No. I mean that you have complete control over what the code is to be
executed when you perform the vmlaunch/vmresume. You set the full
context for the thread about to run, including the RIP of course. So the
page of code which this RIP points to is under your control and you can
patch that code about to be executed. I was playing around with this for
certain Win32 API calls and would patch the code to perform a vmcall,
instead of the Win32 call, which would cause a vmexit.
Pete
–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295
------ Original Message ------
From: “Amitrajit B”
To: “Windows System Software Devs Interest List”
Sent: 6/16/2016 10:43:58 PM
Subject: Re: Re[2]: [ntdev] HyperVisor : Inspecting instructions
>@Pscott : when you say patch the opcode stream, do this mean one needs
>an agent inside the VM?
>
>On Thu, Jun 16, 2016 at 7:05 PM, PScott
>wrote:
>>Like I said, I have successfully implemented a scheme where I patch
>>the opcode stream being executed and have the code perform a vmcall,
>>which will result in a vmexit, when certain events occur. It is
>>definitely tedious and lengthy. As for patching the general purpose
>>instructions you are requesting, I would think, in theory, it could be
>>done but again, very tedious except in the simplest of cases.
>>
>>Pete
>>
>>–
>>Kernel Drivers
>>Windows File System and Device Driver Consulting
>>http://www.kerneldrivers.com/
>>866.263.9295
>>
>>
>>
>>------ Original Message ------
>>From: “A P”
>>To: “Windows System Software Devs Interest List”
>>Sent: 6/16/2016 6:21:47 PM
>>Subject: Re: [ntdev] HyperVisor : Inspecting instructions
>>
>>>Thanks all.
>>>
>>>@Mike : At this time it is mostly research, I want to be potentially
>>>able to add interceptors for certain instructions and inspect the
>>>data they act on. A few of these are call, ret, jmp, add, sub, mov.
>>>
>>>thats all there is to it now.
>>>
>>>are these instructions mentioned above trappable in VMX/SVM?
>>>
>>>
>>>how do I set a hardware break point for an instruction? since this is
>>>for research, i dont mind the perf hit as long as it is not as bad as
>>>single stepping.
>>>
>>>
>>>On Thu, Jun 16, 2016 at 4:09 PM, Mike Larkin
>>>wrote:
>>>>On Thu, Jun 16, 2016 at 03:59:57PM -0700, A P wrote:
>>>> > Hello all,
>>>> >
>>>> > is it possible for a hypervisor (any type) to inspect specific
>>>> > instructions. Example, say the add or sub or what ever.
>>>> >
>>>> > i am doing some reading, and it looks like one of the differences
>>>>between a
>>>> > hypervisor and emulator is since emulators (potentially) need to
>>>>implement
>>>> > each instruction, they can inspect each instruction easily and
>>>> > (potentially) change it’s behavior.
>>>> >
>>>> > However, in hypervisors, that is not the case, the goal is to
>>>>execute
>>>> > instructions on the native processor hence such inspection is not
>>>>required.
>>>> >
>>>> > But if one wants to do this in a hyperviosr is that possible? I am
>>>>aware of
>>>> > trap flags but I don’t to set the cpu in single step mode to
>>>>achieve this.
>>>> > Any other better suggestions?
>>>>
>>>>It depends on what you are trying to do. Some instructions are
>>>>trappable in
>>>>VMX/SVM operation, but many are not. I can’t think of an arbitarary
>>>>way to
>>>>inspect individual general purpose instructions (like add, sub, etc)
>>>>unless
>>>>they are operating against memory operands and the pages containing
>>>>those
>>>>operands are marked as not present in EPT/NPT (and you are using
>>>>EPT/NPT
>>>>to begin with), and the hypervisor is configured to take #PFs before
>>>>the guest
>>>>sees them. Then you’d at least stand a chance. But that sort of
>>>>construction
>>>>certainly isn’t general-purpose in nature and would obviously
>>>>require you
>>>>to set that up ahead of time.
>>>>
>>>>If it were just a single instruction or two you wanted to trap on,
>>>>you could
>>>>set a hardware breakpoint there and configure the hypervisor to take
>>>>the
>>>>exception before delivery to the guest (eg, exception bitmap
>>>>exiting).
>>>>
>>>>Other instructions that are generally not trappable but cause
>>>>information
>>>>leakage (like SGDT and friends) can be registered for exits, and in
>>>>those
>>>>cases you’ll see those in your exit handler if you enable those exit
>>>>types.
>>>>
>>>>As in many threads on this list, why don’t you say what you are
>>>>trying to do
>>>>at a higher level instead of making everyone guess, though?
>>>>
>>>>-ml
>>>>
>>>> >
>>>> > Al
>>>> >
>>>> > —
>>>> > NTDEV is sponsored by OSR
>>>> >
>>>> > Visit the list online at:
>>>>http:
>>>> >
>>>> > MONTHLY seminars on crash dump analysis, WDF, Windows internals
>>>>and software drivers!
>>>> > Details at http:
>>>> >
>>>> > To unsubscribe, visit the List Server section of OSR Online at
>>>>http:
>>>>
>>>>—
>>>>NTDEV is sponsored by OSR
>>>>
>>>>Visit the list online at:
>>>>http:
>>>>
>>>>MONTHLY seminars on crash dump analysis, WDF, Windows internals and
>>>>software drivers!
>>>>Details at http:
>>>>
>>>>To unsubscribe, visit the List Server section of OSR Online at
>>>>http:
>>>
>>>— NTDEV is sponsored by OSR Visit the list online at: MONTHLY
>>>seminars on crash dump analysis, WDF, Windows internals and software
>>>drivers! Details at To unsubscribe, visit the List Server section of
>>>OSR Online at
>>
>>—
>>NTDEV is sponsored by OSR
>>
>>Visit the list online at:
>>http:
>>
>>MONTHLY seminars on crash dump analysis, WDF, Windows internals and
>>software drivers!
>>Details at http:
>>
>>To unsubscribe, visit the List Server section of OSR Online at
>>http:
>
>
>
>–
>
>- ab
>— NTDEV is sponsored by OSR Visit the list online at: MONTHLY
>seminars on crash dump analysis, WDF, Windows internals and software
>drivers! Details at To unsubscribe, visit the List Server section of
>OSR Online at</http:></http:></http:></http:></http:></http:></http:></http:></http:>
