Getting Started
Using HyperDbg
Tips & Tricks
Contribution
Design
VMX root-mode compatible message tracing
How we transfer the buffers safely from the kernel and vmx-root to the debugger
Without any doubt, one of the hardest parts of designing a hypervisor is sending a message from Vmx root-mode to Vmx non-root mode. This is because you have lots of limitations like you can’t access non-paged buffer, and of course, most of the NT functions are not (ANY IRQL) compatible as they might access the buffers that reside in paged pool.
The things are ending here, there are plenty of other limitation to deal with.
This section is inspired by Chapter 6: Kernel Mechanisms (High IRQL Synchronization) from the Windows Kernel Programming book by Pavel Yosifovich which is a really amazing book if you want to start with kernel programming.
Concepts
This section describes some of the Operating System concepts, you should know before starting.
What’s a spinlock?
The Spin Lock is a bit in memory that provides atomic test and modify operations. When a CPU tries to acquire a spinlock, and it’s not currently free, the CPU keeps spinning on the spinlock, busy waiting for it to be released by another CPU means that it keeps checking until another thread which acquired it first release it.
Test-and-Set
You probably read about Test and Set in university. Still, in case you didn’t, in computer science, the test-and-set instruction is an instruction used to write 1 (set) to a memory location and return its old value as a single atomic (i.e., non-interruptible) operation. If multiple processes may access the same memory location, and if a process is currently performing a test-and-set, no other process may begin another test-and-set until the first process’s test-and-set is finished.
What do we mean by “Safe”?
The “safe” is used a lot in hypervisors. By “safe,” we mean something that works all the time and won’t cause system crash or system halt. It’s because it’s so tricky to manage codes in vmx root-mode. After all, interrupts are masked (disabled), or transfer buffer from vmx root-mode to vmx non-root mode needs extra effort, and we should be cautious and avoid executing some APIs to be safe.
What is DPC?
A Deferred Procedure Call (DPC) is a Windows mechanism that allows high-priority tasks (e.g., an interrupt handler) to defer required but lower-priority tasks for later execution. This permits device drivers and other low-level event consumers to perform the high-priority part of their processing quickly and schedule non-critical additional processing for execution at a lower priority.
DPCs are implemented by DPC objects which are created and initialized by the kernel when a device driver or some other kernel-mode program issues requests for DPC. The DPC request is then added to the end of a DPC queue. Each processor has a separate DPC queue. DPCs have three priority levels: low, medium, and high. By default, all DPCs are set to medium priority. When Windows drops to an IRQL of Dispatch/DPC level, it checks the DPC queue for any pending DPCs and executes them until the queue is empty or some other interrupt with a higher IRQL occurs.
This is the description of DPCs from MSDN:
Because ISRs must execute as quickly as possible, drivers must usually postpone the completion of servicing an interrupt until after the ISR returns. Therefore, the system provides support for deferred procedure calls (DPCs), which can be queued from ISRs and which are executed at a later time and at a lower IRQL than the ISR.
Challenges
For example, Vmx-root mode is not a HIGH_IRQL interrupt (with discussing it in Discussion Section), but as it disables all of the interrupts, we can think like it’s a HIGH_IRQL state. The problem is that must of synchronization functions are designed to be worked on IRQL less than DISPATCH_LEVEL.
Why is it problematic? Imagine you have a one-core processor, and your function requires a spinlock (let say it’s merely a buffer that needs to be accessed). The function raises the IRQL to DISPATCH_LEVEL. Now the Windows Scheduler can’t interrupt the function until it releases the spinlock and lowers the IRQL to PASSIVE_LEVEL or APC_LEVEL. During the execution of the function, a vm-exit occurs; thus, we’re in vmx root-mode now. It’s because, as I told you, vm-exit happens as if it’s a HIGH_IRQL interrupt.
Now, what if we want to access that buffer in vmx root mode? Two scenarios might occur.
- We wait on a spinlock that was previously acquired by a thread in vmx non-root mode and this we have to wait forever. A deadlock occurs.
- We enter the function without looking at the lock (while there is another thread that enters the function at the same time.) so it results in a corrupted buffer and invalid data.
The other limitation is in Windows design putting the thread into a waiting state cannot be done at IRQL DISPATCH_LEVEL or higher. It’s because in Windows when you acquire a spinlock it raises the IRQL to 2 – DISPATCH_LEVEL (if not already there), acquire the spinlock, perform the work and finally release the spinlock and lower IRQL back.
If you look at a function like KeAcquireSpinLock and KeReleaseSpinLock, they get an IRQL in their arguments. First, KeAcquireSpinLock saves current IRQL to the parameter supplied by the user then raises the IRQL to DISPATCH_LEVEL and sets a bit. When the function finished its works with shared data, then it calls KeReleaseSpinLock and passes that old IRQL parameter so this function unsets the bit and restore the old IRQL (lowers the IRQL).
Windows has 4 kinds of Spinlocks,
- 1.KeAcquireSpinLock – KeReleaseSpinLock : This pair can be called at IRQL <= DISPATCH_LEVEL.
- 2.KeAcquireSpinLockAtDpcLevel – KeReleaseSpinLockFromDpcLevel : This pair can be call at IRQL = DISPATCH_LEVEL only, it’s more optimized if you are already in IRQL 2 as it doesn’t saves the old IRQL and it’s specially designed to work on DPC routine.
- 3.KeAcquireInterruptSpinLock – KeReleaseInterruptSpinLock: Hardware based use this pair e.g in Interrupt Service Routine (ISR) or it used by drivers with an interrupt source.
- 4.ExInterlockedXxx : This function raises the IRQL to HIGH_LEVEL and perform it’s task, it doesn’t need a release function as no one interrupt us on HIGH_IRQL.
But unfortunately, things are more complicated when it comes to vmx root-mode. We don’t have IRQL in the vmx root-mode. It’s an operating system thing, so we can’t use any of the above functions, and things are getting worst if we want to use our message tracing mechanism between multiple cores!
For these reasons, we have to design our custom spinlock.
Designing A Spinlock
Designing spinlock in a multi-core system by its nature needs the hardware support for atomic operation means that hardware (most of the time processor) should guarantee that an operation is performed just by logical (hyper-threaded) core and it’s non-interruptible.
The design of this mechanism in the processor is beyond the scope of this article. We simply use an intrinsic function provided by Windows called “_interlockedbittestandset“.
This makes our implementation super simple. We just need to use the following function, and it’s the responsibility of the processor to take care of everything.
We should use volatile keyword in parameters too, otherwise, it’s like un-volatiling.
1
inline BOOLEAN SpinlockTryLock(volatile LONG* Lock)
2
{
3
return (!(*Lock) && !_interlockedbittestandset(Lock, 0));
4
}
Copied!
Now we need to spin! If the above function was not successful, then we have to keep CPU checking to see when another processor releases the lock.
1
void SpinlockLock(volatile LONG* Lock)
2
{
3
unsigned wait = 1;
4
5
while (!SpinlockTryLock(Lock))
6
{
7
for (unsigned i = 0; i < wait; ++i)
8
{
9
_mm_pause();
10
}
11
12
// Don't call "pause" too many times. If the wait becomes too big,
13
// clamp it to the max_wait.
14
15
if (wait * 2 > max_wait)
16
{
17
wait = max_wait;
18
}
19
else
20
{
21
wait = wait * 2;
22
}
23
}
24
}
Copied!
If you wonder what is the _mm_pause() then it’s equal to PAUSE instruction in x86.
Pause instruction is commonly used in the loop of testing spinlock, when some other thread owns the spinlock, to mitigate the tight loop.
PAUSE notifies the CPU that this is a spinlock wait loop, so memory and cache accesses may be optimized. See also pause instruction in x86 for some more details about avoiding the memory-order mis-speculation when leaving the spin-loop. PAUSE may stop CPU for some time to save power. Older CPUs decode it as REP NOP, so you don’t have to check if it’s supported. Older CPUs will simply do nothing (NOP) as fast as possible.
For releasing the lock, there is nothing special to do, so simply unset it without caring for any other processor as there is no other processor that wants to unset it.
1
void SpinlockUnlock(volatile LONG* Lock)
2
{
3
*Lock = 0;
4
}
Copied!
The “volatile” keyword tells the compiler that the value of the variable may change at any time without any action being taken by the code the compiler finds nearby. The implications of this are quite serious. There are lots of examples here if you have a problem with understanding “volatile“.
Message Tracer Design
For solving the above the challenge about deadlock, I create two message pools for saving messages. The first pool is designed to be used as storage for vmx non-root messages (buffers) and the second pool is used for vmx-root messages.
We have the following structure that describes the state of each of these two pools.
1
typedef struct _LOG_BUFFER_INFORMATION {
2
3
UINT64 BufferStartAddress; // Start address of the buffer
4
UINT64 BufferEndAddress; // End address of the buffer
5
6
UINT64 BufferForMultipleNonImmediateMessage; // Start address of the buffer for accumulating non-immadiate messages
7
UINT32 CurrentLengthOfNonImmBuffer; // the current size of the buffer for accumulating non-immadiate messages
8
9
10
KSPIN_LOCK BufferLock; // SpinLock to protect access to the queue
11
KSPIN_LOCK BufferLockForNonImmMessage; // SpinLock to protect access to the queue of non-imm messages
12
13
UINT32 CurrentIndexToSend; // Current buffer index to send to user-mode
14
UINT32 CurrentIndexToWrite; // Current buffer index to write new messages
15
16
} LOG_BUFFER_INFORMATION, * PLOG_BUFFER_INFORMATION;
Copied!
Generally, we’ll save the buffer as illustrated below, each chunk of the message came with BUFFER_HEADER that describes that chunk.
Other information for the buffer like Current Index to Write and Current to Send is saved in the above structure.
1
A core buffer is like this , it's divided into MaximumPacketsCapacity chucks,
2
each chunk has PacketChunkSize + sizeof(BUFFER_HEADER) size
3
4
__________________________
5
| BUFFER_HEADER |
6
|_________________________|
7
| |
8
| BODY |
9
| (Buffer) |
10
| size = PacketChunkSize |
11
| |
12
|_________________________|
13
| BUFFER_HEADER |
14
|_________________________|
15
| |
16
| BODY |
17
| (Buffer) |
18
| size = PacketChunkSize |
19
| |
20
|_________________________|
21
| |
22
| |
23
| |
24
| |
25
| . |
26
| . |
27
| . |
28
| |
29
| |
30
| |
31
| |
32
|_________________________|
33
| BUFFER_HEADER |
34
|_________________________|
35
| |
36
| BODY |
37
| (Buffer) |
38
| size = PacketChunkSize |
39
| |
40
|_________________________|
Copied!
The BUFFER_HEADER is defined like this,
1
// Message buffer structure
2
typedef struct _BUFFER_HEADER {
3
UINT32 OpeationNumber; // Operation ID to user-mode
4
UINT32 BufferLength; // The actual length
5
BOOLEAN Valid; // Determine whether the buffer was valid to send or not
6
} BUFFER_HEADER, * PBUFFER_HEADER;
Copied!
We save the length of used length of the chunk and a bit which determine whether we sent it before or not.
Operation Number is number, which will be sent to the user-mode to show the type of the buffer that came from the kernel. In other words, it’s a number that indicates the intention (and structure) of the buffer, so the user-mode application will know what to do with this buffer.
The following Operation Numbers are currently defined :
1
// Message buffer structure
2
typedef struct _BUFFER_HEADER {
3
UINT32 OpeationNumber; // Operation ID to user-mode
4
UINT32 BufferLength; // The actual length
5
BOOLEAN Valid; // Determine whether the buffer was valid to send or not
6
} BUFFER_HEADER, * PBUFFER_HEADER;
Copied!
Each of them shows a different type of message, and the last one shows that a bunch buffer is accumulated in this buffer. This message tracing is designed to send any kind of the buffer from both vmx root and OS to the user-mode, so it’s not limited just to sending messages, we can send buffers with custom structures and different Operation Numbers.
The last thing about our message tracing is, it can be configured with the following constants, you can change them in order to have a better performance for your exclusive use.
1
// Default buffer size
2
#define MaximumPacketsCapacity 1000 // number of packets
3
#define PacketChunkSize 1000 // NOTE : REMEMBER TO CHANGE IT IN USER-MODE APP TOO
4
#define UsermodeBufferSize sizeof(UINT32) + PacketChunkSize + 1 /* Becausee of Opeation code at the start of the buffer + 1 for null-termminating */
5
#define LogBufferSize MaximumPacketsCapacity * (PacketChunkSize + sizeof(BUFFER_HEADER))
Copied!
You can configure things like the maximum number of chunks in a buffer and also the size of each chunk. Setting the above variables is necessary in some cases if there is no thread to consume (read) these chunks and pools are full; it replaces the previous unread buffer. Hence, if you can’t frequently consume the pools, then it’s better to specify a higher number for MaximumPacketsCapacity so that you won’t lose anything.
Initialization Phase
In the initialization phase, we allocate space for the above structure (2 times, one for vmx non-root and one for vmx-root) and then allocate the buffers to be used as the storage for saving our messages.
We have to zero them all and also KeInitializeSpinLock to initialize the spinlock. We use this spinlock only for vmx non-root, and this function makes sure that the value for the lock is unset. We do the same for our custom spinlock (VmxRootLoggingLock), just unset it.
You might ask, what is the “BufferLockForNonImmMessage“, it’s another lock that will use it as optimization (see later).
All in all, we have the following code.
1
/* Initialize the buffer relating to log message tracing */
2
BOOLEAN LogInitialize() {
3
4
5
// Initialize buffers for trace message and data messages (wee have two buffers one for vmx root and one for vmx non-root)
6
MessageBufferInformation = ExAllocatePoolWithTag(NonPagedPool, sizeof(LOG_BUFFER_INFORMATION) * 2, POOLTAG);
7
8
if (!MessageBufferInformation)
9
{
10
return FALSE; //STATUS_INSUFFICIENT_RESOURCES
11
}
12
13
// Zeroing the memory
14
RtlZeroMemory(MessageBufferInformation, sizeof(LOG_BUFFER_INFORMATION) * 2);
15
16
// Initialize the lock for Vmx-root mode (HIGH_IRQL Spinlock)
17
VmxRootLoggingLock = 0;
18
19
// Allocate buffer for messages and initialize the core buffer information
20
for (int i = 0; i < 2; i++)
21
{
22
23
// initialize the lock
24
// Actually, only the 0th buffer use this spinlock but let initialize it for both but the second buffer spinlock is useless
25
// as we use our custom spinlock.
26
KeInitializeSpinLock(&MessageBufferInformation[i].BufferLock);
27
KeInitializeSpinLock(&MessageBufferInformation[i].BufferLockForNonImmMessage);
28
29
// allocate the buffer
30
MessageBufferInformation[i].BufferStartAddress = ExAllocatePoolWithTag(NonPagedPool, LogBufferSize, POOLTAG);
31
MessageBufferInformation[i].BufferForMultipleNonImmediateMessage = ExAllocatePoolWithTag(NonPagedPool, PacketChunkSize, POOLTAG);
32
33
if (!MessageBufferInformation[i].BufferStartAddress)
34
{
35
return FALSE; // STATUS_INSUFFICIENT_RESOURCES
36
}
37
38
// Zeroing the buffer
39
RtlZeroMemory(MessageBufferInformation[i].BufferStartAddress, LogBufferSize);
40
41
// Set the end address
42
MessageBufferInformation[i].BufferEndAddress = (UINT64)MessageBufferInformation[i].BufferStartAddress + LogBufferSize;
43
}
44
}
Copied!
Sending Phase (Saving Buffer and adding them to pools)
In a regular Windows routine generally, we shouldn’t be on IRQL more than Dispatch Level. There is no case that our log manager needs to be used in higher IRQLs, so we don’t care about them; thus, we have two different approaches here. First, we acquire the lock (spinlock) using KeAcquireSpinLock in vmx non-root as it’s a Windows optimized way to acquire a lock and for vmx-root mode, we acquire the lock using our previously designed spinlock.
As I told you above, we want to fix this problem that might a vmx-exit occurs when we acquired a lock, so it’s not possible to use the same spinlock as deadlock might happen.
Now we have to see whether we are operating from vmx non-root or vmx root, based on this condition, we select our lock and the index of the buffer that we want to put our message into it.
I’m not gonna explain each step, as it’s easy, it’s just managing buffer and copying data from a buffer to another buffer and also the code is well commented so you can read the code, instead, I explain tricky parts of our message tracing.
After creating a header for our new message buffer, we will copy the bytes and change the information about buffer’s indexes. The last step here is to see whether any thread is waiting to receive our message or not.
If there is no thread waiting for our message then nothing more to do here but if there is a thread which is IRP Pending state (I explain about it later), then we use KeInsertQueueDpc so that it will be added to our DPC Queue which will be subsequently executed by Windows in IRQL == DISPATCH_LEVEL.
It means that our callback function will execute by Windows later and of course, Windows execute our function in vmx non-root so it’s safe. I’ll describe this callback and how we create a DPC later.
Finally, we have to release the locks so that other threads can enter.
1
/* Save buffer to the pool */
2
BOOLEAN LogSendBuffer(UINT32 OperationCode, PVOID Buffer, UINT32 BufferLength)
3
{
4
KIRQL OldIRQL;
5
UINT32 Index;
6
BOOLEAN IsVmxRoot;
7
8
if (BufferLength > PacketChunkSize - 1 || BufferLength == 0)
9
{
10
// We can't save this huge buffer
11
return FALSE;
12
}
13
14
// Check that if we're in vmx root-mode
15
IsVmxRoot = GuestState[KeGetCurrentProcessorNumber()].IsOnVmxRootMode;
16
17
// Check if we're in Vmx-root, if it is then we use our customized HIGH_IRQL Spinlock, if not we use the windows spinlock
18
if (IsVmxRoot)
19
{
20
// Set the index
21
Index = 1;
22
SpinlockLock(&VmxRootLoggingLock);
23
}
24
else
25
{
26
// Set the index
27
Index = 0;
28
// Acquire the lock
29
KeAcquireSpinLock(&MessageBufferInformation[Index].BufferLock, &OldIRQL);
30
}
31
32
// check if the buffer is filled to it's maximum index or not
33
if (MessageBufferInformation[Index].CurrentIndexToWrite > MaximumPacketsCapacity - 1)
34
{
35
// start from the begining
36
MessageBufferInformation[Index].CurrentIndexToWrite = 0;
37
}
38
39
// Compute the start of the buffer header
40
BUFFER_HEADER* Header = (BUFFER_HEADER*)((UINT64)MessageBufferInformation[Index].BufferStartAddress + (MessageBufferInformation[Index].CurrentIndexToWrite * (PacketChunkSize + sizeof(BUFFER_HEADER))));
41
42
// Set the header
43
Header->OpeationNumber = OperationCode;
44
Header->BufferLength = BufferLength;
45
Header->Valid = TRUE;
46
47
/* Now it's time to fill the buffer */
48
49
// compute the saving index
50
PVOID SavingBuffer = ((UINT64)MessageBufferInformation[Index].BufferStartAddress + (MessageBufferInformation[Index].CurrentIndexToWrite * (PacketChunkSize + sizeof(BUFFER_HEADER))) + sizeof(BUFFER_HEADER));
51
52
// Copy the buffer
53
RtlCopyBytes(SavingBuffer, Buffer, BufferLength);
54
55
// Increment the next index to write
56
MessageBufferInformation[Index].CurrentIndexToWrite = MessageBufferInformation[Index].CurrentIndexToWrite + 1;
57
58
// check if there is any thread in IRP Pending state, so we can complete their request
59
if (GlobalNotifyRecord != NULL)
60
{
61
/* there is some threads that needs to be completed */
62
// set the target pool
63
GlobalNotifyRecord->CheckVmxRootMessagePool = IsVmxRoot;
64
// Insert dpc to queue
65
KeInsertQueueDpc(&GlobalNotifyRecord->Dpc, GlobalNotifyRecord, NULL);
66
67
// set notify routine to null
68
GlobalNotifyRecord = NULL;
69
}
70
71
// Check if we're in Vmx-root, if it is then we use our customized HIGH_IRQL Spinlock, if not we use the windows spinlock
72
if (IsVmxRoot)
73
{
74
SpinlockUnlock(&VmxRootLoggingLock);
75
}
76
else
77
{
78
// Release the lock
79
KeReleaseSpinLock(&MessageBufferInformation[Index].BufferLock, OldIRQL);
80
}
81
}
Copied!
Reading Phase (Read buffers and send them to user-mode)
It’s time to read the previously filled buffer! The fact that we add a DPC in the previous function “LogSendBuffer” shows that the “LogReadBuffer” is executed in vmx non-root mode so we can freely use most of the APIs (not all of them).
Theoretically, we have a problem here, if we want to read a buffer from the vmx root-mode pool, then it might cause a deadlock as we acquired a vmx root-mode lock and might a vm-exit occur. Hence, we spin on this lock in vmx root mode forever, but practically there is no deadlock here. Can you guess why?
It’s because our LogReadBuffer executes in DISPATCH_LEVEL so the Windows scheduler won’t interrupt us, and our function is executed without any interruption and the fact that we’re not doing anything fancy here. I mean, we’re not performing anything (like CPUID) that causes a vm-exit in our code, so practically there is nothing to cause deadlock here, but we should keep in mind that we’re not allowed to run codes that cause vmx-exit.
We compute the header address based on previous information and also set the valid bit to zero so that it shows that this buffer is previously used.
Then we copy the buffer to the buffer that specified in arguments also put the Operation Number on the top of the target buffer so that the future functions will know about the intention of this buffer. We can also use DbgPrint to show the messages to the kernel debugger. Using DbgPrint in DISPATCH_LEVEL (vmx non-root mode) is safe. We might need to use DbgPrint multiple times as this function has a maximum of 512 bytes by default. Even though you can change the limit number but we assume the default size is selected.
Finally, we have to reset some of the information regarding buffer, clear the buffer messages (it’s not necessary to zero the buffer, but for making debug process easier, I prefer to zero the buffer), and release the locks.
1
/* return of this function shows whether the read was successfull or not (e.g FALSE shows there's no new buffer available.)*/
2
BOOLEAN LogReadBuffer(BOOLEAN IsVmxRoot, PVOID BufferToSaveMessage, UINT32* ReturnedLength) {
3
4
KIRQL OldIRQL;
5
UINT32 Index;
6
7
// Check if we're in Vmx-root, if it is then we use our customized HIGH_IRQL Spinlock, if not we use the windows spinlock
8
if (IsVmxRoot)
9
{
10
// Set the index
11
Index = 1;
12
13
// Acquire the lock
14
SpinlockLock(&VmxRootLoggingLock);
15
}
16
else
17
{
18
// Set the index
19
Index = 0;
20
21
// Acquire the lock
22
KeAcquireSpinLock(&MessageBufferInformation[Index].BufferLock, &OldIRQL);
23
}
24
25
// Compute the current buffer to read
26
BUFFER_HEADER* Header = (BUFFER_HEADER*)((UINT64)MessageBufferInformation[Index].BufferStartAddress + (MessageBufferInformation[Index].CurrentIndexToSend * (PacketChunkSize + sizeof(BUFFER_HEADER))));
27
28
if (!Header->Valid)
29
{
30
// there is nothing to send
31
return FALSE;
32
}
33
34
/* If we reached here, means that there is sth to send */
35
// First copy the header
36
RtlCopyBytes(BufferToSaveMessage, &Header->OpeationNumber, sizeof(UINT32));
37
38
39
// Second, save the buffer contents
40
PVOID SendingBuffer = ((UINT64)MessageBufferInformation[Index].BufferStartAddress + (MessageBufferInformation[Index].CurrentIndexToSend * (PacketChunkSize + sizeof(BUFFER_HEADER))) + sizeof(BUFFER_HEADER));
41
PVOID SavingAddress = ((UINT64)BufferToSaveMessage + sizeof(UINT32)); // Because we want to pass the header of usermode header
42
RtlCopyBytes(SavingAddress, SendingBuffer, Header->BufferLength);
43
44
45
#if ShowMessagesOnDebugger
46
47
// Means that show just messages
48
if (Header->OpeationNumber <= OPERATION_LOG_NON_IMMEDIATE_MESSAGE)
49
{
50
/* We're in Dpc level here so it's safe to use DbgPrint*/
51
// DbgPrint limitation is 512 Byte
52
if (Header->BufferLength > DbgPrintLimitation)
53
{
54
for (size_t i = 0; i <= Header->BufferLength / DbgPrintLimitation; i++)
55
{
56
if (i != 0)
57
{
58
DbgPrint("%s", (char*)((UINT64)SendingBuffer + (DbgPrintLimitation * i) - 2));
59
}
60
else
61
{
62
DbgPrint("%s", (char*)((UINT64)SendingBuffer + (DbgPrintLimitation * i)));
63
}
64
}
65
}
66
else
67
{
68
DbgPrint("%s", (char*)SendingBuffer);
69
}
70
71
}
72
#endif
73
74
// Finally, set the current index to invalid as we sent it
75
Header->Valid = FALSE;
76
77
// Set the length to show as the ReturnedByted in usermode ioctl funtion + size of header
78
*ReturnedLength = Header->BufferLength + sizeof(UINT32);
79
80
81
// Last step is to clear the current buffer (we can't do it once when CurrentIndexToSend is zero because
82
// there might be multiple messages on the start of the queue that didn't read yet)
83
// we don't free the header
84
RtlZeroMemory(SendingBuffer, Header->BufferLength);
85
86
// Check to see whether we passed the index or not
87
if (MessageBufferInformation[Index].CurrentIndexToSend > MaximumPacketsCapacity - 2)
88
{
89
MessageBufferInformation[Index].CurrentIndexToSend = 0;
90
}
91
else
92
{
93
// Increment the next index to read
94
MessageBufferInformation[Index].CurrentIndexToSend = MessageBufferInformation[Index].CurrentIndexToSend + 1;
95
}
96
97
// Check if we're in Vmx-root, if it is then we use our customized HIGH_IRQL Spinlock, if not we use the windows spinlock
98
if (IsVmxRoot)
99
{
100
SpinlockUnlock(&VmxRootLoggingLock);
101
}
102
else
103
{
104
// Release the lock
105
KeReleaseSpinLock(&MessageBufferInformation[Index].BufferLock, OldIRQL);
106
}
107
}
Copied!
Checking for new messages
Checking for the new message is simple; we just need to check the current message index based on previous information and see if its header is valid or not. If it’s valid then it shows that we have a new message, but if it’s not valid, then some function reads the message previously, and there is no new message.
For checking the new message, we even don’t need to acquire a lock because basically we don’t write anything and in our case reading doesn’t need a lock.
1
/* return of this function shows whether the read was successfull or not (e.g FALSE shows there's no new buffer available.)*/
2
BOOLEAN LogCheckForNewMessage(BOOLEAN IsVmxRoot) {
3
4
KIRQL OldIRQL;
5
UINT32 Index;
6
7
if (IsVmxRoot)
8
{
9
Index = 1;
10
}
11
else
12
{
13
Index = 0;
14
}
15
// Compute the current buffer to read
16
BUFFER_HEADER* Header = (BUFFER_HEADER*)((UINT64)MessageBufferInformation[Index].BufferStartAddress + (MessageBufferInformation[Index].CurrentIndexToSend * (PacketChunkSize + sizeof(BUFFER_HEADER))));
17
18
if (!Header->Valid)
19
{
20
// there is nothing to send
21
return FALSE;
22
}
23
24
/* If we reached here, means that there is sth to send */
25
return TRUE;
26
}
Copied!
Sending messages to pools
Previously, we see how to save (send) buffers and read them. Each message is a buffer of strings, so finally, we have to use “LogSendBuffer” to send our buffer, but we need to consider extra effort to send a well-formed message.
va_start and va_end are used to support multiple arguments to one function, e.g like DbgPrint or printf.
You can use a combination of KeQuerySystemTime, ExSystemTimeToLocalTime, and RtlTimeToTimeFields to get the current system time (see the example) then putting them together with sprintf_s.
There is a particular reason why we use the sprintf-like function instead of RtlString* functions; the reason is described in the Discussion section. The next step is computing length using strnlen_s.
Finally, we have a vital optimization here; logically we create two kinds of messages, one called “Immediate Message” which we will directly send it into the pool and another type is “Non-Immediate Message” which we gather the messages in another buffer and append new messages in that buffer until its capacity is full (we shouldn’t pass the PacketChunkSize limit).
Using this way, we don’t send each message to the user-mode separately but instead, we send multiple messages in one buffer to the user-mode. We will gain visible performance improvement. For example with a configuration with PacketChunkSize == 1000 bytes we send 6 messages on a buffer (it’s average basically it depends on each message size) because you probably know that CPU has to do a lot to change its state from kernel-mode to user-mode and also creating new IRP Packet is a heavy task.
You can also change the configuration, e.g., increase the PacketChunkSize so that more messages will hold on the temporary buffer, but generally, it delays the time you see the message.
Also, we work on a buffer so we need another spinlock here.
Putting it all together we have the following code :
1
// Send string messages and tracing for logging and monitoring
2
BOOLEAN LogSendMessageToQueue(UINT32 OperationCode, BOOLEAN IsImmediateMessage, BOOLEAN ShowCurrentSystemTime, const char* Fmt, ...)
3
{
4
BOOLEAN Result;
5
va_list ArgList;
6
size_t WrittenSize;
7
UINT32 Index;
8
KIRQL OldIRQL;
9
BOOLEAN IsVmxRootMode;
10
int SprintfResult;
11
char LogMessage[PacketChunkSize];
12
char TempMessage[PacketChunkSize];
13
char TimeBuffer[20] = { 0 };
14
15
// Set Vmx State
16
IsVmxRootMode = GuestState[KeGetCurrentProcessorNumber()].IsOnVmxRootMode;
17
18
if (ShowCurrentSystemTime)
19
{
20
// It's actually not necessary to use -1 but because user-mode code might assume a null-terminated buffer so
21
// it's better to use - 1
22
va_start(ArgList, Fmt);
23
// We won't use this because we can't use in any IRQL
24
/*Status = RtlStringCchVPrintfA(TempMessage, PacketChunkSize - 1, Fmt, ArgList);*/
25
SprintfResult = vsprintf_s(TempMessage, PacketChunkSize - 1, Fmt, ArgList);
26
va_end(ArgList);
27
28
// Check if the buffer passed the limit
29
if (SprintfResult == -1)
30
{
31
// Probably the buffer is large that we can't store it
32
return FALSE;
33
}
34
35
// Fill the above with timer
36
TIME_FIELDS TimeFields;
37
LARGE_INTEGER SystemTime, LocalTime;
38
KeQuerySystemTime(&SystemTime);
39
ExSystemTimeToLocalTime(&SystemTime, &LocalTime);
40
RtlTimeToTimeFields(&LocalTime, &TimeFields);
41
42
// We won't use this because we can't use in any IRQL
43
/*Status = RtlStringCchPrintfA(TimeBuffer, RTL_NUMBER_OF(TimeBuffer),
44
"%02hd:%02hd:%02hd.%03hd", TimeFields.Hour,
45
TimeFields.Minute, TimeFields.Second,
46
TimeFields.Milliseconds);
47
48
// Append time with previous message
49
Status = RtlStringCchPrintfA(LogMessage, PacketChunkSize - 1, "(%s)\t %s", TimeBuffer, TempMessage);*/
50
51
// this function probably run without error, so there is no need to check the return value
52
sprintf_s(TimeBuffer, RTL_NUMBER_OF(TimeBuffer), "%02hd:%02hd:%02hd.%03hd", TimeFields.Hour,
53
TimeFields.Minute, TimeFields.Second,
54
TimeFields.Milliseconds);
55
56
// Append time with previous message
57
SprintfResult = sprintf_s(LogMessage, PacketChunkSize - 1, "(%s - core : %d - vmx-root? %s)\t %s", TimeBuffer, KeGetCurrentProcessorNumberEx(0), IsVmxRootMode ? "yes" : "no", TempMessage);
58
59
// Check if the buffer passed the limit
60
if (SprintfResult == -1)
61
{
62
// Probably the buffer is large that we can't store it
63
return FALSE;
64
}
65
66
67
}
68
else
69
{
70
// It's actually not necessary to use -1 but because user-mode code might assume a null-terminated buffer so
71
// it's better to use - 1
72
va_start(ArgList, Fmt);
73
// We won't use this because we can't use in any IRQL
74
/* Status = RtlStringCchVPrintfA(LogMessage, PacketChunkSize - 1, Fmt, ArgList); */
75
SprintfResult = vsprintf_s(LogMessage, PacketChunkSize - 1, Fmt, ArgList);
76
va_end(ArgList);
77
78
// Check if the buffer passed the limit
79
if (SprintfResult == -1)
80
{
81
// Probably the buffer is large that we can't store it
82
return FALSE;
83
}
84
85
}
86
// Use std function because they can be run in any IRQL
87
// RtlStringCchLengthA(LogMessage, PacketChunkSize - 1, &WrittenSize);
88
WrittenSize = strnlen_s(LogMessage, PacketChunkSize - 1);
89
90
if (LogMessage[0] == '\0') {
91
92
// nothing to write
93
DbgBreakPoint();
94
return FALSE;
95
}
96
97
if (IsImmediateMessage)
98
{
99
return LogSendBuffer(OperationCode, LogMessage, WrittenSize);
100
}
101
else
102
{
103
// Check if we're in Vmx-root, if it is then we use our customized HIGH_IRQL Spinlock, if not we use the windows spinlock
104
if (IsVmxRootMode)
105
{
106
// Set the index
107
Index = 1;
108
SpinlockLock(&VmxRootLoggingLockForNonImmBuffers);
109
}
110
else
111
{
112
// Set the index
113
Index = 0;
114
// Acquire the lock
115
KeAcquireSpinLock(&MessageBufferInformation[Index].BufferLockForNonImmMessage, &OldIRQL);
116
}
117
//Set the result to True
118
Result = TRUE;
119
120
// If log message WrittenSize is above the buffer then we have to send the previous buffer
121
if ((MessageBufferInformation[Index].CurrentLengthOfNonImmBuffer + WrittenSize) > PacketChunkSize - 1 && MessageBufferInformation[Index].CurrentLengthOfNonImmBuffer != 0)
122
{
123
124
// Send the previous buffer (non-immediate message)
125
Result = LogSendBuffer(OPERATION_LOG_NON_IMMEDIATE_MESSAGE,
126
MessageBufferInformation[Index].BufferForMultipleNonImmediateMessage,
127
MessageBufferInformation[Index].CurrentLengthOfNonImmBuffer);
128
129
// Free the immediate buffer
130
MessageBufferInformation[Index].CurrentLengthOfNonImmBuffer = 0;
131
RtlZeroMemory(MessageBufferInformation[Index].BufferForMultipleNonImmediateMessage, PacketChunkSize);
132
}
133
134
// We have to save the message
135
RtlCopyBytes(MessageBufferInformation[Index].BufferForMultipleNonImmediateMessage +
136
MessageBufferInformation[Index].CurrentLengthOfNonImmBuffer, LogMessage, WrittenSize);
137
138
// add the length
139
MessageBufferInformation[Index].CurrentLengthOfNonImmBuffer += WrittenSize;
140
141
142
// Check if we're in Vmx-root, if it is then we use our customized HIGH_IRQL Spinlock, if not we use the windows spinlock
143
if (IsVmxRootMode)
144
{
145
SpinlockUnlock(&VmxRootLoggingLockForNonImmBuffers);
146
}
147
else
148
{
149
// Release the lock
150
KeReleaseSpinLock(&MessageBufferInformation[Index].BufferLockForNonImmMessage, OldIRQL);
151
}
152
153
return Result;
154
}
155
}
Copied!
Receiving buffers and messages in user-mode
Receiving buffers from the user-mode is done by using an IOCTL. First, we create another thread in our user-mode application. This thread is responsible for bringing the kernel-mode buffers to the user-mode and then operate based on Operation Number.
1
HANDLE Thread = CreateThread(NULL, 0, ThreadFunc, Handle, 0, NULL);
2
if (Thread) {
3
printf("[*] Thread Created successfully !!!");
4
}
Copied!
This thread executes the following function. We use IRP Pending for transferring data from kernel-mode to user-mode. IRP Pending is primarily used for transferring a packet. For example, you send an IRP packet to the kernel, and kernel marks this packet as Pending. Whenever the user-mode buffer is available to send to the user-mode, the kernel completes the IRP request, and the IOCTL function returns to the user-mode and continues the execution.
It’s somehow like when you use Wait for an object. We can also use events in Windows and whenever the buffer is available the event is triggered but IRP Pending is better as it designed for the purpose of sending messages to user-mode.
What we have to do is allocating a buffer for kernel-mode code and using DeviceIoControl to request the packet. When the packet from the kernel received, we process the packet and switch through the Operation Number.
1
void ReadIrpBasedBuffer(HANDLE Device) {
2
3
BOOL Status;
4
ULONG ReturnedLength;
5
REGISTER_EVENT RegisterEvent;
6
UINT32 OperationCode;
7
8
printf(" =============================== Kernel-Mode Logs (Driver) ===============================\n");
9
RegisterEvent.hEvent = NULL;
10
RegisterEvent.Type = IRP_BASED;
11
char OutputBuffer[UsermodeBufferSize + 100] = { 0 };
12
13
try
14
{
15
16
while (TRUE) {
17
18
ZeroMemory(OutputBuffer, UsermodeBufferSize);
19
20
Sleep(200); // we're not trying to eat all of the CPU ;)
21
22
Status = DeviceIoControl(
23
Device, // Handle to device
24
IOCTL_REGISTER_EVENT, // IO Control code
25
&RegisterEvent, // Input Buffer to driver.
26
SIZEOF_REGISTER_EVENT * 2, // Length of input buffer in bytes. (x 2 is bcuz as the driver is x64 and has 64 bit values)
27
OutputBuffer, // Output Buffer from driver.
28
sizeof(OutputBuffer), // Length of output buffer in bytes.
29
&ReturnedLength, // Bytes placed in buffer.
30
NULL // synchronous call
31
);
32
33
if (!Status) {
34
printf("Ioctl failed with code %d\n", GetLastError());
35
break;
36
}
37
printf("\n========================= Kernel Mode (Buffer) =========================\n");
38
39
OperationCode = 0;
40
memcpy(&OperationCode, OutputBuffer, sizeof(UINT32));
41
42
printf("Returned Length : 0x%x \n", ReturnedLength);
43
printf("Operation Code : 0x%x \n", OperationCode);
44
45
switch (OperationCode)
46
{
47
case OPERATION_LOG_NON_IMMEDIATE_MESSAGE:
48
printf("A buffer of messages (OPERATION_LOG_NON_IMMEDIATE_MESSAGE) :\n");
49
printf("%s", OutputBuffer + sizeof(UINT32));
50
break;
51
case OPERATION_LOG_INFO_MESSAGE:
52
printf("Information log (OPERATION_LOG_INFO_MESSAGE) :\n");
53
printf("%s", OutputBuffer + sizeof(UINT32));
54
break;
55
case OPERATION_LOG_ERROR_MESSAGE:
56
printf("Error log (OPERATION_LOG_ERROR_MESSAGE) :\n");
57
printf("%s", OutputBuffer + sizeof(UINT32));
58
break;
59
case OPERATION_LOG_WARNING_MESSAGE:
60
printf("Warning log (OPERATION_LOG_WARNING_MESSAGE) :\n");
61
printf("%s", OutputBuffer + sizeof(UINT32));
62
break;
63
64
default:
65
break;
66
}
67
68
69
printf("\n========================================================================\n");
70
}
71
}
72
catch (const std::exception&)
73
{
74
printf("\n Exception !\n");
75
}
76
}
Copied!
IOCTL and managing user-mode requests
When the IOCTL arrived on the kernel side, DrvDispatchIoControl from major functions is called. This function returns a pointer to the caller’s I/O stack location in the specified IRP.
From the IRP Stack we can read the IOCTL code and buffers address, this time we perform necessary checks and pass the arguments to LogRegisterIrpBasedNotification.
1
/* Driver IOCTL Dispatcher*/
2
NTSTATUS DrvDispatchIoControl(PDEVICE_OBJECT DeviceObject, PIRP Irp)
3
{
4
PIO_STACK_LOCATION IrpStack;
5
PREGISTER_EVENT RegisterEvent;
6
NTSTATUS Status;
7
8
IrpStack = IoGetCurrentIrpStackLocation(Irp);
9
10
switch (IrpStack->Parameters.DeviceIoControl.IoControlCode)
11
{
12
case IOCTL_REGISTER_EVENT:
13
14
// First validate the parameters.
15
if (IrpStack->Parameters.DeviceIoControl.InputBufferLength < SIZEOF_REGISTER_EVENT || Irp->AssociatedIrp.SystemBuffer == NULL) {
16
Status = STATUS_INVALID_PARAMETER;
17
DbgBreakPoint();
18
break;
19
}
20
21
RegisterEvent = (PREGISTER_EVENT)Irp->AssociatedIrp.SystemBuffer;
22
23
switch (RegisterEvent->Type) {
24
case IRP_BASED:
25
Status = LogRegisterIrpBasedNotification(DeviceObject, Irp);
26
break;
27
case EVENT_BASED:
28
Status = LogRegisterEventBasedNotification(DeviceObject, Irp);
29
break;
30
default:
31
ASSERTMSG("\tUnknow notification type from user-mode\n", FALSE);
32
Status = STATUS_INVALID_PARAMETER;
33
break;
34
}
35
break;
36
37
default:
38
ASSERT(FALSE); // should never hit this
39
Status = STATUS_NOT_IMPLEMENTED;
40
break;
41
}
42
43
if (Status != STATUS_PENDING) {
44
Irp->IoStatus.Status = Status;
45
Irp->IoStatus.Information = 0;
46
IoCompleteRequest(Irp, IO_NO_INCREMENT);
47
}
48
49
return Status;
50
}
Copied!
To register an IRP notification, first, we check whether any other thread is pending by checking GlobalNotifyRecord if there is any thread we complete the IRP and return to the user-mode because in our design we ignore multiple threads that request the buffers means that only one thread can read the kernel-mode buffer.
Second, we initialize a custom structure that describes the state. The following structure is responsible for saving Type, DPC Object, and target buffer.
1
typedef struct _NOTIFY_RECORD {
2
NOTIFY_TYPE Type;
3
union {
4
PKEVENT Event;
5
PIRP PendingIrp;
6
} Message;
7
KDPC Dpc;
8
BOOLEAN CheckVmxRootMessagePool; // Set so that notify callback can understand where to check (Vmx root or Vmx non-root)
9
} NOTIFY_RECORD, * PNOTIFY_RECORD;
Copied!
In order to fill this structure, we initialize a DPC object by calling KeInitializeDpc, this function gets the function callback that should be called later (LogNotifyUsermodeCallback) and the parameter(s) to this function (NotifyRecord).
We first check the vmx non-root pools to see if anything new is available. Otherwise, we check the vmx-root mode buffer. This precedence is because vmx non-root buffers are more important. After all, we spent must of the time in VMX Root-mode, so we might see thousands of messages from vmx-root while we have fewer messages from vmx non-root. If we check the vmx root message buffer first, then we might lose some messages from vmx non-root or never find a time to process them.
If any new message is available then we directly add a DPC to the queue (KeInsertQueueDpc).
If there isn’t any new message available, then we simply save our Notify Record for future use, and also we mark IRP to pending state using IoMarkIrpPending and return STATUS_PENDING.
1
/* Register a new IRP Pending thread which listens for new buffers */
2
NTSTATUS LogRegisterIrpBasedNotification(PDEVICE_OBJECT DeviceObject, PIRP Irp)
3
{
4
PNOTIFY_RECORD NotifyRecord;
5
PIO_STACK_LOCATION IrpStack;
6
KIRQL OOldIrql;
7
PREGISTER_EVENT RegisterEvent;
8
9
// check if current core has another thread with pending IRP, if no then put the current thread to pending
10
// otherwise return and complete thread with STATUS_SUCCESS as there is another thread waiting for message
11
12
if (GlobalNotifyRecord == NULL)
13
{
14
IrpStack = IoGetCurrentIrpStackLocation(Irp);
15
RegisterEvent = (PREGISTER_EVENT)Irp->AssociatedIrp.SystemBuffer;
16
17
// Allocate a record and save all the event context.
18
NotifyRecord = ExAllocatePoolWithQuotaTag(NonPagedPool, sizeof(NOTIFY_RECORD), POOLTAG);
19
20
if (NULL == NotifyRecord) {
21
return STATUS_INSUFFICIENT_RESOURCES;
22
}
23
24
NotifyRecord->Type = IRP_BASED;
25
NotifyRecord->Message.PendingIrp = Irp;
26
27
KeInitializeDpc(&NotifyRecord->Dpc, // Dpc
28
LogNotifyUsermodeCallback, // DeferredRoutine
29
NotifyRecord // DeferredContext
30
);
31
32
IoMarkIrpPending(Irp);
33
34
// check for new message (for both Vmx-root mode or Vmx non root-mode)
35
if (LogCheckForNewMessage(FALSE))
36
{
37
// check vmx root
38
NotifyRecord->CheckVmxRootMessagePool = FALSE;
39
40
// Insert dpc to queue
41
KeInsertQueueDpc(&NotifyRecord->Dpc, NotifyRecord, NULL);
42
}
43
else if (LogCheckForNewMessage(TRUE))
44
{
45
// check vmx non-root
46
NotifyRecord->CheckVmxRootMessagePool = TRUE;
47
48
// Insert dpc to queue
49
KeInsertQueueDpc(&NotifyRecord->Dpc, NotifyRecord, NULL);
50
}
51
else
52
{
53
// Set the notify routine to the global structure
54
GlobalNotifyRecord = NotifyRecord;
55
}
56
57
// We will return pending as we have marked the IRP pending.
58
return STATUS_PENDING;
59
}
60
else
61
{
62
return STATUS_SUCCESS;
63
}
64
}
Copied!
Usermode notify callback
As you see in the above codes, we add DPCs to queue in two functions (LogRegisterIrpBasedNotification and LogSendBuffer). This way, we won’t miss anything, and everything is processed as a message is generated. For example, if there is any thread waiting for the message then LogSendBuffer notifies it about the new message, if there isn’t any thread waiting for the message then LogSendBuffer can’t do anything, as long as a new thread comes to the kernel then it checks for the new message. Think about it one more time. It’s beautiful.
Now it’s time to read the packets from kernel pools and send them to the user-mode.
When LogNotifyUsermodeCallback is called then we sure that we’re in DISPATCH_LEVEL and vmx non-root mode.
In this function, we check if the parameters sent to the kernel are valid or not. It’s because the user-mode provides them. For example, we check the IRP stack’s Parameters. DeviceIoControl. InputBufferLength and Parameters. DeviceIoControl. OutputBufferLength to make sure they are not null or check whether the SystemBuffer is null or not.
Then we call LogReadBuffer with user-mode buffers, so this function will fill the user-mode buffer and adds the Operation Number in a suitable place. Also, Irp->IoStatus.Information provides the buffer length to the user-mode.
The last step here is to complete the IRP, so I/O Manager sends the results to the user-mode, and the thread can continue to its normal life.
The reason why we access the user-mode buffer in all processes (because DPCs might run on the random user-mode process) and why we use DPCs and don’t use other things like APCs is discussed in the Discussion section.
The following code demonstrates what we talked about it above.
1
/* Complete the IRP in IRP Pending state and fill the usermode buffers with pool data */
2
VOID LogNotifyUsermodeCallback(PKDPC Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
3
{
4
5
PNOTIFY_RECORD NotifyRecord;
6
PIRP Irp;
7
UINT32 Length;
8
9
UNREFERENCED_PARAMETER(Dpc);
10
UNREFERENCED_PARAMETER(SystemArgument1);
11
UNREFERENCED_PARAMETER(SystemArgument2);
12
13
NotifyRecord = DeferredContext;
14
15
ASSERT(NotifyRecord != NULL); // can't be NULL
16
_Analysis_assume_(NotifyRecord != NULL);
17
18
switch (NotifyRecord->Type)
19
{
20
21
case IRP_BASED:
22
Irp = NotifyRecord->Message.PendingIrp;
23
24
if (Irp != NULL) {
25
26
PCHAR OutBuff; // pointer to output buffer
27
ULONG InBuffLength; // Input buffer length
28
ULONG OutBuffLength; // Output buffer length
29
PIO_STACK_LOCATION IrpSp;
30
31
// Make suree that concurrent calls to notify function never occurs
32
if