-
Notifications
You must be signed in to change notification settings - Fork 8
Expand file tree
/
Copy pathloop.c
More file actions
142 lines (130 loc) · 4.26 KB
/
Copy pathloop.c
File metadata and controls
142 lines (130 loc) · 4.26 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
#include <stdio.h>
#include "process.h"
#include "mm.h"
#include "syscall.h"
#include "dump.h"
static const char *
get_exit_reason_str(int reason)
{
switch (reason)
{
case WHvRunVpExitReasonNone:
return "none";
case WHvRunVpExitReasonMemoryAccess:
return "memory";
case WHvRunVpExitReasonUnrecoverableException:
return "exception";
case WHvRunVpExitReasonCanceled:
return "canceled";
default:
return "undefined";
}
}
static void
print_instruction(mm_t *mm)
{
WHV_VP_EXIT_CONTEXT *context = &mm->vm->exit_context.VpContext;
uint8_t len = context->InstructionLength;
fprintf(stderr, "inst(%d): ", len);
if (len == 0)
len = 8;
uint64_t rip = context->Rip;
uint8_t *p = (uint8_t *)mm_gvirt_to_hvirt(mm, rip);
for (int i = 0; i < len; i++)
fprintf(stderr, "%02x ", p[i]);
fprintf(stderr, "\n");
}
void handle_vmexit(thread_t *thread)
{
vcpu_t *vcpu = &thread->vcpu;
mm_t *mm = &thread->process->mm;
vm_t *vm = vcpu->vm;
int reason = vm->exit_context.ExitReason;
if (reason == WHvRunVpExitReasonUnrecoverableException)
{
uint16_t *inst = (uint16_t *)mm_gvirt_to_hvirt(mm, vm->exit_context.VpContext.Rip);
if (*inst == 0x050f)
{ // syscall
uint64_t sysnum;
uint64_t args[6];
vcpu_regs_t regs1[] = {
VCPU_REGS_ENTRY_GET(RAX, &sysnum),
VCPU_REGS_ENTRY_GET(RDI, &args[0]),
VCPU_REGS_ENTRY_GET(RSI, &args[1]),
VCPU_REGS_ENTRY_GET(RDX, &args[2]),
VCPU_REGS_ENTRY_GET(R10, &args[3]),
VCPU_REGS_ENTRY_GET(R8, &args[4]),
VCPU_REGS_ENTRY_GET(R9, &args[5]),
};
vcpu_get_regs(vcpu, regs1, countof(regs1));
vcpu_regvalue_t rax = handle_syscall(thread, sysnum, args);
vcpu_regvalue_t rip = vm->exit_context.VpContext.Rip + 2;
vcpu_regs_t regs2[] = {
VCPU_REGS_ENTRY_SET(RIP, rip),
VCPU_REGS_ENTRY_SET(RAX, rax),
};
vcpu_set_regs(vcpu, regs2, countof(regs2));
vcpu->in_operation = true;
return;
}
}
vcpu->in_operation = false;
printf("exit reason: %s (%x)\n", get_exit_reason_str(reason), reason);
printf("state: %x\n", vm->exit_context.VpContext.ExecutionState.AsUINT16);
printf("cs:rip : %x:%llx\n", vm->exit_context.VpContext.Cs.Selector, vm->exit_context.VpContext.Rip);
switch (vm->exit_context.ExitReason)
{
case WHvRunVpExitReasonMemoryAccess:
print_instruction(mm);
printf("access info: %x\n", vm->exit_context.MemoryAccess.AccessInfo.AsUINT32);
printf("gpa: %llx\n", vm->exit_context.MemoryAccess.Gpa);
printf("gva: %llx\n", vm->exit_context.MemoryAccess.Gva);
#if 0
vcpu_regvalue_t rsp;
vcpu_regs_t regs[] = {
VCPU_REGS_ENTRY_GET(RSP, &rsp),
};
vcpu_get_regs(vcpu, regs, countof(regs));
dump_guest_stack(mm, rsp);
#endif
break;
case WHvRunVpExitReasonUnrecoverableException: {
printf("info: %x\n", vm->exit_context.VpException.ExceptionInfo.AsUINT32);
printf("type: %d\n", vm->exit_context.VpException.ExceptionType);
printf("error code: %d\n", vm->exit_context.VpException.ErrorCode);
printf("inst count: %d\n", vm->exit_context.VpException.InstructionByteCount);
printf("parameter: %llx\n", vm->exit_context.VpException.ExceptionParameter);
print_instruction(mm);
break;
}
default:
break;
}
vcpu_regvalue_t rax, rcx, rdx, rbx, rsp, rbp, rsi, rdi, r8, r9, r10, r11, r12, r13, r14, r15, rflags;
vcpu_regs_t regs[] = {
VCPU_REGS_ENTRY_GET(RAX, &rax),
VCPU_REGS_ENTRY_GET(RCX, &rcx),
VCPU_REGS_ENTRY_GET(RDX, &rdx),
VCPU_REGS_ENTRY_GET(RBX, &rbx),
VCPU_REGS_ENTRY_GET(RSP, &rsp),
VCPU_REGS_ENTRY_GET(RBP, &rbp),
VCPU_REGS_ENTRY_GET(RSI, &rsi),
VCPU_REGS_ENTRY_GET(RDI, &rdi),
VCPU_REGS_ENTRY_GET(R8, &r8),
VCPU_REGS_ENTRY_GET(R9, &r9),
VCPU_REGS_ENTRY_GET(R10, &r10),
VCPU_REGS_ENTRY_GET(R11, &r11),
VCPU_REGS_ENTRY_GET(R12, &r12),
VCPU_REGS_ENTRY_GET(R13, &r13),
VCPU_REGS_ENTRY_GET(R14, &r14),
VCPU_REGS_ENTRY_GET(R15, &r15),
VCPU_REGS_ENTRY_GET(RFLAGS, &rflags),
};
vcpu_get_regs(vcpu, regs, countof(regs));
fprintf(stderr, "rax=%016lx, rbx=%016lx, rcx=%016lx, rdx=%016lx\n", rax, rbx, rcx, rdx);
fprintf(stderr, "rsi=%016lx, rdi=%016lx, rbp=%016lx, rsp=%016lx\n", rsi, rdi, rbp, rsp);
fprintf(stderr, " r8=%016lx, r9=%016lx, r10=%016lx, r11=%016lx\n", r8, r9, r10, r11);
fprintf(stderr, "r12=%016lx, r13=%016lx, r14=%016lx, r15=%016lx\n", r12, r13, r14, r15);
dump_guest_stack(mm, rsp);
return;
}