Skip to content

Commit

Permalink
Fix AMD execution
Browse files Browse the repository at this point in the history
  • Loading branch information
cheat-engine committed Apr 28, 2020
1 parent 287e784 commit 1ac848f
Show file tree
Hide file tree
Showing 13 changed files with 620 additions and 135 deletions.
4 changes: 2 additions & 2 deletions dbvm/Makefile
Original file line number Diff line number Diff line change
Expand Up @@ -34,9 +34,9 @@ displaydebug: DISPLAYDEBUG=1
displaydebug: clean install

usb: install
@if [ -b /dev/sdc ] ;\
@if [ -b /dev/sdb ] ;\
then \
dd if=vmdisk.img of=/dev/sde ;\
dd if=vmdisk.img of=/dev/sdb ;\
sync ;\
else \
echo "/dev/sde does not exist. Did you just run this without understanding makefiles? This could have really fucked you up" ;\
Expand Down
35 changes: 34 additions & 1 deletion dbvm/vmm/common.h
Original file line number Diff line number Diff line change
Expand Up @@ -434,7 +434,6 @@ typedef volatile struct _PDE2MB_PAE
unsigned EXB : 1;
} __attribute__((__packed__)) _PDE2MB_PAE, *PPDE2MB_PAE;


typedef volatile struct _PDPTE_PAE
{
unsigned P : 1; // 0: present (1 = present)
Expand All @@ -451,6 +450,40 @@ typedef volatile struct _PDPTE_PAE
unsigned EXB : 1;
} __attribute__((__packed__)) *PPDPTE_PAE;

typedef struct _PPDPTE_PAE_BS
{
unsigned P : 1; // present (1 = present)
unsigned RW : 1; // Read Write
unsigned US : 1; // User supervisor
unsigned PWT : 1; // page-level write-through
unsigned PCD : 1; // page-level cache disabled
unsigned A : 1;
unsigned D : 1;
unsigned PS : 1;
unsigned G : 1;
unsigned A1 : 1; // available 1 aka copy-on-write
unsigned A2 : 1; // available 2/ is 1 when paged to disk
unsigned A3 : 1; // available 3
unsigned PFN : 24; // page-frame number
unsigned reserved3 : 28;
} __attribute__((__packed__)) *PPDPTE_PAE_BS;

typedef volatile struct _PPML4
{
unsigned P : 1; // 0: present (1 = present)
unsigned RW : 1; // 1: Read Write
unsigned US : 1; // 2: User supervisor
unsigned PWT : 1; // 3: page-level write-through
unsigned PCD : 1; // 4: page-level cache disabled
unsigned reserved2 : 4; // 5-8: reserved
unsigned A1 : 1; // 9: available 1 aka copy-on-write
unsigned A2 : 1; // 10: available 2/ is 1 when paged to disk
unsigned A3 : 1; // 11: available 3
unsigned PFN : 28; // page-frame number
unsigned reserved3 : 23;
unsigned EXB : 1;
} __attribute__((__packed__)) *PPML4;


typedef struct _TSS
{
Expand Down
3 changes: 3 additions & 0 deletions dbvm/vmm/epthandler.c
Original file line number Diff line number Diff line change
Expand Up @@ -2069,6 +2069,9 @@ void initMemTypeRanges()
//builds an array of memory ranges and their cache
{
int i;
if (memoryrangesPos)
return; //already initialized

csEnter(&memoryrangesCS);

memoryrangesPos=0;
Expand Down
26 changes: 26 additions & 0 deletions dbvm/vmm/luahandler.c
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,30 @@ int lua_print(lua_State *L)
return 0;
}

int lua_cpuid(lua_State *L)
{
unsigned long long rax,rbx,rcx,rdx;

if (lua_gettop(L)>=1)
{
rax=lua_tointeger(L,1);

if (lua_gettop(L)>=2)
{
rcx=lua_tointeger(L,2);
}
}

_cpuid(&rax,&rbx,&rcx,&rdx);

lua_pushinteger(L,rax);
lua_pushinteger(L,rbx);
lua_pushinteger(L,rcx);
lua_pushinteger(L,rdx);

return 4;
}

int lua_readMSR(lua_State *L)
{
if (lua_gettop(L)>=1)
Expand Down Expand Up @@ -197,6 +221,8 @@ lua_State *initializeLua(void)
lua_register(LuaVM,"readMSR", lua_readMSR);
lua_register(LuaVM,"writeMSR", lua_writeMSR);

lua_register(LuaVM,"cpuid", lua_cpuid);



lua_register(LuaVM,"psod", lua_psod);
Expand Down
61 changes: 47 additions & 14 deletions dbvm/vmm/main.c
Original file line number Diff line number Diff line change
Expand Up @@ -122,16 +122,31 @@ int cinthandler(unsigned long long *stack, int intnr) //todo: move to it's own s

enableserial();


ddDrawRectangle(DDHorizontalResolution-100,0,100,100,_rdtsc());

if (readMSR(IA32_FS_BASE_MSR)==0)
{

#ifdef DEBUG
sendstringCS.ignorelock=1;
sendstringfCS.ignorelock=1;
#endif

ddDrawRectangle(DDHorizontalResolution-100,0,100,100,_rdtsc());

if (readMSRSafe(IA32_FS_BASE_MSR)==0)
{
sendstringf("Invalid FS base during exception\n");
sendstringf("Invalid FS base during exception %d CR2=%6!!\n",intnr, getCR2());


if (intnr==13)
{
UINT64 RIP=stack[17];
errorcodeValue=stack[16];

sendstringf("RIP=%6\n", RIP);
sendstringf("ErrorCode=%x\n", errorcodeValue);

}

ddDrawRectangle(0,DDVerticalResolution-100,100,100,0xff0000);
while (1) outportb(0x80,0xc5);
}
Expand Down Expand Up @@ -883,12 +898,15 @@ void vmm_entry2(void)
vmm_entry2_hlt(cpuinfo);
}

sendstringf("Starting VMX for cpu %d\n", cpunr);

displayline("CPU CORE %d: entering VMX mode\n",cpunr);

startvmx(cpuinfo);

// while (1); //debug

displayline("CPU CORE %d: entering VMX mode\n",cpunr);


sendstringf("Application cpu returned from startvmx\n\r");

Expand Down Expand Up @@ -1068,7 +1086,7 @@ void vmm_entry(void)
cpu_familyID=cpu_familyID + (cpu_ext_familyID << 4);


//if (0)
// if (0)
if (1) //((d & (1<<28))>0) //this doesn't work in vmware, so find a different method
{
QWORD entrypage=0x30000;
Expand Down Expand Up @@ -1668,6 +1686,21 @@ void vmcalltest(void)
//#pragma GCC pop_options


void apentryvmx()
{
nosendchar[getAPICID()]=0;
// sendstringf("Hello from %d", getAPICID());

while (1)
{
// sendchar("-");
QWORD eax,ebx,ecx,edx;
_cpuid(&eax,&ebx,&ecx,&edx);


}

}

void reboot(int skipAPTerminationWait)
{
Expand Down Expand Up @@ -2529,9 +2562,7 @@ void menu(void)
case 'l':
{
sendstring("Entering lua console:");
//enterLuaConsole();


enterLuaConsole();
break;
}
#endif
Expand Down Expand Up @@ -2716,14 +2747,15 @@ void startvmx(pcpuinfo currentcpuinfo)



UINT64 VM_HSAVE_PA_MSR=readMSR(0xc0010117); //VM_HSAVE_PA MSR
sendstringf("VM_HSAVE_PA_MSR was %6\n", VM_HSAVE_PA_MSR);
UINT64 VM_HSAVE_PA_MSR_VALUE=readMSR(VM_HSAVE_PA_MSR); //VM_HSAVE_PA MSR
sendstringf("VM_HSAVE_PA_MSR was %6\n", VM_HSAVE_PA_MSR_VALUE);

currentcpuinfo->vmcb_host=malloc(4096);
currentcpuinfo->vmcb_host=malloc(8192);
zeromemory(currentcpuinfo->vmcb_host,8192);
// bochsbp();
writeMSR(0xc0010117, (UINT64)VirtualToPhysical(currentcpuinfo->vmcb_host));

writeMSR(VM_HSAVE_PA_MSR, (UINT64)VirtualToPhysical(currentcpuinfo->vmcb_host));

sendstringf("VM_HSAVE_PA_MSR is %6\n", (UINT64)readMSR(VM_HSAVE_PA_MSR));

setupVMX(currentcpuinfo);

Expand All @@ -2734,6 +2766,7 @@ void startvmx(pcpuinfo currentcpuinfo)




launchVMX(currentcpuinfo);

sendstring("launchVMX returned\n");
Expand Down
5 changes: 5 additions & 0 deletions dbvm/vmm/main.h
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,8 @@


void reboot(int skipAPTermination);
void apentryvmx();


void startvmx(pcpuinfo currentcpuinfo);
void CheckCRCValues(void);
Expand Down Expand Up @@ -43,8 +45,11 @@ extern UINT64 getCR8(void);
extern UINT64 getDR0(void);
extern UINT64 setDR0(UINT64 newdr0);
extern UINT64 getDR1(void);
extern UINT64 setDR1(UINT64 newdr0);
extern UINT64 getDR2(void);
extern UINT64 setDR2(UINT64 newdr0);
extern UINT64 getDR3(void);
extern UINT64 setDR3(UINT64 newdr0);
extern UINT64 getDR6(void);
extern UINT64 setDR6(UINT64 newdr6);
extern UINT64 getDR7(void);
Expand Down
1 change: 1 addition & 0 deletions dbvm/vmm/msrnames.h
Original file line number Diff line number Diff line change
Expand Up @@ -93,5 +93,6 @@
#define IA32_TSC_MSR 0x10
#define IA32_TSC_AUX_MSR 0xc0000103

#define VM_HSAVE_PA_MSR 0xc0010117 //AMD

#endif /* MSRNAMES_H_ */
4 changes: 2 additions & 2 deletions dbvm/vmm/vmeventhandler.c
Original file line number Diff line number Diff line change
Expand Up @@ -1074,8 +1074,8 @@ ULONG getSegmentAccessRights(PGDT_ENTRY gdt, PGDT_ENTRY ldt, ULONG selector)

WORD convertSegmentAccessRightsToSegmentAttrib(ULONG accessrights)
{
Access_Rights ar;
Segment_Attribs sa;
Access_Rights ar; //intel
Segment_Attribs sa; //amd

ar.AccessRights=accessrights;

Expand Down
Loading

0 comments on commit 1ac848f

Please sign in to comment.