smi.cpp File Reference

!smi command More...

#include "pch.h"

Functions
VOID	CommandSmiHelp ()
	help of the !smi command
BOOLEAN	CommandSmiSendRequest (SMI_OPERATION_PACKETS *SmiOperationRequest)
	Send SMI requests.
BOOLEAN	HyperDbgPerformSmiOperation (SMI_OPERATION_PACKETS *SmiOperation)
	Request to perform an SMI operation.
VOID	CommandSmi (vector< CommandToken > CommandTokens, string Command)
	!smi command handler

Variables
BOOLEAN	g_IsKdModuleLoaded
	shows whether the kernel debugger (KD) module is loaded or not
BOOLEAN	g_IsSerialConnectedToRemoteDebuggee
	Shows if the debugger was connected to remote debuggee over (A remote guest).

Detailed Description

!smi command

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.15

Date

2025-08-02

Copyright

This project is released under the GNU Public License v3.

Function Documentation

CommandSmi()

VOID CommandSmi	(	vector< CommandToken >	CommandTokens,
		string	Command )

!smi command handler

Parameters

CommandTokens
Command

Returns

VOID

{
    SMI_OPERATION_PACKETS SmiOperationRequest = {0};
 
    if (CommandTokens.size() != 2)
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
 
        CommandSmiHelp();
        return;
    }
 
    if (CompareLowerCaseStrings(CommandTokens.at(1), "count"))
    {
        SmiOperationRequest.SmiOperationType = SMI_OPERATION_REQUEST_TYPE_READ_COUNT;
    }
    else if (CompareLowerCaseStrings(CommandTokens.at(1), "trigger"))
    {
        SmiOperationRequest.SmiOperationType = SMI_OPERATION_REQUEST_TYPE_TRIGGER_POWER_SMI;
    }
    else
    {
        ShowMessages("incorrect use of the '%s'\n\n",
                     GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
        CommandSmiHelp();
        return;
    }
 
    //
    // Send the SMI operation request
    //
    if (CommandSmiSendRequest(&SmiOperationRequest))
    {
        if (SmiOperationRequest.SmiOperationType == SMI_OPERATION_REQUEST_TYPE_READ_COUNT)
        {
            if (SmiOperationRequest.SmiCount == 0)
            {
                ShowMessages("SMI count: 0 (for security reasons, nested-virtualization environment (VMs) are unable to communicate with UEFI firmware)\n");
            }
            else
            {
                ShowMessages("SMI count: 0x%x\n", SmiOperationRequest.SmiCount);
            }
        }
        else if (SmiOperationRequest.SmiOperationType == SMI_OPERATION_REQUEST_TYPE_TRIGGER_POWER_SMI)
        {
            ShowMessages("power SMI triggered successfully (you can use '!smi count' to view the number of executed SMIs)\n");
        }
    }
    else
    {
        ShowErrorMessage(SmiOperationRequest.KernelStatus);
        return;
    }
}

CommandSmiHelp()

VOID CommandSmiHelp

(

)

help of the !smi command

Returns

VOID

{
    ShowMessages("!smi : shows details and triggers functionalities related to System Management Interrupt (SMI).\n");
    ShowMessages("Note : SMIs are triggered using APM I/O Decode Registers and SMI count are from MSR_SMI_COUNT MSR (0x34).\n\n");
 
    ShowMessages("syntax : \t!smi [Function (string)]\n");
 
    ShowMessages("\n");
    ShowMessages("\t\te.g : !smi count\n");
    ShowMessages("\t\te.g : !smi trigger\n");
}

CommandSmiSendRequest()

BOOLEAN CommandSmiSendRequest

(

SMI_OPERATION_PACKETS *

SmiOperationRequest

)

Send SMI requests.

Parameters

SmiRequest

Returns

VOID

{
    BOOL  Status;
    ULONG ReturnedLength;
 
    if (g_IsSerialConnectedToRemoteDebuggee)
    {
        //
        // Send the request over serial kernel debugger
        //
        if (!KdSendSmiPacketsToDebuggee(SmiOperationRequest, SIZEOF_SMI_OPERATION_PACKETS))
        {
            return FALSE;
        }
        else
        {
            return TRUE;
        }
    }
    else
    {
        AssertShowMessageReturnStmt(g_IsKdModuleLoaded, g_DeviceHandle, ASSERT_MESSAGE_KD_NOT_LOADED, ASSERT_MESSAGE_DRIVER_NOT_LOADED, AssertReturnFalse);
 
        //
        // Send IOCTL
        //
        Status = DeviceIoControl(
            g_DeviceHandle,               // Handle to device
            IOCTL_PERFORM_SMI_OPERATION,  // IO Control Code (IOCTL)
            SmiOperationRequest,          // Input Buffer to driver.
            SIZEOF_SMI_OPERATION_PACKETS, // Input buffer length
            SmiOperationRequest,          // Output Buffer from driver.
            SIZEOF_SMI_OPERATION_PACKETS, // Length of output buffer in bytes.
            &ReturnedLength,              // Bytes placed in buffer.
            NULL                          // synchronous call
        );
 
        if (!Status)
        {
            ShowMessages("ioctl failed with code 0x%x\n", GetLastError());
 
            return FALSE;
        }
 
        if (SmiOperationRequest->KernelStatus == DEBUGGER_OPERATION_WAS_SUCCESSFUL)
        {
            return TRUE;
        }
        else
        {
            return FALSE;
        }
    }
}

HyperDbgPerformSmiOperation()

BOOLEAN HyperDbgPerformSmiOperation

(

SMI_OPERATION_PACKETS *

SmiOperation

)

Request to perform an SMI operation.

Parameters

SmiOperation

Returns

BOOLEAN

{
    return CommandSmiSendRequest(SmiOperation);
}

Variable Documentation

g_IsKdModuleLoaded

BOOLEAN g_IsKdModuleLoaded

extern

shows whether the kernel debugger (KD) module is loaded or not

g_IsSerialConnectedToRemoteDebuggee

BOOLEAN g_IsSerialConnectedToRemoteDebuggee

extern

Shows if the debugger was connected to remote debuggee over (A remote guest).