutinePerformChangeIoBitmapOnSingleCore (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 change I/O bitmap on a single core
VOID DpcRoutinePerformEnableMovToControlRegisterExiting (KDPC *Dpc, DEBUGGER_EVENT_OPTIONS *EventOptions, PVOID SystemArgument1, PVOID SystemArgument2)
 Set the Mov to Control Registers Exitings.
VOID DpcRoutineEnableMovControlRegisterExitingAllCores (KDPC *Dpc, DEBUGGER_EVENT_OPTIONS *EventOptions, PVOID SystemArgument1, PVOID SystemArgument2)
 Enables mov control registers exitings.
VOID DpcRoutineDisableMovControlRegisterExitingAllCores (KDPC *Dpc, DEBUGGER_EVENT_OPTIONS *EventOptions, PVOID SystemArgument1, PVOID SystemArgument2)
 Disables mov control registers exitings.
VOID DpcRoutineEnableMovToCr3Exiting (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 Broadcast to enable mov-to-cr3 exitings.
VOID DpcRoutineChangeToMbecSupportedEptp (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 Broadcast to change to MBEC supported EPTP.
VOID DpcRoutineRestoreToNormalEptp (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 Broadcast to restore to normal EPTP.
VOID DpcRoutineEnableOrDisableMbec (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 Broadcast to enable or disable MBEC.
VOID DpcRoutineDisableMovToCr3Exiting (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 Broadcast to disable mov-to-cr3 exitings.
VOID DpcRoutineEnableEferSyscallEvents (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 Broadcast syscall hook to all cores.
VOID DpcRoutineDisableEferSyscallEvents (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 Broadcast syscall unhook to all cores.
VOID DpcRoutineDisablePml (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 Broadcast disable PML on all cores.
VOID DpcRoutineEnablePml (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 Broadcast enable PML on all cores.
VOID DpcRoutineChangeMsrBitmapReadOnAllCores (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 Disable Msr Bitmaps on all cores (vm-exit on all msrs).
VOID DpcRoutineResetMsrBitmapReadOnAllCores (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 Reset Msr Bitmaps on all cores (vm-exit on all msrs).
VOID DpcRoutineChangeMsrBitmapWriteOnAllCores (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 Disable Msr Bitmaps on all cores (vm-exit on all msrs).
VOID DpcRoutineResetMsrBitmapWriteOnAllCores (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 Reset Msr Bitmaps on all cores (vm-exit on all msrs).
VOID DpcRoutineEnableRdtscExitingAllCores (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 Enables rdtsc/rdtscp exiting in primary cpu-based controls.
VOID DpcRoutineDisableRdtscExitingAllCores (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 Disables rdtsc/rdtscp exiting in primary cpu-based controls.
VOID DpcRoutineDisableRdtscExitingForClearingTscEventsAllCores (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 Disables rdtsc/rdtscp exiting in primary cpu-based controls ONLY for clearing !tsc events.
VOID DpcRoutineDisableMov2DrExitingForClearingDrEventsAllCores (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 Disables mov to debug registers exiting ONLY for clearing !dr events.
VOID DpcRoutineDisableMov2CrExitingForClearingCrEventsAllCores (KDPC *Dpc, DEBUGGER_EVENT_OPTIONS *EventOptions, PVOID SystemArgument1, PVOID SystemArgument2)
 Disables mov to control registers exiting ONLY for clearing !crwrite events.
VOID DpcRoutineEnableRdpmcExitingAllCores (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 Enables rdpmc exiting in primary cpu-based controls.
VOID DpcRoutineDisableRdpmcExitingAllCores (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 Disable rdpmc exiting in primary cpu-based controls.
VOID DpcRoutineSetExceptionBitmapOnAllCores (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 Enable Exception Bitmaps on all cores.
VOID DpcRoutineUnsetExceptionBitmapOnAllCores (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 Disable Exception Bitmaps on all cores.
VOID DpcRoutineResetExceptionBitmapOnlyOnClearingExceptionEventsOnAllCores (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 Reset Exception Bitmaps on all cores.
VOID DpcRoutineEnableMovDebigRegisterExitingAllCores (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 Enables mov debug registers exitings.
VOID DpcRoutineDisableMovDebigRegisterExitingAllCores (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 Disables mov debug registers exitings.
VOID DpcRoutineSetEnableExternalInterruptExitingOnAllCores (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 Enable vm-exit on all cores for external interrupts.
VOID DpcRoutineSetDisableExternalInterruptExitingOnlyOnClearingInterruptEventsOnAllCores (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 Disable vm-exit on all cores for external interrupts only for clearing !interrupt events.
VOID DpcRoutineChangeIoBitmapOnAllCores (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 Change I/O Bitmaps on all cores.
VOID DpcRoutineResetIoBitmapOnAllCores (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 Reset I/O Bitmaps on all cores.
VOID DpcRoutineEnableBreakpointOnExceptionBitmapOnAllCores (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 Enable breakpoint exiting on exception bitmaps on all cores.
VOID DpcRoutineDisableBreakpointOnExceptionBitmapOnAllCores (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 Disable breakpoint exiting on exception bitmaps on all cores.
VOID DpcRoutineEnableNmiVmexitOnAllCores (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 Enable vm-exit on NMIs on all cores.
VOID DpcRoutineDisableNmiVmexitOnAllCores (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 Disable vm-exit on NMIs on all cores.
VOID DpcRoutineEnableDbAndBpExitingOnAllCores (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 Enable vm-exit on #DBs and #BPs on all cores.
VOID DpcRoutineDisableDbAndBpExitingOnAllCores (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 Disable vm-exit on #DBs and #BPs on all cores.
VOID DpcRoutineRemoveHookAndInvalidateSingleEntryOnAllCores (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 The broadcast function which removes the single hook and invalidate TLB.
VOID DpcRoutineRemoveHookAndInvalidateAllEntriesOnAllCores (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 The broadcast function which removes all the hooks and invalidate TLB.
VOID DpcRoutineInvalidateEptOnAllCores (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 The broadcast function which invalidate EPT using Vmcall.
VOID DpcRoutineInitializeGuest (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 The broadcast function which initialize the guest.
VOID DpcRoutineTerminateGuest (KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
 The broadcast function which terminate the guest.

Detailed Description

headers of all the dpc routines which relates to executing on a single core

Author
Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)
Version
0.1
Date
2020-04-29
Copyright
This project is released under the GNU Public License v3.

Function Documentation

◆ DpcRoutineChangeIoBitmapOnAllCores()

VOID DpcRoutineChangeIoBitmapOnAllCores ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

Change I/O Bitmaps on all cores.

Parameters
Dpc
DeferredContextI/O Port index
SystemArgument1
SystemArgument2
Returns
VOID
1201{
1202 UNREFERENCED_PARAMETER(Dpc);
1203
1204 //
1205 // Change I/O Bitmaps on all cores
1206 //
1207 AsmVmxVmcall(VMCALL_CHANGE_IO_BITMAP, (UINT64)DeferredContext, 0, 0);
1208
1209 // ------------------------------------------------------------------------------
1210 // Synchronize the end of this routine with the caller
1211 //
1212 PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
1213}
AsmVmxVmcall
NTSTATUS AsmVmxVmcall(UINT64 VmcallNumber, UINT64 OptionalParam1, UINT64 OptionalParam2, UINT64 OptionalParam3)
Request Vmcall.
PlatformBroadcastSynchronizeEndOfRoutine
VOID PlatformBroadcastSynchronizeEndOfRoutine(PVOID SystemArgument1, PVOID SystemArgument2)
This function synchronize the function execution for a single core.
Definition PlatformBroadcast.c:24
VMCALL_CHANGE_IO_BITMAP
#define VMCALL_CHANGE_IO_BITMAP
VMCALL to change I/O Bitmaps (A & B).
Definition Vmcall.h:118

◆ DpcRoutineChangeMsrBitmapReadOnAllCores()

VOID DpcRoutineChangeMsrBitmapReadOnAllCores ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

Disable Msr Bitmaps on all cores (vm-exit on all msrs).

Parameters
Dpc
DeferredContext
SystemArgument1
SystemArgument2
Returns
VOID
677{
678 UNREFERENCED_PARAMETER(Dpc);
679
680 //
681 // Disable msr bitmaps from vmx-root
682 //
683 AsmVmxVmcall(VMCALL_CHANGE_MSR_BITMAP_READ, (UINT64)DeferredContext, 0, 0);
684
685 // ------------------------------------------------------------------------------
686 // Synchronize the end of this routine with the caller
687 //
688 PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
689}
VMCALL_CHANGE_MSR_BITMAP_READ
#define VMCALL_CHANGE_MSR_BITMAP_READ
VMCALL to change MSR Bitmap Read.
Definition Vmcall.h:76

◆ DpcRoutineChangeMsrBitmapWriteOnAllCores()

VOID DpcRoutineChangeMsrBitmapWriteOnAllCores ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

Disable Msr Bitmaps on all cores (vm-exit on all msrs).

Parameters
Dpc
DeferredContextMsr index to be masked on msr bitmap
SystemArgument1
SystemArgument2
Returns
VOID
728{
729 UNREFERENCED_PARAMETER(Dpc);
730
731 //
732 // Disable msr bitmaps from vmx-root
733 //
734 AsmVmxVmcall(VMCALL_CHANGE_MSR_BITMAP_WRITE, (UINT64)DeferredContext, 0, 0);
735
736 // ------------------------------------------------------------------------------
737 // Synchronize the end of this routine with the caller
738 //
739 PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
740}
VMCALL_CHANGE_MSR_BITMAP_WRITE
#define VMCALL_CHANGE_MSR_BITMAP_WRITE
VMCALL to change MSR Bitmap Write.
Definition Vmcall.h:82

◆ DpcRoutineChangeToMbecSupportedEptp()

VOID DpcRoutineChangeToMbecSupportedEptp ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

Broadcast to change to MBEC supported EPTP.

Parameters
Dpc
DeferredContext
SystemArgument1
SystemArgument2
Returns
VOID
469{
470 UNREFERENCED_PARAMETER(Dpc);
471 UNREFERENCED_PARAMETER(DeferredContext);
472
473 //
474 // Change to a MBEC supported EPTP from vmx-root
475 //
476 AsmVmxVmcall(VMCALL_CHANGE_TO_MBEC_SUPPORTED_EPTP, 0, 0, 0);
477
478 // ------------------------------------------------------------------------------
479 // Synchronize the end of this routine with the caller
480 //
481 PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
482}
VMCALL_CHANGE_TO_MBEC_SUPPORTED_EPTP
#define VMCALL_CHANGE_TO_MBEC_SUPPORTED_EPTP
VMCALL to change EPTP to an MBEC-supported EPTP.
Definition Vmcall.h:285

◆ DpcRoutineDisableBreakpointOnExceptionBitmapOnAllCores()

VOID DpcRoutineDisableBreakpointOnExceptionBitmapOnAllCores ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

Disable breakpoint exiting on exception bitmaps on all cores.

Parameters
Dpc
DeferredContext
SystemArgument1
SystemArgument2
Returns
VOID
1278{
1279 UNREFERENCED_PARAMETER(Dpc);
1280 UNREFERENCED_PARAMETER(DeferredContext);
1281
1282 //
1283 // Change exception bitmap
1284 //
1285 AsmVmxVmcall(VMCALL_UNSET_EXCEPTION_BITMAP, EXCEPTION_VECTOR_BREAKPOINT, 0, 0);
1286
1287 // ------------------------------------------------------------------------------
1288 // Synchronize the end of this routine with the caller
1289 //
1290 PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
1291}
VMCALL_UNSET_EXCEPTION_BITMAP
#define VMCALL_UNSET_EXCEPTION_BITMAP
VMCALL to unset exception bitmap on VMCS.
Definition Vmcall.h:191
EXCEPTION_VECTOR_BREAKPOINT
@ EXCEPTION_VECTOR_BREAKPOINT
Definition Events.h:27

◆ DpcRoutineDisableDbAndBpExitingOnAllCores()

VOID DpcRoutineDisableDbAndBpExitingOnAllCores ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

Disable vm-exit on #DBs and #BPs on all cores.

Parameters
Dpc
DeferredContext
SystemArgument1
SystemArgument2
Returns
VOID
1387{
1388 UNREFERENCED_PARAMETER(Dpc);
1389 UNREFERENCED_PARAMETER(DeferredContext);
1390
1391 //
1392 // Cause no vm-exit on #BPs
1393 //
1394 AsmVmxVmcall(VMCALL_UNSET_EXCEPTION_BITMAP, EXCEPTION_VECTOR_BREAKPOINT, 0, 0);
1395
1396 //
1397 // Cause no vm-exit on #DBs
1398 //
1399 AsmVmxVmcall(VMCALL_UNSET_EXCEPTION_BITMAP, EXCEPTION_VECTOR_DEBUG_BREAKPOINT, 0, 0);
1400
1401 // ------------------------------------------------------------------------------
1402 // Synchronize the end of this routine with the caller
1403 //
1404 PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
1405}
EXCEPTION_VECTOR_DEBUG_BREAKPOINT
@ EXCEPTION_VECTOR_DEBUG_BREAKPOINT
Definition Events.h:25

◆ DpcRoutineDisableEferSyscallEvents()

VOID DpcRoutineDisableEferSyscallEvents ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

Broadcast syscall unhook to all cores.

Parameters
Dpc
DeferredContext
SystemArgument1
SystemArgument2
Returns
VOID
599{
600 UNREFERENCED_PARAMETER(Dpc);
601 UNREFERENCED_PARAMETER(DeferredContext);
602
603 //
604 // Disable Syscall hook from vmx-root
605 //
606 AsmVmxVmcall(VMCALL_DISABLE_SYSCALL_HOOK_EFER, 0, 0, 0);
607
608 // ------------------------------------------------------------------------------
609 // Synchronize the end of this routine with the caller
610 //
611 PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
612}
VMCALL_DISABLE_SYSCALL_HOOK_EFER
#define VMCALL_DISABLE_SYSCALL_HOOK_EFER
VMCALL to disable syscall hook using EFER SCE bit.
Definition Vmcall.h:70

◆ DpcRoutineDisableMov2CrExitingForClearingCrEventsAllCores()

VOID DpcRoutineDisableMov2CrExitingForClearingCrEventsAllCores ( KDPC * Dpc,
DEBUGGER_EVENT_OPTIONS * EventOptions,
PVOID SystemArgument1,
PVOID SystemArgument2 )

Disables mov to control registers exiting ONLY for clearing !crwrite events.

Parameters
Dpc
Event
SystemArgument1
SystemArgument2
Returns
VOID
887{
888 UNREFERENCED_PARAMETER(Dpc);
889
890 //
891 // Disables mov 2 control regs exiting ONLY for clearing events
892 //
893 AsmVmxVmcall(VMCALL_DISABLE_MOV_TO_CR_EXITING_ONLY_FOR_CR_EVENTS, EventOptions->OptionalParam1, EventOptions->OptionalParam2, 0);
894
895 // ------------------------------------------------------------------------------
896 // Synchronize the end of this routine with the caller
897 //
898 PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
899}
VMCALL_DISABLE_MOV_TO_CR_EXITING_ONLY_FOR_CR_EVENTS
#define VMCALL_DISABLE_MOV_TO_CR_EXITING_ONLY_FOR_CR_EVENTS
VMCALL to clear mov 2 cr exiting bit ONLY in the case of disabling the events for !...
Definition Vmcall.h:267
_DEBUGGER_EVENT_OPTIONS::OptionalParam2
UINT64 OptionalParam2
Definition Events.h:278
_DEBUGGER_EVENT_OPTIONS::OptionalParam1
UINT64 OptionalParam1
Definition Events.h:277

◆ DpcRoutineDisableMov2DrExitingForClearingDrEventsAllCores()

VOID DpcRoutineDisableMov2DrExitingForClearingDrEventsAllCores ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

Disables mov to debug registers exiting ONLY for clearing !dr events.

Parameters
Dpc
DeferredContext
SystemArgument1
SystemArgument2
Returns
VOID
860{
861 UNREFERENCED_PARAMETER(Dpc);
862 UNREFERENCED_PARAMETER(DeferredContext);
863
864 //
865 // Disables mov 2 hw debug regs exiting ONLY for clearing events
866 //
867 AsmVmxVmcall(VMCALL_DISABLE_MOV_TO_HW_DR_EXITING_ONLY_FOR_DR_EVENTS, 0, 0, 0);
868
869 // ------------------------------------------------------------------------------
870 // Synchronize the end of this routine with the caller
871 //
872 PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
873}
VMCALL_DISABLE_MOV_TO_HW_DR_EXITING_ONLY_FOR_DR_EVENTS
#define VMCALL_DISABLE_MOV_TO_HW_DR_EXITING_ONLY_FOR_DR_EVENTS
VMCALL to clear mov 2 hw dr exiting bit ONLY in the case of disabling the events for !...
Definition Vmcall.h:249

◆ DpcRoutineDisableMovControlRegisterExitingAllCores()

VOID DpcRoutineDisableMovControlRegisterExitingAllCores ( KDPC * Dpc,
DEBUGGER_EVENT_OPTIONS * EventOptions,
PVOID SystemArgument1,
PVOID SystemArgument2 )

Disables mov control registers exitings.

Parameters
Dpc
Event
SystemArgument1
SystemArgument2
Returns
VOID
1095{
1096 UNREFERENCED_PARAMETER(Dpc);
1097
1098 //
1099 // Disable mov control registers exitings in primary cpu-based controls
1100 //
1101 AsmVmxVmcall(VMCALL_DISABLE_MOV_TO_CONTROL_REGS_EXITING, EventOptions->OptionalParam1, EventOptions->OptionalParam2, 0);
1102
1103 // ------------------------------------------------------------------------------
1104 // Synchronize the end of this routine with the caller
1105 //
1106 PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
1107}
VMCALL_DISABLE_MOV_TO_CONTROL_REGS_EXITING
#define VMCALL_DISABLE_MOV_TO_CONTROL_REGS_EXITING
VMCALL to disable mov to CR exiting.
Definition Vmcall.h:260

◆ DpcRoutineDisableMovDebigRegisterExitingAllCores()

VOID DpcRoutineDisableMovDebigRegisterExitingAllCores ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

Disables mov debug registers exitings.

Parameters
Dpc
DeferredContext
SystemArgument1
SystemArgument2
Returns
VOID
1120{
1121 UNREFERENCED_PARAMETER(Dpc);
1122 UNREFERENCED_PARAMETER(DeferredContext);
1123
1124 //
1125 // Disable mov debug registers exitings in primary cpu-based controls
1126 //
1127 AsmVmxVmcall(VMCALL_DISABLE_MOV_TO_DEBUG_REGS_EXITING, 0, 0, 0);
1128
1129 // ------------------------------------------------------------------------------
1130 // Synchronize the end of this routine with the caller
1131 //
1132 PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
1133}
VMCALL_DISABLE_MOV_TO_DEBUG_REGS_EXITING
#define VMCALL_DISABLE_MOV_TO_DEBUG_REGS_EXITING
VMCALL to disable mov to debug registers exiting.
Definition Vmcall.h:148

◆ DpcRoutineDisableMovToCr3Exiting()

VOID DpcRoutineDisableMovToCr3Exiting ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

Broadcast to disable mov-to-cr3 exitings.

Parameters
Dpc
DeferredContext
SystemArgument1
SystemArgument2
Returns
VOID
547{
548 UNREFERENCED_PARAMETER(Dpc);
549 UNREFERENCED_PARAMETER(DeferredContext);
550
551 //
552 // Disable mov-to-cr3 exiting from vmx-root
553 //
554 AsmVmxVmcall(VMCALL_DISABLE_MOV_TO_CR3_EXITING, 0, 0, 0);
555
556 // ------------------------------------------------------------------------------
557 // Synchronize the end of this routine with the caller
558 //
559 PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
560}
VMCALL_DISABLE_MOV_TO_CR3_EXITING
#define VMCALL_DISABLE_MOV_TO_CR3_EXITING
VMCALL to disable cr3 exiting.
Definition Vmcall.h:185

◆ DpcRoutineDisableNmiVmexitOnAllCores()

VOID DpcRoutineDisableNmiVmexitOnAllCores ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

Disable vm-exit on NMIs on all cores.

Parameters
Dpc
DeferredContext
SystemArgument1
SystemArgument2
Returns
VOID
1330{
1331 UNREFERENCED_PARAMETER(Dpc);
1332 UNREFERENCED_PARAMETER(DeferredContext);
1333
1334 //
1335 // Cause no vm-exit on NMIs
1336 //
1337 AsmVmxVmcall(VMCALL_UNSET_VM_EXIT_ON_NMIS, NULL64_ZERO, 0, 0);
1338
1339 // ------------------------------------------------------------------------------
1340 // Synchronize the end of this routine with the caller
1341 //
1342 PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
1343}
VMCALL_UNSET_VM_EXIT_ON_NMIS
#define VMCALL_UNSET_VM_EXIT_ON_NMIS
VMCALL to not cause vm-exit on NMIs.
Definition Vmcall.h:235
NULL64_ZERO
#define NULL64_ZERO
Definition BasicTypes.h:111

◆ DpcRoutineDisablePml()

VOID DpcRoutineDisablePml ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

Broadcast disable PML on all cores.

Parameters
Dpc
DeferredContext
SystemArgument1
SystemArgument2
Returns
VOID
651{
652 UNREFERENCED_PARAMETER(Dpc);
653 UNREFERENCED_PARAMETER(DeferredContext);
654
655 //
656 // Disable PML from vmx-root
657 //
658 AsmVmxVmcall(VMCALL_DISABLE_DIRTY_LOGGING_MECHANISM, 0, 0, 0);
659
660 // ------------------------------------------------------------------------------
661 // Synchronize the end of this routine with the caller
662 //
663 PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
664}
VMCALL_DISABLE_DIRTY_LOGGING_MECHANISM
#define VMCALL_DISABLE_DIRTY_LOGGING_MECHANISM
VMCALL to disable dirty logging (PML) mechanism.
Definition Vmcall.h:279

◆ DpcRoutineDisableRdpmcExitingAllCores()

VOID DpcRoutineDisableRdpmcExitingAllCores ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

Disable rdpmc exiting in primary cpu-based controls.

Parameters
Dpc
DeferredContext
SystemArgument1
SystemArgument2
Returns
VOID
938{
939 UNREFERENCED_PARAMETER(Dpc);
940 UNREFERENCED_PARAMETER(DeferredContext);
941
942 //
943 // Disable rdpmc exiting in primary cpu-based controls
944 //
945 AsmVmxVmcall(VMCALL_UNSET_RDPMC_EXITING, 0, 0, 0);
946
947 // ------------------------------------------------------------------------------
948 // Synchronize the end of this routine with the caller
949 //
950 PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
951}
VMCALL_UNSET_RDPMC_EXITING
#define VMCALL_UNSET_RDPMC_EXITING
VMCALL to disable rdpmc exiting in primary cpu-based controls.
Definition Vmcall.h:142

◆ DpcRoutineDisableRdtscExitingAllCores()

VOID DpcRoutineDisableRdtscExitingAllCores ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

Disables rdtsc/rdtscp exiting in primary cpu-based controls.

Parameters
Dpc
DeferredContext
SystemArgument1
SystemArgument2
Returns
VOID
805{
806 UNREFERENCED_PARAMETER(Dpc);
807 UNREFERENCED_PARAMETER(DeferredContext);
808
809 //
810 // Disables rdtsc/rdtscp exiting in primary cpu-based controls
811 //
812 AsmVmxVmcall(VMCALL_UNSET_RDTSC_EXITING, 0, 0, 0);
813
814 // ------------------------------------------------------------------------------
815 // Synchronize the end of this routine with the caller
816 //
817 PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
818}
VMCALL_UNSET_RDTSC_EXITING
#define VMCALL_UNSET_RDTSC_EXITING
VMCALL to disable rdtsc/rdtscp exiting in primary cpu-based controls.
Definition Vmcall.h:130

◆ DpcRoutineDisableRdtscExitingForClearingTscEventsAllCores()

VOID DpcRoutineDisableRdtscExitingForClearingTscEventsAllCores ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

Disables rdtsc/rdtscp exiting in primary cpu-based controls ONLY for clearing !tsc events.

Parameters
Dpc
DeferredContext
SystemArgument1
SystemArgument2
Returns
VOID
832{
833 UNREFERENCED_PARAMETER(Dpc);
834 UNREFERENCED_PARAMETER(DeferredContext);
835
836 //
837 // Disables rdtsc/rdtscp exiting in primary cpu-based controls
838 // ONLY for clearing events
839 //
840 AsmVmxVmcall(VMCALL_DISABLE_RDTSC_EXITING_ONLY_FOR_TSC_EVENTS, 0, 0, 0);
841
842 // ------------------------------------------------------------------------------
843 // Synchronize the end of this routine with the caller
844 //
845 PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
846}
VMCALL_DISABLE_RDTSC_EXITING_ONLY_FOR_TSC_EVENTS
#define VMCALL_DISABLE_RDTSC_EXITING_ONLY_FOR_TSC_EVENTS
VMCALL to clear rdtsc exiting bit ONLY in the case of disabling the events for !tsc command.
Definition Vmcall.h:242

◆ DpcRoutineEnableBreakpointOnExceptionBitmapOnAllCores()

VOID DpcRoutineEnableBreakpointOnExceptionBitmapOnAllCores ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

Enable breakpoint exiting on exception bitmaps on all cores.

Parameters
Dpc
DeferredContext
SystemArgument1
SystemArgument2
Returns
VOID
1252{
1253 UNREFERENCED_PARAMETER(Dpc);
1254 UNREFERENCED_PARAMETER(DeferredContext);
1255
1256 //
1257 // Change exception bitmap's #BP bit
1258 //
1259 AsmVmxVmcall(VMCALL_SET_EXCEPTION_BITMAP, EXCEPTION_VECTOR_BREAKPOINT, 0, 0);
1260
1261 // ------------------------------------------------------------------------------
1262 // Synchronize the end of this routine with the caller
1263 //
1264 PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
1265}
VMCALL_SET_EXCEPTION_BITMAP
#define VMCALL_SET_EXCEPTION_BITMAP
VMCALL to set exception bitmap on VMCS.
Definition Vmcall.h:100

◆ DpcRoutineEnableDbAndBpExitingOnAllCores()

VOID DpcRoutineEnableDbAndBpExitingOnAllCores ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

Enable vm-exit on #DBs and #BPs on all cores.

Parameters
Dpc
DeferredContext
SystemArgument1
SystemArgument2
Returns
VOID
1356{
1357 UNREFERENCED_PARAMETER(Dpc);
1358 UNREFERENCED_PARAMETER(DeferredContext);
1359
1360 //
1361 // Cause vm-exit on #BPs
1362 //
1363 AsmVmxVmcall(VMCALL_SET_EXCEPTION_BITMAP, EXCEPTION_VECTOR_BREAKPOINT, 0, 0);
1364
1365 //
1366 // Cause vm-exit on #DBs
1367 //
1368 AsmVmxVmcall(VMCALL_SET_EXCEPTION_BITMAP, EXCEPTION_VECTOR_DEBUG_BREAKPOINT, 0, 0);
1369
1370 // ------------------------------------------------------------------------------
1371 // Synchronize the end of this routine with the caller
1372 //
1373 PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
1374}

◆ DpcRoutineEnableEferSyscallEvents()

VOID DpcRoutineEnableEferSyscallEvents ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

Broadcast syscall hook to all cores.

Parameters
Dpc
DeferredContext
SystemArgument1
SystemArgument2
Returns
VOID
573{
574 UNREFERENCED_PARAMETER(Dpc);
575 UNREFERENCED_PARAMETER(DeferredContext);
576
577 //
578 // Enable Syscall hook from vmx-root
579 //
580 AsmVmxVmcall(VMCALL_ENABLE_SYSCALL_HOOK_EFER, 0, 0, 0);
581
582 // ------------------------------------------------------------------------------
583 // Synchronize the end of this routine with the caller
584 //
585 PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
586}
VMCALL_ENABLE_SYSCALL_HOOK_EFER
#define VMCALL_ENABLE_SYSCALL_HOOK_EFER
VMCALL to enable syscall hook using EFER SCE bit.
Definition Vmcall.h:64

◆ DpcRoutineEnableMovControlRegisterExitingAllCores()

VOID DpcRoutineEnableMovControlRegisterExitingAllCores ( KDPC * Dpc,
DEBUGGER_EVENT_OPTIONS * EventOptions,
PVOID SystemArgument1,
PVOID SystemArgument2 )

Enables mov control registers exitings.

Parameters
Dpc
Event
SystemArgument1
SystemArgument2
Returns
VOID
1070{
1071 UNREFERENCED_PARAMETER(Dpc);
1072
1073 //
1074 // Enables mov control registers exitings in primary cpu-based controls
1075 //
1076 AsmVmxVmcall(VMCALL_ENABLE_MOV_TO_CONTROL_REGS_EXITING, EventOptions->OptionalParam1, EventOptions->OptionalParam2, 0);
1077
1078 // ------------------------------------------------------------------------------
1079 // Synchronize the end of this routine with the caller
1080 //
1081 PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
1082}
VMCALL_ENABLE_MOV_TO_CONTROL_REGS_EXITING
#define VMCALL_ENABLE_MOV_TO_CONTROL_REGS_EXITING
VMCALL to enable mov to CR exiting.
Definition Vmcall.h:254

◆ DpcRoutineEnableMovDebigRegisterExitingAllCores()

VOID DpcRoutineEnableMovDebigRegisterExitingAllCores ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

Enables mov debug registers exitings.

Parameters
Dpc
DeferredContext
SystemArgument1
SystemArgument2
Returns
VOID
1044{
1045 UNREFERENCED_PARAMETER(Dpc);
1046 UNREFERENCED_PARAMETER(DeferredContext);
1047
1048 //
1049 // Enables mov debug registers exitings in primary cpu-based controls
1050 //
1051 AsmVmxVmcall(VMCALL_ENABLE_MOV_TO_DEBUG_REGS_EXITING, 0, 0, 0);
1052
1053 // ------------------------------------------------------------------------------
1054 // Synchronize the end of this routine with the caller
1055 //
1056 PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
1057}
VMCALL_ENABLE_MOV_TO_DEBUG_REGS_EXITING
#define VMCALL_ENABLE_MOV_TO_DEBUG_REGS_EXITING
VMCALL to enable mov to debug registers exiting.
Definition Vmcall.h:106

◆ DpcRoutineEnableMovToCr3Exiting()

VOID DpcRoutineEnableMovToCr3Exiting ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

Broadcast to enable mov-to-cr3 exitings.

Parameters
Dpc
DeferredContext
SystemArgument1
SystemArgument2
Returns
VOID
443{
444 UNREFERENCED_PARAMETER(Dpc);
445 UNREFERENCED_PARAMETER(DeferredContext);
446
447 //
448 // Enable mov-to-cr3 exiting from vmx-root
449 //
450 AsmVmxVmcall(VMCALL_ENABLE_MOV_TO_CR3_EXITING, 0, 0, 0);
451
452 // ------------------------------------------------------------------------------
453 // Synchronize the end of this routine with the caller
454 //
455 PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
456}
VMCALL_ENABLE_MOV_TO_CR3_EXITING
#define VMCALL_ENABLE_MOV_TO_CR3_EXITING
VMCALL to enable cr3 exiting.
Definition Vmcall.h:179

◆ DpcRoutineEnableNmiVmexitOnAllCores()

VOID DpcRoutineEnableNmiVmexitOnAllCores ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

Enable vm-exit on NMIs on all cores.

Parameters
Dpc
DeferredContext
SystemArgument1
SystemArgument2
Returns
VOID
1304{
1305 UNREFERENCED_PARAMETER(Dpc);
1306 UNREFERENCED_PARAMETER(DeferredContext);
1307
1308 //
1309 // Cause vm-exit on NMIs
1310 //
1311 AsmVmxVmcall(VMCALL_SET_VM_EXIT_ON_NMIS, NULL64_ZERO, 0, 0);
1312
1313 // ------------------------------------------------------------------------------
1314 // Synchronize the end of this routine with the caller
1315 //
1316 PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
1317}
VMCALL_SET_VM_EXIT_ON_NMIS
#define VMCALL_SET_VM_EXIT_ON_NMIS
VMCALL to cause vm-exit on NMIs.
Definition Vmcall.h:229

◆ DpcRoutineEnableOrDisableMbec()

VOID DpcRoutineEnableOrDisableMbec ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

Broadcast to enable or disable MBEC.

Parameters
Dpc
DeferredContext
SystemArgument1
SystemArgument2
Returns
VOID
521{
522 UNREFERENCED_PARAMETER(Dpc);
523 UNREFERENCED_PARAMETER(DeferredContext);
524
525 //
526 // Enable/Disable MBEC from vmx-root
527 //
528 AsmVmxVmcall(VMCALL_DISABLE_OR_ENABLE_MBEC, (UINT64)DeferredContext, 0, 0);
529
530 // ------------------------------------------------------------------------------
531 // Synchronize the end of this routine with the caller
532 //
533 PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
534}
VMCALL_DISABLE_OR_ENABLE_MBEC
#define VMCALL_DISABLE_OR_ENABLE_MBEC
VMCALL to enable/disable MBEC.
Definition Vmcall.h:297

◆ DpcRoutineEnablePml()

VOID DpcRoutineEnablePml ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

Broadcast enable PML on all cores.

Parameters
Dpc
DeferredContext
SystemArgument1
SystemArgument2
Returns
VOID
625{
626 UNREFERENCED_PARAMETER(Dpc);
627 UNREFERENCED_PARAMETER(DeferredContext);
628
629 //
630 // Enable PML from vmx-root
631 //
632 AsmVmxVmcall(VMCALL_ENABLE_DIRTY_LOGGING_MECHANISM, 0, 0, 0);
633
634 // ------------------------------------------------------------------------------
635 // Synchronize the end of this routine with the caller
636 //
637 PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
638}
VMCALL_ENABLE_DIRTY_LOGGING_MECHANISM
#define VMCALL_ENABLE_DIRTY_LOGGING_MECHANISM
VMCALL to enable dirty logging (PML) mechanism.
Definition Vmcall.h:273

◆ DpcRoutineEnableRdpmcExitingAllCores()

VOID DpcRoutineEnableRdpmcExitingAllCores ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

Enables rdpmc exiting in primary cpu-based controls.

Parameters
Dpc
DeferredContext
SystemArgument1
SystemArgument2
Returns
VOID
912{
913 UNREFERENCED_PARAMETER(Dpc);
914 UNREFERENCED_PARAMETER(DeferredContext);
915
916 //
917 // Enables rdpmc exiting in primary cpu-based controls
918 //
919 AsmVmxVmcall(VMCALL_SET_RDPMC_EXITING, 0, 0, 0);
920
921 // ------------------------------------------------------------------------------
922 // Synchronize the end of this routine with the caller
923 //
924 PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
925}
VMCALL_SET_RDPMC_EXITING
#define VMCALL_SET_RDPMC_EXITING
VMCALL to enable rdpmc exiting in primary cpu-based controls.
Definition Vmcall.h:94

◆ DpcRoutineEnableRdtscExitingAllCores()

VOID DpcRoutineEnableRdtscExitingAllCores ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

Enables rdtsc/rdtscp exiting in primary cpu-based controls.

Parameters
Dpc
DeferredContext
SystemArgument1
SystemArgument2
Returns
VOID
779{
780 UNREFERENCED_PARAMETER(Dpc);
781 UNREFERENCED_PARAMETER(DeferredContext);
782
783 //
784 // Enables rdtsc/rdtscp exiting in primary cpu-based controls
785 //
786 AsmVmxVmcall(VMCALL_SET_RDTSC_EXITING, 0, 0, 0);
787
788 // ------------------------------------------------------------------------------
789 // Synchronize the end of this routine with the caller
790 //
791 PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
792}
VMCALL_SET_RDTSC_EXITING
#define VMCALL_SET_RDTSC_EXITING
VMCALL to enable rdtsc/rdtscp exiting in primary cpu-based controls.
Definition Vmcall.h:88

◆ DpcRoutineInitializeGuest()

VOID DpcRoutineInitializeGuest ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

The broadcast function which initialize the guest.

Parameters
Dpc
DeferredContext
SystemArgument1
SystemArgument2
Returns
VOID
1510{
1511 UNREFERENCED_PARAMETER(Dpc);
1512 UNREFERENCED_PARAMETER(DeferredContext);
1513
1514 //
1515 // Save the vmx state and prepare vmcs setup and finally execute vmlaunch instruction
1516 //
1517 AsmVmxSaveState();
1518
1519 // ------------------------------------------------------------------------------
1520 // Synchronize the end of this routine with the caller
1521 //
1522 PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
1523}
AsmVmxSaveState
VOID AsmVmxSaveState()
Save state on vmx.

◆ DpcRoutineInvalidateEptOnAllCores()

VOID DpcRoutineInvalidateEptOnAllCores ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

The broadcast function which invalidate EPT using Vmcall.

Parameters
Dpc
DeferredContext
SystemArgument1
SystemArgument2
Returns
VOID
1472{
1473 UNREFERENCED_PARAMETER(Dpc);
1474
1475 if (DeferredContext == NULL)
1476 {
1477 //
1478 // We have to invalidate all contexts
1479 //
1480 AsmVmxVmcall(VMCALL_INVEPT_ALL_CONTEXTS, NULL64_ZERO, NULL64_ZERO, NULL64_ZERO);
1481 }
1482 else
1483 {
1484 //
1485 // We have to invalidate all contexts
1486 //
1487 AsmVmxVmcall(VMCALL_INVEPT_SINGLE_CONTEXT,
1488 g_GuestState[KeGetCurrentProcessorNumberEx(NULL)].EptPointer.AsUInt,
1489 NULL64_ZERO,
1490 NULL64_ZERO);
1491 }
1492
1493 // ------------------------------------------------------------------------------
1494 // Synchronize the end of this routine with the caller
1495 //
1496 PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
1497}
VMCALL_INVEPT_ALL_CONTEXTS
#define VMCALL_INVEPT_ALL_CONTEXTS
VMCALL to invalidate EPT (All Contexts).
Definition Vmcall.h:40
VMCALL_INVEPT_SINGLE_CONTEXT
#define VMCALL_INVEPT_SINGLE_CONTEXT
VMCALL to invalidate EPT (A Single Context).
Definition Vmcall.h:46
g_GuestState
VIRTUAL_MACHINE_STATE * g_GuestState
Save the state and variables related to virtualization on each to logical core.
Definition GlobalVariables.h:38

◆ DpcRoutinePerformChangeIoBitmapOnSingleCore()

VOID DpcRoutinePerformChangeIoBitmapOnSingleCore ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

change I/O bitmap on a single core

Parameters
Dpc
DeferredContext
SystemArgument1
SystemArgument2
Returns
VOID
415{
416 UNREFERENCED_PARAMETER(Dpc);
417 UNREFERENCED_PARAMETER(SystemArgument1);
418 UNREFERENCED_PARAMETER(SystemArgument2);
419
420 //
421 // change I/O bitmap
422 //
423 AsmVmxVmcall(VMCALL_CHANGE_IO_BITMAP, (UINT64)DeferredContext, 0, 0);
424
425 //
426 // As this function is designed for a single,
427 // we have to release the synchronization lock here
428 //
429 SpinlockUnlock(&OneCoreLock);
430}
SpinlockUnlock
VOID SpinlockUnlock(volatile LONG *Lock)
Release the lock.
Definition Spinlock.c:162
OneCoreLock
volatile LONG OneCoreLock
lock for one core execution
Definition DpcRoutines.c:19

◆ DpcRoutinePerformChangeMsrBitmapReadOnSingleCore()

VOID DpcRoutinePerformChangeMsrBitmapReadOnSingleCore ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

change msr bitmap read on a single core

Parameters
Dpc
DeferredContext
SystemArgument1
SystemArgument2
Returns
VOID
157{
158 UNREFERENCED_PARAMETER(Dpc);
159 UNREFERENCED_PARAMETER(SystemArgument1);
160 UNREFERENCED_PARAMETER(SystemArgument2);
161
162 //
163 // change msr bitmap (read)
164 //
165 AsmVmxVmcall(VMCALL_CHANGE_MSR_BITMAP_READ, (UINT64)DeferredContext, 0, 0);
166
167 //
168 // As this function is designed for a single,
169 // we have to release the synchronization lock here
170 //
171 SpinlockUnlock(&OneCoreLock);
172}

◆ DpcRoutinePerformChangeMsrBitmapWriteOnSingleCore()

VOID DpcRoutinePerformChangeMsrBitmapWriteOnSingleCore ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

change msr bitmap write on a single core

Parameters
Dpc
DeferredContext
SystemArgument1
SystemArgument2
Returns
VOID
185{
186 UNREFERENCED_PARAMETER(Dpc);
187 UNREFERENCED_PARAMETER(SystemArgument1);
188 UNREFERENCED_PARAMETER(SystemArgument2);
189
190 //
191 // change msr bitmap (write)
192 //
193 AsmVmxVmcall(VMCALL_CHANGE_MSR_BITMAP_WRITE, (UINT64)DeferredContext, 0, 0);
194
195 //
196 // As this function is designed for a single,
197 // we have to release the synchronization lock here
198 //
199 SpinlockUnlock(&OneCoreLock);
200}

◆ DpcRoutinePerformEnableEferSyscallHookOnSingleCore()

VOID DpcRoutinePerformEnableEferSyscallHookOnSingleCore ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

Enable syscall hook EFER on a single core.

Parameters
Dpc
DeferredContext
SystemArgument1
SystemArgument2
Returns
VOID
386{
387 UNREFERENCED_PARAMETER(Dpc);
388 UNREFERENCED_PARAMETER(DeferredContext);
389 UNREFERENCED_PARAMETER(SystemArgument1);
390 UNREFERENCED_PARAMETER(SystemArgument2);
391
392 //
393 // Enable syscall hook EFER
394 //
395 AsmVmxVmcall(VMCALL_ENABLE_SYSCALL_HOOK_EFER, NULL64_ZERO, 0, 0);
396
397 //
398 // As this function is designed for a single,
399 // we have to release the synchronization lock here
400 //
401 SpinlockUnlock(&OneCoreLock);
402}

◆ DpcRoutinePerformEnableMovToControlRegisterExiting()

VOID DpcRoutinePerformEnableMovToControlRegisterExiting ( KDPC * Dpc,
DEBUGGER_EVENT_OPTIONS * EventOptions,
PVOID SystemArgument1,
PVOID SystemArgument2 )

Set the Mov to Control Registers Exitings.

Parameters
Dpc
Event
SystemArgument1
SystemArgument2
Returns
VOID
329{
330 UNREFERENCED_PARAMETER(Dpc);
331 UNREFERENCED_PARAMETER(SystemArgument1);
332 UNREFERENCED_PARAMETER(SystemArgument2);
333
334 //
335 // enable Mov to Control Registers Exitings
336 //
337 AsmVmxVmcall(VMCALL_ENABLE_MOV_TO_CONTROL_REGS_EXITING, EventOptions->OptionalParam1, EventOptions->OptionalParam2, 0);
338
339 //
340 // As this function is designed for a single,
341 // we have to release the synchronization lock here
342 //
343 SpinlockUnlock(&OneCoreLock);
344}

◆ DpcRoutinePerformEnableMovToDebugRegistersExiting()

VOID DpcRoutinePerformEnableMovToDebugRegistersExiting ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

Set the Mov to Debug Registers Exitings.

Parameters
Dpc
DeferredContext
SystemArgument1
SystemArgument2
Returns
VOID
300{
301 UNREFERENCED_PARAMETER(Dpc);
302 UNREFERENCED_PARAMETER(DeferredContext);
303 UNREFERENCED_PARAMETER(SystemArgument1);
304 UNREFERENCED_PARAMETER(SystemArgument2);
305
306 //
307 // enable Mov to Debug Registers Exitings
308 //
309 AsmVmxVmcall(VMCALL_ENABLE_MOV_TO_DEBUG_REGS_EXITING, 0, 0, 0);
310
311 //
312 // As this function is designed for a single,
313 // we have to release the synchronization lock here
314 //
315 SpinlockUnlock(&OneCoreLock);
316}

◆ DpcRoutinePerformEnableRdpmcExitingOnSingleCore()

VOID DpcRoutinePerformEnableRdpmcExitingOnSingleCore ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

set rdpmc exiting

Parameters
Dpc
DeferredContext
SystemArgument1
SystemArgument2
Returns
VOID
242{
243 UNREFERENCED_PARAMETER(Dpc);
244 UNREFERENCED_PARAMETER(DeferredContext);
245 UNREFERENCED_PARAMETER(SystemArgument1);
246 UNREFERENCED_PARAMETER(SystemArgument2);
247
248 //
249 // enable rdtsc/rdtscp exiting
250 //
251 AsmVmxVmcall(VMCALL_SET_RDPMC_EXITING, 0, 0, 0);
252
253 //
254 // As this function is designed for a single,
255 // we have to release the synchronization lock here
256 //
257 SpinlockUnlock(&OneCoreLock);
258}

◆ DpcRoutinePerformEnableRdtscExitingOnSingleCore()

VOID DpcRoutinePerformEnableRdtscExitingOnSingleCore ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

set rdtsc/rdtscp exiting

Parameters
Dpc
DeferredContext
SystemArgument1
SystemArgument2
Returns
VOID
213{
214 UNREFERENCED_PARAMETER(Dpc);
215 UNREFERENCED_PARAMETER(DeferredContext);
216 UNREFERENCED_PARAMETER(SystemArgument1);
217 UNREFERENCED_PARAMETER(SystemArgument2);
218
219 //
220 // enable rdtsc/rdtscp exiting
221 //
222 AsmVmxVmcall(VMCALL_SET_RDTSC_EXITING, 0, 0, 0);
223
224 //
225 // As this function is designed for a single,
226 // we have to release the synchronization lock here
227 //
228 SpinlockUnlock(&OneCoreLock);
229}

◆ DpcRoutinePerformSetExceptionBitmapOnSingleCore()

VOID DpcRoutinePerformSetExceptionBitmapOnSingleCore ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

change exception bitmap on a single core

Parameters
Dpc
DeferredContext
SystemArgument1
SystemArgument2
Returns
VOID
271{
272 UNREFERENCED_PARAMETER(Dpc);
273 UNREFERENCED_PARAMETER(DeferredContext);
274 UNREFERENCED_PARAMETER(SystemArgument1);
275 UNREFERENCED_PARAMETER(SystemArgument2);
276
277 //
278 // change exception bitmap
279 //
280 AsmVmxVmcall(VMCALL_SET_EXCEPTION_BITMAP, (UINT64)DeferredContext, 0, 0);
281
282 //
283 // As this function is designed for a single,
284 // we have to release the synchronization lock here
285 //
286 SpinlockUnlock(&OneCoreLock);
287}

◆ DpcRoutinePerformSetExternalInterruptExitingOnSingleCore()

VOID DpcRoutinePerformSetExternalInterruptExitingOnSingleCore ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

Enable external interrupt exiting on a single core.

Parameters
Dpc
DeferredContext
SystemArgument1
SystemArgument2
Returns
VOID
357{
358 UNREFERENCED_PARAMETER(Dpc);
359 UNREFERENCED_PARAMETER(DeferredContext);
360 UNREFERENCED_PARAMETER(SystemArgument1);
361 UNREFERENCED_PARAMETER(SystemArgument2);
362
363 //
364 // Enable external interrupt exiting
365 //
366 AsmVmxVmcall(VMCALL_ENABLE_EXTERNAL_INTERRUPT_EXITING, NULL64_ZERO, 0, 0);
367
368 //
369 // As this function is designed for a single,
370 // we have to release the synchronization lock here
371 //
372 SpinlockUnlock(&OneCoreLock);
373}
VMCALL_ENABLE_EXTERNAL_INTERRUPT_EXITING
#define VMCALL_ENABLE_EXTERNAL_INTERRUPT_EXITING
VMCALL to enable external interrupt exiting.
Definition Vmcall.h:112

◆ DpcRoutinePerformVirtualization()

BOOLEAN DpcRoutinePerformVirtualization ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

Broadcast VmxPerformVirtualizationOnSpecificCore.

Parameters
Dpc
DeferredContext
SystemArgument1
SystemArgument2
Returns
BOOLEAN
129{
130 UNREFERENCED_PARAMETER(Dpc);
131 UNREFERENCED_PARAMETER(DeferredContext);
132
133 //
134 // Allocates Vmx regions for all logical cores (Vmxon region and Vmcs region)
135 //
136 VmxPerformVirtualizationOnSpecificCore();
137
138 // ------------------------------------------------------------------------------
139 // Synchronize the end of this routine with the caller
140 //
141 PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
142
143 return TRUE;
144}
VmxPerformVirtualizationOnSpecificCore
BOOLEAN VmxPerformVirtualizationOnSpecificCore()
Allocates Vmx regions for all logical cores (Vmxon region and Vmcs region).
Definition Vmx.c:362
TRUE
#define TRUE
Definition BasicTypes.h:114

◆ DpcRoutineRemoveHookAndInvalidateAllEntriesOnAllCores()

VOID DpcRoutineRemoveHookAndInvalidateAllEntriesOnAllCores ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

The broadcast function which removes all the hooks and invalidate TLB.

Parameters
Dpc
DeferredContext
SystemArgument1
SystemArgument2
Returns
VOID
1418{
1419 UNREFERENCED_PARAMETER(Dpc);
1420 UNREFERENCED_PARAMETER(DeferredContext);
1421
1422 //
1423 // Execute the VMCALL to remove the hook and invalidate
1424 //
1425 AsmVmxVmcall(VMCALL_UNHOOK_ALL_PAGES, NULL64_ZERO, NULL64_ZERO, NULL64_ZERO);
1426
1427 // ------------------------------------------------------------------------------
1428 // Synchronize the end of this routine with the caller
1429 //
1430 PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
1431}
VMCALL_UNHOOK_ALL_PAGES
#define VMCALL_UNHOOK_ALL_PAGES
VMCALL to remove a all physical addresses from hook list.
Definition Vmcall.h:52

◆ DpcRoutineRemoveHookAndInvalidateSingleEntryOnAllCores()

VOID DpcRoutineRemoveHookAndInvalidateSingleEntryOnAllCores ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

The broadcast function which removes the single hook and invalidate TLB.

Parameters
Dpc
DeferredContext
SystemArgument1
SystemArgument2
Returns
VOID
1444{
1445 UNREFERENCED_PARAMETER(Dpc);
1446 UNREFERENCED_PARAMETER(DeferredContext);
1447
1448 EPT_SINGLE_HOOK_UNHOOKING_DETAILS * UnhookingDetail = (EPT_SINGLE_HOOK_UNHOOKING_DETAILS *)DeferredContext;
1449
1450 //
1451 // Execute the VMCALL to remove the hook and invalidate
1452 //
1453 AsmVmxVmcall(VMCALL_UNHOOK_SINGLE_PAGE, UnhookingDetail->PhysicalAddress, UnhookingDetail->OriginalEntry, NULL64_ZERO);
1454
1455 // ------------------------------------------------------------------------------
1456 // Synchronize the end of this routine with the caller
1457 //
1458 PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
1459}
VMCALL_UNHOOK_SINGLE_PAGE
#define VMCALL_UNHOOK_SINGLE_PAGE
VMCALL to restore a single EPT entry and invalidate EPT cache.
Definition Vmcall.h:58
EPT_SINGLE_HOOK_UNHOOKING_DETAILS
struct _EPT_SINGLE_HOOK_UNHOOKING_DETAILS EPT_SINGLE_HOOK_UNHOOKING_DETAILS
Details of unhooking single EPT hooks.
_EPT_SINGLE_HOOK_UNHOOKING_DETAILS::PhysicalAddress
SIZE_T PhysicalAddress
Definition DataTypes.h:410
_EPT_SINGLE_HOOK_UNHOOKING_DETAILS::OriginalEntry
UINT64 OriginalEntry
Definition DataTypes.h:411

◆ DpcRoutineResetExceptionBitmapOnlyOnClearingExceptionEventsOnAllCores()

VOID DpcRoutineResetExceptionBitmapOnlyOnClearingExceptionEventsOnAllCores ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

Reset Exception Bitmaps on all cores.

This function should ONLY be used in clearing !exception events

Parameters
Dpc
DeferredContextException index on IDT
SystemArgument1
SystemArgument2
Returns
VOID
1018{
1019 UNREFERENCED_PARAMETER(Dpc);
1020 UNREFERENCED_PARAMETER(DeferredContext);
1021
1022 //
1023 // Reset Exception Bitmaps from vmx-root
1024 //
1025 AsmVmxVmcall(VMCALL_RESET_EXCEPTION_BITMAP_ONLY_ON_CLEARING_EXCEPTION_EVENTS, NULL64_ZERO, 0, 0);
1026
1027 // ------------------------------------------------------------------------------
1028 // Synchronize the end of this routine with the caller
1029 //
1030 PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
1031}
VMCALL_RESET_EXCEPTION_BITMAP_ONLY_ON_CLEARING_EXCEPTION_EVENTS
#define VMCALL_RESET_EXCEPTION_BITMAP_ONLY_ON_CLEARING_EXCEPTION_EVENTS
VMCALL to reset exception bitmap on VMCS.
Definition Vmcall.h:167

◆ DpcRoutineResetIoBitmapOnAllCores()

VOID DpcRoutineResetIoBitmapOnAllCores ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

Reset I/O Bitmaps on all cores.

Parameters
Dpc
DeferredContext
SystemArgument1
SystemArgument2
Returns
VOID
1226{
1227 UNREFERENCED_PARAMETER(Dpc);
1228 UNREFERENCED_PARAMETER(DeferredContext);
1229
1230 //
1231 // Reset I/O Bitmaps on all cores
1232 //
1233 AsmVmxVmcall(VMCALL_RESET_IO_BITMAP, NULL64_ZERO, 0, 0);
1234
1235 // ------------------------------------------------------------------------------
1236 // Synchronize the end of this routine with the caller
1237 //
1238 PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
1239}
VMCALL_RESET_IO_BITMAP
#define VMCALL_RESET_IO_BITMAP
VMCALL to reset I/O Bitmaps (A & B).
Definition Vmcall.h:173

◆ DpcRoutineResetMsrBitmapReadOnAllCores()

VOID DpcRoutineResetMsrBitmapReadOnAllCores ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

Reset Msr Bitmaps on all cores (vm-exit on all msrs).

Parameters
Dpc
DeferredContext
SystemArgument1
SystemArgument2
Returns
VOID
702{
703 UNREFERENCED_PARAMETER(Dpc);
704 UNREFERENCED_PARAMETER(DeferredContext);
705
706 //
707 // Reset msr bitmaps from vmx-root
708 //
709 AsmVmxVmcall(VMCALL_RESET_MSR_BITMAP_READ, NULL64_ZERO, 0, 0);
710
711 // ------------------------------------------------------------------------------
712 // Synchronize the end of this routine with the caller
713 //
714 PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
715}
VMCALL_RESET_MSR_BITMAP_READ
#define VMCALL_RESET_MSR_BITMAP_READ
VMCALL to reset MSR Bitmap Read.
Definition Vmcall.h:154

◆ DpcRoutineResetMsrBitmapWriteOnAllCores()

VOID DpcRoutineResetMsrBitmapWriteOnAllCores ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

Reset Msr Bitmaps on all cores (vm-exit on all msrs).

Parameters
Dpc
DeferredContext
SystemArgument1
SystemArgument2
Returns
VOID
753{
754 UNREFERENCED_PARAMETER(Dpc);
755 UNREFERENCED_PARAMETER(DeferredContext);
756
757 //
758 // Reset msr bitmaps from vmx-root
759 //
760 AsmVmxVmcall(VMCALL_RESET_MSR_BITMAP_WRITE, NULL64_ZERO, 0, 0);
761
762 // ------------------------------------------------------------------------------
763 // Synchronize the end of this routine with the caller
764 //
765 PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
766}
VMCALL_RESET_MSR_BITMAP_WRITE
#define VMCALL_RESET_MSR_BITMAP_WRITE
VMCALL to reset MSR Bitmap Write.
Definition Vmcall.h:160

◆ DpcRoutineRestoreToNormalEptp()

VOID DpcRoutineRestoreToNormalEptp ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

Broadcast to restore to normal EPTP.

Parameters
Dpc
DeferredContext
SystemArgument1
SystemArgument2
Returns
VOID
495{
496 UNREFERENCED_PARAMETER(Dpc);
497 UNREFERENCED_PARAMETER(DeferredContext);
498
499 //
500 // Restore to normal EPTP from vmx-root
501 //
502 AsmVmxVmcall(VMCALL_RESTORE_TO_NORMAL_EPTP, 0, 0, 0);
503
504 // ------------------------------------------------------------------------------
505 // Synchronize the end of this routine with the caller
506 //
507 PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
508}
VMCALL_RESTORE_TO_NORMAL_EPTP
#define VMCALL_RESTORE_TO_NORMAL_EPTP
VMCALL to restore EPTP to normal EPTP.
Definition Vmcall.h:291

◆ DpcRoutineRunTaskOnSingleCore()

NTSTATUS DpcRoutineRunTaskOnSingleCore ( UINT32 CoreNumber,
PVOID Routine,
PVOID DeferredContext )

This function synchronize the function execution for a single core You should only used it for one core, not in multiple threads simultaneously The function that needs to use this feature (Routine parameter function) should have the when it ends : 

         SpinlockUnlock(&OneCoreLock);
Parameters
CoreNumbercore number that the target function should run on it
Routinethe target function that should be ran
DeferredContextan optional parameter to Routine
Returns
NTSTATUS
36{
37 PRKDPC Dpc;
38 ULONG ProcessorsCount;
39
40 ProcessorsCount = KeQueryActiveProcessorCount(0);
41
42 //
43 // Check if the core number is not invalid
44 //
45 if (CoreNumber >= ProcessorsCount)
46 {
47 return STATUS_INVALID_PARAMETER;
48 }
49
50 //
51 // Allocate Memory for DPC
52 //
53 Dpc = PlatformMemAllocateNonPagedPool(sizeof(KDPC));
54
55 if (!Dpc)
56 {
57 return STATUS_INSUFFICIENT_RESOURCES;
58 }
59
60 //
61 // Creating a DPC that will run on the target process
62 //
63 KeInitializeDpc(Dpc, // Dpc
64 (PKDEFERRED_ROUTINE)Routine, // DeferredRoutine
65 DeferredContext // DeferredContext
66 );
67
68 //
69 // Set the target core
70 //
71 KeSetTargetProcessorDpc(Dpc, (CCHAR)CoreNumber);
72
73 //
74 // it's sure will be executed, but we want to free the above
75 // pool, so we have to wait on a spinlock that will be release
76 // by the DPC routine, actually Affinity Thread but that
77 // won't support more than 64 logical cores, I create a discussion
78 // here, and explained the problem, but no one answers
79 // link: https://community.osr.com/discussion/292064/putting-a-barrier-for-dpc-before-continuing-the-rest-of-code
80 // we also can't use the spinlock routine of Windows as this function
81 // raises the IRQL to DPC and we want to execute at DPC, means that
82 // If we're currently on the right core, we never find a chance to
83 // release the spinlock so a deadlock happens, all in all it's complicated :)
84 //
85
86 //
87 // Set the lock to be freed by the other DPC routine
88 //
89 if (!SpinlockTryLock(&OneCoreLock))
90 {
91 //
92 // We can't get the lock, probably sth goes wrong !
93 //
94 PlatformMemFreePool(Dpc);
95 return STATUS_UNSUCCESSFUL;
96 }
97
98 //
99 // Fire the DPC
100 //
101 KeInsertQueueDpc(Dpc, NULL, NULL);
102
103 //
104 // spin on lock to be release, immediately after we get the lock, we'll
105 // release it for because there is no need to it anymore and DPC is finished
106 //
107 SpinlockLock(&OneCoreLock);
108 SpinlockUnlock(&OneCoreLock);
109
110 //
111 // Now it's safe to deallocate the bugger
112 //
113 PlatformMemFreePool(Dpc);
114
115 return STATUS_SUCCESS;
116}
PlatformMemAllocateNonPagedPool
PVOID PlatformMemAllocateNonPagedPool(SIZE_T NumberOfBytes)
Allocates non-paged pool memory.
Definition PlatformMem.c:208
PlatformMemFreePool
PVOID PlatformMemFreePool(PVOID BufferAddress)
Frees a memory pool.
Definition PlatformMem.c:269
SpinlockTryLock
BOOLEAN SpinlockTryLock(volatile LONG *Lock)
Tries to get the lock otherwise returns.
Definition Spinlock.c:41
SpinlockLock
VOID SpinlockLock(volatile LONG *Lock)
Tries to get the lock and won't return until successfully get the lock.
Definition Spinlock.c:53
STATUS_UNSUCCESSFUL
#define STATUS_UNSUCCESSFUL
Definition Windows.h:172
ULONG
unsigned long ULONG
Definition BasicTypes.h:31

◆ DpcRoutineSetDisableExternalInterruptExitingOnlyOnClearingInterruptEventsOnAllCores()

VOID DpcRoutineSetDisableExternalInterruptExitingOnlyOnClearingInterruptEventsOnAllCores ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

Disable vm-exit on all cores for external interrupts only for clearing !interrupt events.

Parameters
Dpc
DeferredContext
SystemArgument1
SystemArgument2
Returns
VOID
1175{
1176 UNREFERENCED_PARAMETER(Dpc);
1177 UNREFERENCED_PARAMETER(DeferredContext);
1178
1179 //
1180 // Disable External Interrupts vm-exit from vmx-root
1181 //
1182 AsmVmxVmcall(VMCALL_DISABLE_EXTERNAL_INTERRUPT_EXITING_ONLY_TO_CLEAR_INTERRUPT_COMMANDS, 0, 0, 0);
1183
1184 // ------------------------------------------------------------------------------
1185 // Synchronize the end of this routine with the caller
1186 //
1187 PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
1188}
VMCALL_DISABLE_EXTERNAL_INTERRUPT_EXITING_ONLY_TO_CLEAR_INTERRUPT_COMMANDS
#define VMCALL_DISABLE_EXTERNAL_INTERRUPT_EXITING_ONLY_TO_CLEAR_INTERRUPT_COMMANDS
VMCALL to disable external interrupt exiting only to clear !interrupt commands.
Definition Vmcall.h:136

◆ DpcRoutineSetEnableExternalInterruptExitingOnAllCores()

VOID DpcRoutineSetEnableExternalInterruptExitingOnAllCores ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

Enable vm-exit on all cores for external interrupts.

Parameters
Dpc
DeferredContext
SystemArgument1
SystemArgument2
Returns
VOID
1146{
1147 UNREFERENCED_PARAMETER(Dpc);
1148 UNREFERENCED_PARAMETER(DeferredContext);
1149
1150 //
1151 // Enable External Interrupts vm-exit from vmx-root
1152 //
1153 AsmVmxVmcall(VMCALL_ENABLE_EXTERNAL_INTERRUPT_EXITING, 0, 0, 0);
1154
1155 // ------------------------------------------------------------------------------
1156 // Synchronize the end of this routine with the caller
1157 //
1158 PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
1159}

◆ DpcRoutineSetExceptionBitmapOnAllCores()

VOID DpcRoutineSetExceptionBitmapOnAllCores ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

Enable Exception Bitmaps on all cores.

Parameters
Dpc
DeferredContextException index on IDT
SystemArgument1
SystemArgument2
Returns
VOID
964{
965 UNREFERENCED_PARAMETER(Dpc);
966
967 //
968 // Enable Exception Bitmaps from vmx-root
969 //
970 AsmVmxVmcall(VMCALL_SET_EXCEPTION_BITMAP, (UINT64)DeferredContext, 0, 0);
971
972 // ------------------------------------------------------------------------------
973 // Synchronize the end of this routine with the caller
974 //
975 PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
976}

◆ DpcRoutineTerminateGuest()

VOID DpcRoutineTerminateGuest ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

The broadcast function which terminate the guest.

Parameters
Dpc
DeferredContext
SystemArgument1
SystemArgument2
Returns
VOID
1536{
1537 UNREFERENCED_PARAMETER(Dpc);
1538 UNREFERENCED_PARAMETER(DeferredContext);
1539
1540 //
1541 // Terminate Vmx using vmcall
1542 //
1543 if (!VmxTerminate())
1544 {
1545 LogError("Err, there were an error terminating vmx");
1546 }
1547
1548 // ------------------------------------------------------------------------------
1549 // Synchronize the end of this routine with the caller
1550 //
1551 PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
1552}
VmxTerminate
BOOLEAN VmxTerminate()
Broadcast to terminate VMX on all logical cores.
Definition Vmx.c:561
LogError
#define LogError(format,...)
Log in the case of error.
Definition HyperDbgHyperLogIntrinsics.h:113

◆ DpcRoutineUnsetExceptionBitmapOnAllCores()

VOID DpcRoutineUnsetExceptionBitmapOnAllCores ( KDPC * Dpc,
PVOID DeferredContext,
PVOID SystemArgument1,
PVOID SystemArgument2 )

Disable Exception Bitmaps on all cores.

Parameters
Dpc
DeferredContextException index on IDT
SystemArgument1
SystemArgument2
Returns
VOID
989{
990 UNREFERENCED_PARAMETER(Dpc);
991
992 //
993 // Disable Exception Bitmaps from vmx-root
994 //
995 AsmVmxVmcall(VMCALL_UNSET_EXCEPTION_BITMAP, (UINT64)DeferredContext, 0, 0);
996
997 // ------------------------------------------------------------------------------
998 // Synchronize the end of this routine with the caller
999 //
1000 PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
1001}