|
On 21/09/2013 17:02, Andrew Cooper
wrote:
On 21/09/2013 15:52, Kai Luo wrote:
Hello everyone:
Recently,I am working on a feature of intercepting the
giving function in windows SSDT table,I replace address
of function in SSDT whith an invalid address.
The question is when I trapped the page fault caused by
accessing the invalid address and I recovered it to
the correct function address,I can recive the same page
fault again.That is to say:
1.I trapped a page fault caused by an invalid
address in sh_page_fault(struct vcpu *v,unsigned long
va,struct cpu_user_regs *regs)
2.I rescover the guest eip to the correct address
using the following code(Missing something?):
regs->eip = <correct_addr>
__vmwrite(GUEST_RIP,
<correct_addr>);
3.Another page fault caused by the same address
occured
I dumped the vmcs when the page faults occured,contents
in vmcs are almost the same except the 'Virtual processor
ID',still confused.Could you help me to analyse the strange
phenomenon?Thank you very
much!
Jone
Ignoring for now whether this is sensible in the slightest, are
you certain that the SSDT function is only being executed once by
Windows and still resulting in two pagefaults?
(Not directly related, but) sh_page_fault() is only valid for
shadow mode, and not valid for EPT/NPT, which HVM domains default
on appropriate hardware.
The vmentry helper writes regs->rip back to GUEST_RIP so you
should not need to do that. If you have followed the instructions
at the top of sh_page_fault(), the guest should retry the access
with the correct RIP.
As for the VPID being different, that is to be expected.
Thinking about this a little more, it is utterly crazy. The SSDT
will be made of AML which will be interpreted. The pagefault will
almost certainly have occurred because of a read from the bad
address, rather than an instruction fetch. Fixing up rip will
result in an unexpected branch as far as the VM is concerned. I am
surprised it didn't BSOD.
If you still insist on using this method, then you would need to
decode the instruction under regs->rip and fix up the appropriate
source operand.
~Andrew
|
