Common.h File Reference

Header files for common functions. More...

Go to the source code of this file.

Classes
struct	_CPUID
	CPUID Registers. More...
union	_CR_FIXED
struct	_NT_KPROCESS
	KPROCESS Brief structure. More...

Macros
#define	__CPU_INDEX__   KeGetCurrentProcessorNumberEx(NULL)
	Core Id.
#define	ALIGNMENT_PAGE_SIZE   4096
	Alignment Size.
#define	MAXIMUM_ADDRESS   0xffffffffffffffff
	Maximum x64 Address.
#define	DPL_USER   3
	System and User ring definitions.
#define	DPL_SYSTEM   0
#define	RPL_MASK   3
	RPL Mask.
#define	BITS_PER_LONG   (sizeof(ULONG) * 8)
#define	ORDER_LONG   (sizeof(ULONG) == 4 ? 5 : 6)
#define	BITMAP_ENTRY(_nr, _bmap)
#define	BITMAP_SHIFT(_nr)
#define	PAGE_OFFSET(Va)
	Offset from a page's 4096 bytes.
#define	_XBEGIN_STARTED   (~0u)
	Intel TSX Constants.
#define	_XABORT_EXPLICIT   (1 << 0)
#define	_XABORT_RETRY   (1 << 1)
#define	_XABORT_CONFLICT   (1 << 2)
#define	_XABORT_CAPACITY   (1 << 3)
#define	_XABORT_DEBUG   (1 << 4)
#define	_XABORT_NESTED   (1 << 5)
#define	_XABORT_CODE(x)

Typedefs
typedef SEGMENT_DESCRIPTOR_32 *	PSEGMENT_DESCRIPTOR
typedef struct _CPUID	CPUID
	CPUID Registers.
typedef struct _CPUID *	PCPUID
typedef union _CR_FIXED	CR_FIXED
typedef union _CR_FIXED *	PCR_FIXED
typedef struct _NT_KPROCESS	NT_KPROCESS
	KPROCESS Brief structure.
typedef struct _NT_KPROCESS *	PNT_KPROCESS
typedef VOID(*	RunOnLogicalCoreFunc) (ULONG ProcessorId)
	Prototype to run a function on a logical core.

Functions
UCHAR *	PsGetProcessImageFileName (IN PEPROCESS Process)
BOOLEAN	CommonAffinityBroadcastToProcessors (_In_ ULONG ProcessorNumber, _In_ RunOnLogicalCoreFunc Routine)
BOOLEAN	CommonIsStringStartsWith (const CHAR *pre, const CHAR *str)
	Detects whether the string starts with another string.
BOOLEAN	CommonIsGuestOnUsermode32Bit ()
	determines if the guest was in 32-bit user-mode or 64-bit (long mode)
PCHAR	CommonGetProcessNameFromProcessControlBlock (PEPROCESS eprocess)
	Get process name by eprocess.
VOID	CommonCpuidInstruction (UINT32 Func, UINT32 SubFunc, INT *CpuInfo)
	Get cpuid results.
VOID	CommonWriteDebugInformation (VIRTUAL_MACHINE_STATE *VCpu)
	Produce debug information from unrecoverable bugs.
BOOLEAN	CommonIsXCr0Valid (XCR0 XCr0)
	Check correctness of the XCR0 register value.

Detailed Description

Header files for common functions.

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.1

Date

2020-04-10

Copyright

This project is released under the GNU Public License v3.

Macro Definition Documentation

__CPU_INDEX__

#define __CPU_INDEX__   KeGetCurrentProcessorNumberEx(NULL)

Core Id.

_XABORT_CAPACITY

#define _XABORT_CAPACITY   (1 << 3)

_XABORT_CODE

#define _XABORT_CODE

(

x

)

Value:

(((x) >> 24) & 0xFF)

_XABORT_CONFLICT

#define _XABORT_CONFLICT   (1 << 2)

_XABORT_DEBUG

#define _XABORT_DEBUG   (1 << 4)

_XABORT_EXPLICIT

#define _XABORT_EXPLICIT   (1 << 0)

_XABORT_NESTED

#define _XABORT_NESTED   (1 << 5)

_XABORT_RETRY

#define _XABORT_RETRY   (1 << 1)

_XBEGIN_STARTED

#define _XBEGIN_STARTED   (~0u)

Intel TSX Constants.

ALIGNMENT_PAGE_SIZE

#define ALIGNMENT_PAGE_SIZE   4096

Alignment Size.

BITMAP_ENTRY

#define BITMAP_ENTRY	(		_nr,
			_bmap )

Value:

((_bmap))[(_nr) / BITS_PER_LONG]

BITMAP_SHIFT

#define BITMAP_SHIFT

(

_nr

)

Value:

((_nr) % BITS_PER_LONG)

BITS_PER_LONG

#define BITS_PER_LONG   (sizeof(ULONG) * 8)

DPL_SYSTEM

#define DPL_SYSTEM   0

DPL_USER

#define DPL_USER   3

System and User ring definitions.

MAXIMUM_ADDRESS

#define MAXIMUM_ADDRESS   0xffffffffffffffff

Maximum x64 Address.

ORDER_LONG

#define ORDER_LONG   (sizeof(ULONG) == 4 ? 5 : 6)

PAGE_OFFSET

#define PAGE_OFFSET

(

Va

)

Value:

((PVOID)((ULONG_PTR)(Va) & (PAGE_SIZE - 1)))

Offset from a page's 4096 bytes.

RPL_MASK

#define RPL_MASK   3

RPL Mask.

Typedef Documentation

CPUID

typedef struct _CPUID CPUID

CPUID Registers.

CR_FIXED

typedef union _CR_FIXED CR_FIXED

NT_KPROCESS

typedef struct _NT_KPROCESS NT_KPROCESS

KPROCESS Brief structure.

PCPUID

typedef struct _CPUID * PCPUID

PCR_FIXED

typedef union _CR_FIXED * PCR_FIXED

PNT_KPROCESS

typedef struct _NT_KPROCESS * PNT_KPROCESS

PSEGMENT_DESCRIPTOR

typedef SEGMENT_DESCRIPTOR_32* PSEGMENT_DESCRIPTOR

RunOnLogicalCoreFunc

typedef VOID(* RunOnLogicalCoreFunc) (ULONG ProcessorId)

Prototype to run a function on a logical core.

Function Documentation

CommonAffinityBroadcastToProcessors()

BOOLEAN CommonAffinityBroadcastToProcessors	(	_In_ ULONG	ProcessorNumber,
		_In_ RunOnLogicalCoreFunc	Routine )

CommonCpuidInstruction()

VOID CommonCpuidInstruction	(	UINT32	Func,
		UINT32	SubFunc,
		INT *	CpuInfo )

Get cpuid results.

Parameters

Func
SubFunc
CpuInfo

Returns

VOID

{
    CpuCpuIdEx(CpuInfo, Func, SubFunc);
}

CommonGetProcessNameFromProcessControlBlock()

PCHAR CommonGetProcessNameFromProcessControlBlock

(

PEPROCESS

Eprocess

)

Get process name by eprocess.

Parameters

Eprocess

Process eprocess

Returns

PCHAR Returns a pointer to the process name

{
    PCHAR Result = 0;
 
    //
    // We can't use PsLookupProcessByProcessId as in pageable and not
    // work on vmx-root
    //
    Result = (CHAR *)PsGetProcessImageFileName(Eprocess);
 
    return Result;
}

CommonIsGuestOnUsermode32Bit()

BOOLEAN CommonIsGuestOnUsermode32Bit

(

)

determines if the guest was in 32-bit user-mode or 64-bit (long mode)

this function should be called from vmx-root

Returns

BOOLEAN

{
    //
    // Only 16 bit is needed however, VMWRITE might write on other bits
    // and corrupt other variables, that's why we get 64bit
    //
    UINT64 CsSel = NULL64_ZERO;
 
    //
    // Read guest's cs selector
    //
    CsSel = HvGetCsSelector();
 
    if (CsSel == KGDT64_R0_CODE)
    {
        //
        // 64-bit kernel-mode
        //
        return FALSE;
    }
    else if ((CsSel & ~3) == KGDT64_R3_CODE)
    {
        //
        // 64-bit user-mode
        //
        return FALSE;
    }
    else if ((CsSel & ~3) == KGDT64_R3_CMCODE)
    {
        //
        // 32-bit user-mode
        //
        return TRUE;
    }
    else
    {
        LogError("Err, unknown value for cs, cannot determine wow64 mode");
    }
 
    //
    // By default, 64-bit
    //
    return FALSE;
}

CommonIsStringStartsWith()

BOOLEAN CommonIsStringStartsWith	(	const CHAR *	pre,
		const CHAR *	str )

Detects whether the string starts with another string.

Parameters

pre
str

Returns

BOOLEAN Returns true if it starts with and false if not strats with

{
    SIZE_T LenPre = strlen(pre),
           LenStr = strlen(str);
    return LenStr < LenPre ? FALSE : memcmp(pre, str, LenPre) == 0;
}

CommonIsXCr0Valid()

BOOLEAN CommonIsXCr0Valid

(

XCR0

XCr0

)

Check correctness of the XCR0 register value.

Parameters

XCr0	The XCR0 register value.

Returns

BOOLEAN

{
    CPUID_EAX_0D_ECX_00 XCr0CpuidInfo;
    UINT64              UnsupportedXCr0Bits;
 
    //
    // SDM Vol.3A 2.6 EXTENDED CONTROL REGISTERS (INCLUDING XCR0) - describes the invalid
    // states of the XCR0 register.
    //
 
    CommonCpuidInstruction(CPUID_EXTENDED_STATE_INFORMATION, 0, (INT32 *)&XCr0CpuidInfo);
    UnsupportedXCr0Bits = ~(XCr0CpuidInfo.Eax.AsUInt | (UINT64)XCr0CpuidInfo.Edx.AsUInt << 32);
 
    if ((XCr0.AsUInt & UnsupportedXCr0Bits) != 0)
    {
        return FALSE;
    }
 
    if (XCr0.X87 != 1)
    {
        return FALSE;
    }
 
    if (XCr0.Sse == 0 && XCr0.Avx == 1)
    {
        return FALSE;
    }
 
    if (XCr0.Avx == 0)
    {
        if ((XCr0.Opmask | XCr0.ZmmHi256 | XCr0.ZmmHi16) == 1)
        {
            return FALSE;
        }
    }
 
    if (XCr0.Bndcsr != XCr0.Bndreg)
    {
        return FALSE;
    }
 
    if ((XCr0.Opmask | XCr0.ZmmHi256 | XCr0.ZmmHi16) == 1)
    {
        if ((XCr0.Opmask & XCr0.ZmmHi256 & XCr0.ZmmHi16) != 1)
        {
            return FALSE;
        }
    }
 
    return TRUE;
}

CommonWriteDebugInformation()

VOID CommonWriteDebugInformation

(

VIRTUAL_MACHINE_STATE *

VCpu

)

Produce debug information from unrecoverable bugs.

Parameters

VCpu	The virtual processor's state

Returns

VOID

{
    LogError("HyperDbg cannot recover from this error, please provide the following information through the Git issues");
 
    LogInfo("Target RIP: %llx\n", VCpu->LastVmexitRip);
 
    CHAR Instruction[MAXIMUM_INSTR_SIZE] = {0};
 
    MemoryMapperReadMemorySafeOnTargetProcess(VCpu->LastVmexitRip, Instruction, MAXIMUM_INSTR_SIZE);
 
    for (SIZE_T i = 0; i < MAXIMUM_INSTR_SIZE; i++)
    {
        Log("%02X ", Instruction[i] & 0xffU);
    }
 
    Log("\n");
    DisassemblerShowOneInstructionInVmxRootMode((PVOID)VCpu->LastVmexitRip,
                                                CommonIsGuestOnUsermode32Bit());
    Log("\n");
 
    Log(
        "RAX=%016llx RBX=%016llx RCX=%016llx\n"
        "RDX=%016llx RSI=% 016llx RDI=%016llx\n"
        "RIP=%016llx RSP=%016llx RBP=%016llx\n"
        "R8 =%016llx R9 =%016llx R10=%016llx\n"
        "R11=%016llx R12=%016llx R13=%016llx\n"
        "R14=%016llx R15=%016llx\n",
        VCpu->Regs->rax,
        VCpu->Regs->rbx,
        VCpu->Regs->rcx,
        VCpu->Regs->rdx,
        VCpu->Regs->rsi,
        VCpu->Regs->rdi,
        VCpu->LastVmexitRip,
        VCpu->Regs->rsp,
        VCpu->Regs->rbp,
        VCpu->Regs->r8,
        VCpu->Regs->r9,
        VCpu->Regs->r10,
        VCpu->Regs->r11,
        VCpu->Regs->r12,
        VCpu->Regs->r13,
        VCpu->Regs->r14,
        VCpu->Regs->r15);
}

PsGetProcessImageFileName()

UCHAR * PsGetProcessImageFileName

(

IN PEPROCESS

Process

)