transparency.cpp File Reference

Measurements for debugger transparency. More...

#include "pch.h"

Functions
unsigned long long	TransparentModeRdtscDiffVmexit ()
	get the difference clock cycles between two rdtsc(s)
unsigned long long	TransparentModeRdtscVmexitTracing ()
	get the difference clock cycles between rdtsc+cpuid+rdtsc
int	TransparentModeCpuidTimeStampCounter (UINT64 *Average, UINT64 *StandardDeviation, UINT64 *Median)
	compute the average, standard deviation and median if rdtsc+cpuid+rdtsc
int	TransparentModeRdtscEmulationDetection (UINT64 *Average, UINT64 *StandardDeviation, UINT64 *Median)
	compute the average, standard deviation and median if rdtsc+rdtsc
BOOLEAN	TransparentModeCheckHypervisorPresence (UINT64 *Average, UINT64 *StandardDeviation, UINT64 *Median)
	compute the average, standard deviation and median if rdtsc+cpuid+rdtsc
BOOLEAN	TransparentModeCheckRdtscpVmexit (UINT64 *Average, UINT64 *StandardDeviation, UINT64 *Median)
	compute the average, standard deviation and median if rdtsc+rdtsc

Detailed Description

Measurements for debugger transparency.

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.1

Date

2020-07-07

Copyright

This project is released under the GNU Public License v3.

Function Documentation

TransparentModeCheckHypervisorPresence()

BOOLEAN TransparentModeCheckHypervisorPresence	(	UINT64 *	Average,
		UINT64 *	StandardDeviation,
		UINT64 *	Median )

compute the average, standard deviation and median if rdtsc+cpuid+rdtsc

detects the presence of hypervisor

Parameters

Average	a pointer to save average on it
StandardDeviation	a pointer to standard deviation average on it
Median	a pointer to save median on it

Returns

int

{
    //
    // Check whether the hypervisor is detected or not
    //
    if (TransparentModeCpuidTimeStampCounter(Average, StandardDeviation, Median))
    {
        ShowMessages("hypervisor detected\n");
        return TRUE;
    }
    else
    {
        ShowMessages("hypervisor not detected\n");
        return FALSE;
    }
}

TransparentModeCheckRdtscpVmexit()

BOOLEAN TransparentModeCheckRdtscpVmexit	(	UINT64 *	Average,
		UINT64 *	StandardDeviation,
		UINT64 *	Median )

compute the average, standard deviation and median if rdtsc+rdtsc

detects the presence of rdtsc/p vm-exits

Parameters

Average	a pointer to save average on it
StandardDeviation	a pointer to standard deviation average on it
Median	a pointer to save median on it

Returns

int

{
    //
    // Check whether the system emulating rdtsc/p or not
    //
    if (TransparentModeRdtscEmulationDetection(Average, StandardDeviation, Median))
    {
        ShowMessages("rdtsc/p emulation detected\n");
        return TRUE;
    }
    else
    {
        ShowMessages("rdtsc/p emulation not detected\n");
        return FALSE;
    }
}

TransparentModeCpuidTimeStampCounter()

int TransparentModeCpuidTimeStampCounter	(	UINT64 *	Average,
		UINT64 *	StandardDeviation,
		UINT64 *	Median )

compute the average, standard deviation and median if rdtsc+cpuid+rdtsc

Parameters

Average	a pointer to save average on it
StandardDeviation	a pointer to standard deviation average on it
Median	a pointer to save median on it

Returns

int

{
    double         Avg          = 0;
    double         MeasuredTime = 0;
    vector<double> Results;
 
    for (int i = 0; i < TestCount; i++)
    {
        MeasuredTime = (double)TransparentModeRdtscDiffVmexit();
        Avg          = Avg + MeasuredTime;
 
        Results.push_back(MeasuredTime);
 
        /*
    ShowMessages("(%d) Measured time : %d\n", i, MeasuredTime);
    */
    }
 
    if (Average != NULL && StandardDeviation != NULL && Median != NULL)
    {
        //
        // Compute the average and variance
        //
        GuassianGenerateRandom(Results, Average, StandardDeviation, Median);
    }
 
    Avg = Avg / TestCount;
    return (Avg < 1000 && Avg > 0) ? FALSE : TRUE;
}

TransparentModeRdtscDiffVmexit()

unsigned long long TransparentModeRdtscDiffVmexit

(

)

get the difference clock cycles between two rdtsc(s)

Returns

unsigned long long

{
    unsigned long long ret, ret2;
    int                cpuid_result[4] = {0};
 
    //
    // GCC
    //
    // __asm__ volatile("rdtsc" : "=a" (eax), "=d" (edx));
    // ret = ((unsigned long long)eax) | (((unsigned long long)edx) << 32);
 
    //
    // Win32
    //
    ret = __rdtsc();
 
    /* vm exit forced here. it uses: eax = 0; cpuid; */
 
    //
    // GCC
    //
    //__asm__ volatile("cpuid" : /* no output */ : "a"(0x00));
 
    //
    // WIN32
    //
    __cpuid(cpuid_result, 0);
 
    //
    // GCC
    //
    // __asm__ volatile("rdtsc" : "=a" (eax), "=d" (edx));
    // ret2 = ((unsigned long long)eax) | (((unsigned long long)edx) << 32);
 
    //
    // WIN32
    //
    ret2 = __rdtsc();
 
    return ret2 - ret;
}

TransparentModeRdtscEmulationDetection()

int TransparentModeRdtscEmulationDetection	(	UINT64 *	Average,
		UINT64 *	StandardDeviation,
		UINT64 *	Median )

compute the average, standard deviation and median if rdtsc+rdtsc

Parameters

Average	a pointer to save average on it
StandardDeviation	a pointer to standard deviation average on it
Median	a pointer to save median on it

Returns

int

{
    double         Avg          = 0;
    double         MeasuredTime = 0;
    vector<double> Results;
 
    for (int i = 0; i < TestCount; i++)
    {
        MeasuredTime = (double)TransparentModeRdtscVmexitTracing();
        Avg          = Avg + MeasuredTime;
 
        Results.push_back(MeasuredTime);
 
        /*
    ShowMessages("(%d) Measured time : %d\n", i, MeasuredTime);
    */
    }
 
    if (Average != NULL && StandardDeviation != NULL && Median != NULL)
    {
        //
        // Compute the average and variance
        //
        GuassianGenerateRandom(Results, Average, StandardDeviation, Median);
    }
 
    Avg = Avg / TestCount;
    return (Avg < 750 && Avg > 0) ? FALSE : TRUE;
}

TransparentModeRdtscVmexitTracing()

unsigned long long TransparentModeRdtscVmexitTracing

(

)

get the difference clock cycles between rdtsc+cpuid+rdtsc

Returns

unsigned long long

{
    unsigned long long ret, ret2;
 
    //
    // GCC
    //
    // __asm__ volatile("rdtsc" : "=a" (eax), "=d" (edx));
    // ret = ((unsigned long long)eax) | (((unsigned long long)edx) << 32);
 
    //
    // WIN32
    //
    ret = __rdtsc();
 
    //
    // GCC
    //
    // __asm__ volatile("rdtsc" : "=a"(eax), "=d"(edx));
    // ret2 = ((unsigned long long)eax) | (((unsigned long long)edx) << 32);
 
    //
    // WIN32
    //
    ret2 = __rdtsc();
 
    return ret2 - ret;
}