transparency.cpp File Reference

Measurements for debugger transparency. More...

#include "pch.h"

Functions
UINT64	TransparentModeRdtscDiffVmexit ()
	get the difference clock cycles between two rdtsc(s)
UINT64	TransparentModeRdtscVmexitTracing ()
	get the difference clock cycles between rdtsc+cpuid+rdtsc
INT	TransparentModeCpuidTimeStampCounter (UINT64 *Average, UINT64 *StandardDeviation, UINT64 *Median)
	compute the average, standard deviation and median if rdtsc+cpuid+rdtsc
INT	TransparentModeRdtscEmulationDetection (UINT64 *Average, UINT64 *StandardDeviation, UINT64 *Median)
	compute the average, standard deviation and median if rdtsc+rdtsc
BOOLEAN	TransparentModeCheckHypervisorPresence (UINT64 *Average, UINT64 *StandardDeviation, UINT64 *Median)
	compute the average, standard deviation and median if rdtsc+cpuid+rdtsc
BOOLEAN	TransparentModeCheckRdtscpVmexit (UINT64 *Average, UINT64 *StandardDeviation, UINT64 *Median)
	compute the average, standard deviation and median if rdtsc+rdtsc

Detailed Description

Measurements for debugger transparency.

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.1

Date

2020-07-07

Copyright

This project is released under the GNU Public License v3.

Function Documentation

TransparentModeCheckHypervisorPresence()

BOOLEAN TransparentModeCheckHypervisorPresence	(	UINT64 *	Average,
		UINT64 *	StandardDeviation,
		UINT64 *	Median )

compute the average, standard deviation and median if rdtsc+cpuid+rdtsc

detects the presence of hypervisor

Parameters

Average	a pointer to save average on it
StandardDeviation	a pointer to standard deviation average on it
Median	a pointer to save median on it

Returns

int

{
    //
    // Check whether the hypervisor is detected or not
    //
    if (TransparentModeCpuidTimeStampCounter(Average, StandardDeviation, Median))
    {
        ShowMessages("hypervisor detected\n");
        return TRUE;
    }
    else
    {
        ShowMessages("hypervisor not detected\n");
        return FALSE;
    }
}

TransparentModeCheckRdtscpVmexit()

BOOLEAN TransparentModeCheckRdtscpVmexit	(	UINT64 *	Average,
		UINT64 *	StandardDeviation,
		UINT64 *	Median )

compute the average, standard deviation and median if rdtsc+rdtsc

detects the presence of rdtsc/p vm-exits

Parameters

Average	a pointer to save average on it
StandardDeviation	a pointer to standard deviation average on it
Median	a pointer to save median on it

Returns

int

{
    //
    // Check whether the system emulating rdtsc/p or not
    //
    if (TransparentModeRdtscEmulationDetection(Average, StandardDeviation, Median))
    {
        ShowMessages("rdtsc/p emulation detected\n");
        return TRUE;
    }
    else
    {
        ShowMessages("rdtsc/p emulation not detected\n");
        return FALSE;
    }
}

TransparentModeCpuidTimeStampCounter()

INT TransparentModeCpuidTimeStampCounter	(	UINT64 *	Average,
		UINT64 *	StandardDeviation,
		UINT64 *	Median )

compute the average, standard deviation and median if rdtsc+cpuid+rdtsc

Parameters

Average	a pointer to save average on it
StandardDeviation	a pointer to standard deviation average on it
Median	a pointer to save median on it

Returns

INT

{
    double         Avg          = 0;
    double         MeasuredTime = 0;
    vector<double> Results;
 
    for (int i = 0; i < TestCount; i++)
    {
        MeasuredTime = (double)TransparentModeRdtscDiffVmexit();
        Avg          = Avg + MeasuredTime;
 
        Results.push_back(MeasuredTime);
 
        /*
    ShowMessages("(%d) Measured time : %d\n", i, MeasuredTime);
    */
    }
 
    if (Average != NULL && StandardDeviation != NULL && Median != NULL)
    {
        //
        // Compute the average and variance
        //
        GuassianGenerateRandom(Results, Average, StandardDeviation, Median);
    }
 
    Avg = Avg / TestCount;
    return (Avg < 1000 && Avg > 0) ? FALSE : TRUE;
}

TransparentModeRdtscDiffVmexit()

UINT64 TransparentModeRdtscDiffVmexit

(

)

get the difference clock cycles between two rdtsc(s)

Returns

UINT64

{
    UINT64 Ret, Ret2;
    INT    CpuidResult[4] = {0};
 
    //
    // GCC
    //
    // __asm__ volatile("rdtsc" : "=a" (eax), "=d" (edx));
    // ret = ((unsigned long long)eax) | (((unsigned long long)edx) << 32);
 
    //
    // Win32
    //
    Ret = CpuReadTsc();
 
    /* vm exit forced here. it uses: eax = 0; cpuid; */
 
    //
    // GCC
    //
    //__asm__ volatile("cpuid" : /* no output */ : "a"(0x00));
 
    //
    // WIN32
    //
    CpuCpuId(CpuidResult, 0);
 
    //
    // GCC
    //
    // __asm__ volatile("rdtsc" : "=a" (eax), "=d" (edx));
    // ret2 = ((unsigned long long)eax) | (((unsigned long long)edx) << 32);
 
    //
    // WIN32
    //
    Ret2 = CpuReadTsc();
 
    return Ret2 - Ret;
}

TransparentModeRdtscEmulationDetection()

INT TransparentModeRdtscEmulationDetection	(	UINT64 *	Average,
		UINT64 *	StandardDeviation,
		UINT64 *	Median )

compute the average, standard deviation and median if rdtsc+rdtsc

Parameters

Average	a pointer to save average on it
StandardDeviation	a pointer to standard deviation average on it
Median	a pointer to save median on it

Returns

INT

{
    double         Avg          = 0;
    double         MeasuredTime = 0;
    vector<double> Results;
 
    for (int i = 0; i < TestCount; i++)
    {
        MeasuredTime = (double)TransparentModeRdtscVmexitTracing();
        Avg          = Avg + MeasuredTime;
 
        Results.push_back(MeasuredTime);
 
        /*
    ShowMessages("(%d) Measured time : %d\n", i, MeasuredTime);
    */
    }
 
    if (Average != NULL && StandardDeviation != NULL && Median != NULL)
    {
        //
        // Compute the average and variance
        //
        GuassianGenerateRandom(Results, Average, StandardDeviation, Median);
    }
 
    Avg = Avg / TestCount;
    return (Avg < 750 && Avg > 0) ? FALSE : TRUE;
}

TransparentModeRdtscVmexitTracing()

UINT64 TransparentModeRdtscVmexitTracing

(

)

get the difference clock cycles between rdtsc+cpuid+rdtsc

Returns

UINT64

{
    UINT64 Ret, Ret2;
 
    //
    // WIN32
    //
    Ret = CpuReadTsc();
 
    //
    // WIN32
    //
    Ret2 = CpuReadTsc();
 
    return Ret2 - Ret;
}