VirtualBox

Changeset 106893 in vbox for trunk/src/VBox/HostDrivers


Ignore:
Timestamp:
Nov 8, 2024 3:54:01 PM (3 months ago)
Author:
vboxsync
svn:sync-xref-src-repo-rev:
165814
Message:

SUPHardNt: Rough and untested port of the C code to win.arm64 so the extpack builds. VBP-1447

Location:
trunk/src/VBox/HostDrivers/Support
Files:
5 edited

Legend:

Unmodified
Added
Removed

  • trunk/src/VBox/HostDrivers/Support/Makefile.kmk

    r106638 r106893  
    257257SUPR3HardenedStatic_SOURCES.win = \
    258258        win/SUPR3HardenedMain-win.cpp \
    259         win/SUPR3HardenedMainA-win.asm \
    260259        win/SUPR3HardenedMainImports-win.cpp \
    261260        win/SUPHardenedVerifyProcess-win.cpp \
    … …  
    263262        $(VBOX_SUP_WIN_CERTS_FILE)
    264263SUPR3HardenedStatic_SOURCES.x86 += \
     264        win/SUPR3HardenedMainA-win.asm \
    265265        $(VBOX_PATH_RUNTIME_SRC)/common/asm/ASMMemFirstMismatchingU8.asm
    266266SUPR3HardenedStatic_SOURCES.amd64 += \
     267        win/SUPR3HardenedMainA-win.asm \
    267268        $(VBOX_PATH_RUNTIME_SRC)/common/asm/ASMMemFirstMismatchingU8.asm
    268269
    … …  
    378379        $(VBOX_PATH_RUNTIME_SRC)/common/err/errmsg.cpp \
    379380        $(VBOX_PATH_RUNTIME_SRC)/common/math/bignum.cpp \
    380         $(VBOX_PATH_RUNTIME_SRC)/common/math/bignum-amd64-x86.asm \
    381381        $(VBOX_PATH_RUNTIME_SRC)/common/misc/RTAssertMsg1Weak.cpp \
    382382        $(VBOX_PATH_RUNTIME_SRC)/common/misc/RTAssertMsg2.cpp \
    383383        $(VBOX_PATH_RUNTIME_SRC)/common/misc/RTAssertMsg2Weak.cpp \
    384384        $(VBOX_PATH_RUNTIME_SRC)/common/misc/RTAssertMsg2WeakV.cpp \
    385         $(VBOX_PATH_RUNTIME_SRC)/common/misc/zero.asm \
    386385        $(VBOX_PATH_RUNTIME_SRC)/common/path/RTPathAbsEx.cpp \
    387386        $(VBOX_PATH_RUNTIME_SRC)/common/path/RTPathFilename.cpp \
    388387        $(VBOX_PATH_RUNTIME_SRC)/common/path/RTPathParse.cpp \
    389388        $(VBOX_PATH_RUNTIME_SRC)/common/path/RTPathParsedReassemble.cpp \
    390         $(VBOX_PATH_RUNTIME_SRC)/common/string/memchr.asm \
    391         $(VBOX_PATH_RUNTIME_SRC)/common/string/memcmp.asm \
    392         $(VBOX_PATH_RUNTIME_SRC)/common/string/memcpy.asm \
    393         $(VBOX_PATH_RUNTIME_SRC)/common/string/memmove.asm \
    394         $(VBOX_PATH_RUNTIME_SRC)/common/string/mempcpy.asm \
    395         $(VBOX_PATH_RUNTIME_SRC)/common/string/memset.asm \
    396389        $(VBOX_PATH_RUNTIME_SRC)/common/string/strversion.cpp \
    397390        $(VBOX_PATH_RUNTIME_SRC)/common/string/RTStrPrintHexBytes.cpp \
    … …  
    399392        $(VBOX_PATH_RUNTIME_SRC)/common/string/RTStrCmp.cpp \
    400393        $(VBOX_PATH_RUNTIME_SRC)/common/string/RTStrCopy.cpp \
    401         $(VBOX_PATH_RUNTIME_SRC)/common/string/RTStrEnd.asm \
    402394        $(VBOX_PATH_RUNTIME_SRC)/common/string/RTStrICmpAscii.cpp \
    403395        $(VBOX_PATH_RUNTIME_SRC)/common/string/RTStrNCmp.cpp \
    … …  
    405397        $(VBOX_PATH_RUNTIME_SRC)/common/string/RTUtf16Copy.cpp \
    406398        $(VBOX_PATH_RUNTIME_SRC)/common/string/RTUtf16NLenEx.cpp \
    407         $(VBOX_PATH_RUNTIME_SRC)/common/string/strchr.asm \
    408         $(VBOX_PATH_RUNTIME_SRC)/common/string/strcmp.asm \
    409         $(VBOX_PATH_RUNTIME_SRC)/common/string/strcpy.asm \
    410399        $(VBOX_PATH_RUNTIME_SRC)/common/string/strformat.cpp \
    411400        $(VBOX_PATH_RUNTIME_SRC)/common/string/RTStrFormat.cpp \
    … …  
    414403        $(VBOX_PATH_RUNTIME_SRC)/common/string/strformatnum.cpp \
    415404        $(VBOX_PATH_RUNTIME_SRC)/common/string/stringalloc.cpp \
    416         $(VBOX_PATH_RUNTIME_SRC)/common/string/strlen.asm \
    417         $(VBOX_PATH_RUNTIME_SRC)/common/string/strncmp.asm \
    418         $(VBOX_PATH_RUNTIME_SRC)/common/string/strncpy.asm \
    419405        $(VBOX_PATH_RUNTIME_SRC)/common/string/strprintf.cpp \
    420406        $(VBOX_PATH_RUNTIME_SRC)/common/string/strprintf-ellipsis.cpp \
    … …  
    442428
    443429 SUPR3HardenedStatic_SOURCES.amd64 += \
     430        $(VBOX_PATH_RUNTIME_SRC)/common/string/memchr.asm \
     431        $(VBOX_PATH_RUNTIME_SRC)/common/string/memcmp.asm \
     432        $(VBOX_PATH_RUNTIME_SRC)/common/string/memcpy.asm \
     433        $(VBOX_PATH_RUNTIME_SRC)/common/string/memmove.asm \
     434        $(VBOX_PATH_RUNTIME_SRC)/common/string/mempcpy.asm \
     435        $(VBOX_PATH_RUNTIME_SRC)/common/string/memset.asm \
     436        $(VBOX_PATH_RUNTIME_SRC)/common/string/RTStrEnd.asm \
     437        $(VBOX_PATH_RUNTIME_SRC)/common/string/strchr.asm \
     438        $(VBOX_PATH_RUNTIME_SRC)/common/string/strcmp.asm \
     439        $(VBOX_PATH_RUNTIME_SRC)/common/string/strcpy.asm \
     440        $(VBOX_PATH_RUNTIME_SRC)/common/string/strlen.asm \
     441        $(VBOX_PATH_RUNTIME_SRC)/common/string/strncmp.asm \
     442        $(VBOX_PATH_RUNTIME_SRC)/common/string/strncpy.asm \
     443        $(VBOX_PATH_RUNTIME_SRC)/common/misc/zero.asm \
    444444        $(VBOX_PATH_RUNTIME_SRC)/common/math/RTUInt128MulByU64.asm \
     445        $(VBOX_PATH_RUNTIME_SRC)/common/math/bignum-amd64-x86.asm \
    445446        $(VBOX_PATH_RUNTIME_SRC)/win/amd64/ASMGetCS.asm \
    446447        $(VBOX_PATH_RUNTIME_SRC)/win/amd64/ASMGetSS.asm
    … …  
    458459 # Add necessary compiler specific files from the compiler lib dir.
    459460 ifeq ($(KBUILD_TARGET),win)
     461  ## @todo use the nocrt variants of this glue code!
     462
    460463  include $(KBUILD_PATH)/tools/$(VBOX_VCC_TOOL).kmk
    461464  SUPR3HardenedStatic_SOURCES.win += \
    … …  
    475478        $(SUPR3HardenedStatic_0_OUTDIR)/guard_dispatch.obj \
    476479        $(SUPR3HardenedStatic_0_OUTDIR)/guard_xfg_dispatch.obj
     480   SUPR3HardenedStatic_SOURCES.win.arm64 += \
     481        $(SUPR3HardenedStatic_0_OUTDIR)/guard_dispatch.obj
    477482   # These next ones are for supporting the /GS option.  We skip gs_report.obj as it
    478483   # import lots from kernel32 and we're better of reporting the problem ourselves.
    … …  
    495500   $$(SUPR3HardenedStatic_0_OUTDIR)/alloca16.obj: \
    496501                $(PATH_TOOL_$(VBOX_VCC_TOOL)_LIB)/libcmt.lib | $$(dir $$@)
    497         set -x; $(TOOL_$(VBOX_VCC_TOOL)_AR) "/EXTRACT:$$($(TOOL_$(VBOX_VCC_TOOL)_AR) /LIST "$<" | $(SED_EXT) -e '/$(notdir $@)/!d' )" "/OUT:$@" "$<"
     502        set -x; $(TOOL_$(VBOX_VCC_TOOL)_AR) "/EXTRACT:$$($(TOOL_$(VBOX_VCC_TOOL)_AR) /LIST "$<" | $(SED_EXT) -e '/$(notdir $@)/!d' -e '/arm64ec/d' )" "/OUT:$@" "$<"
    498503  endif
    499504 endif

  • trunk/src/VBox/HostDrivers/Support/win/SUPHardenedVerifyImage-win.cpp

    r106061 r106893  
    147147SUPSYSROOTDIRBUF            g_WinSxSNtPath;
    148148#if defined(IN_RING3) && !defined(VBOX_PERMIT_EVEN_MORE)
    149 /** The full 'Program Files' path. */
     149/** The full 'Program Files' ('Program Files (arm)' on arm64) path. */
    150150SUPSYSROOTDIRBUF            g_ProgramFilesNtPath;
    151151# ifdef RT_ARCH_AMD64
    … …  
    11301130     */
    11311131    KUSER_SHARED_DATA volatile *pUserSharedData = (KUSER_SHARED_DATA volatile *)MM_SHARED_USER_DATA_VA;
    1132 # ifdef RT_ARCH_AMD64
    1133     uint64_t uRet = *(uint64_t volatile *)&pUserSharedData->SystemTime; /* This is what KeQuerySystemTime does (missaligned). */
     1132# if defined(RT_ARCH_AMD64) || defined(RT_ARCH_ARM64)
     1133    /* This is what KeQuerySystemTime (macro) does. SystemTime is misaligned,
     1134       not not badly enough to cause trouble on arm. */
     1135#  ifdef RT_ARCH_ARM64
     1136    uint64_t const uRet = __iso_volatile_load64((int64_t volatile *)&pUserSharedData->SystemTime);
     1137#  else
     1138    uint64_t const uRet = *(uint64_t volatile *)&pUserSharedData->SystemTime;
     1139#  endif
    11341140    return RTTimeSpecSetNtTime(pNow, uRet);
    1135 # else
    1136 
     1141
     1142# elif defined(RT_ARCH_X86)
    11371143    LARGE_INTEGER NtTime;
    11381144    do
    … …  
    11421148    } while (pUserSharedData->SystemTime.High2Time != NtTime.HighPart);
    11431149    return RTTimeSpecSetNtTime(pNow, NtTime.QuadPart);
     1150
     1151# else
     1152#  error "port me"
    11441153# endif
     1154
    11451155#else  /* IN_RING0 */
    11461156    return RTTimeNow(pNow);
    … …  
    17721782    } s_aPaths[] =
    17731783    {
     1784# if defined(RT_ARCH_AMD64) || defined(RT_ARCH_X86)
    17741785        { &g_ProgramFilesNtPath,    L"ProgramFilesDir",         "ProgDir" },
    17751786        { &g_CommonFilesNtPath,     L"CommonFilesDir",          "ComDir" },
     1787# elif defined(RT_ARCH_ARM64)
     1788        { &g_ProgramFilesNtPath,    L"ProgramFilesDir (arm)",   "ProgDir" },
     1789        { &g_CommonFilesNtPath,     L"CommonFilesDir (arm)",    "ComDir" },
     1790# else
     1791#  error "port me"
     1792# endif
    17761793# ifdef RT_ARCH_AMD64
    17771794        { &g_ProgramFilesX86NtPath, L"ProgramFilesDir (x86)",   "ProgDir32" },

  • trunk/src/VBox/HostDrivers/Support/win/SUPHardenedVerifyProcess-win.cpp

    r106267 r106893  
    6464#endif
    6565#include "win/SUPHardenedVerify-win.h"
     66
     67
     68/*********************************************************************************************************************************
     69*   Defined Constants And Macros                                                                                                 *
     70*********************************************************************************************************************************/
     71#if defined(RT_ARCH_ARM64)
     72AssertCompile(PAGE_SIZE == _4K);
     73# define g_abRTZeroPage     g_abRTZero4K
     74#endif
     75
    6676
    6777
    … …  
    770780     */
    771781#ifdef RT_ARCH_AMD64
    772     if (pNtHdrs->FileHeader.Machine != IMAGE_FILE_MACHINE_AMD64 && !pImage->f32bitResourceDll)
     782    const uint16_t uExpectedMachine = IMAGE_FILE_MACHINE_AMD64;
     783#elif defined(RT_ARCH_ARM64)
     784    const uint16_t uExpectedMachine = IMAGE_FILE_MACHINE_ARM64;
     785#elif defined(RT_ARCH_X86)
     786    const uint16_t uExpectedMachine = IMAGE_FILE_MACHINE_I386;
    773787#else
    774     if (pNtHdrs->FileHeader.Machine != IMAGE_FILE_MACHINE_I386)
     788# error "port me"
     789#endif
     790#if ARCH_BITS == 64
     791    if (pNtHdrs->FileHeader.Machine != uExpectedMachine && !pImage->f32bitResourceDll)
     792#elif defined
     793    if (pNtHdrs->FileHeader.Machine != uExpectedMachine)
    775794#endif
    776795        return supHardNtVpSetInfo2(pThis, VERR_SUP_VP_UNEXPECTED_IMAGE_MACHINE,
    777                                    "%s: Unexpected machine: %#x", pImage->pszName, pNtHdrs->FileHeader.Machine);
     796                                   "%s: Unexpected machine: %#x (expected %#x)",
     797                                   pImage->pszName, pNtHdrs->FileHeader.Machine, uExpectedMachine);
    778798    bool const fIs32Bit = pNtHdrs->FileHeader.Machine == IMAGE_FILE_MACHINE_I386;
    779799

  • trunk/src/VBox/HostDrivers/Support/win/SUPR3HardenedMain-win.cpp

    r106061 r106893  
    6363#include <iprt/utf16.h>
    6464#include <iprt/zero.h>
     65#ifdef RT_ARCH_ARM64
     66# include <iprt/armv8.h>
     67#endif
    6568
    6669#include "SUPLibInternal.h"
    … …  
    267270
    268271
     272/**
     273 * The size (in bytes) of a function replacement patch.
     274 */
     275#if defined(RT_ARCH_AMD64) || defined(RT_ARCH_X86) || defined(DOXYGEN_RUNNING)
     276# define SUPR3HARDENED_NT_PATCH_SIZE     16
     277#elif defined(RT_ARCH_ARM64)
     278# define SUPR3HARDENED_NT_PATCH_SIZE     32
     279#else
     280# error "port me"
     281#endif
     282
     283/**
     284 * A ntdll code patch.
     285 */
     286typedef union SUPR3HARDNTPATCH
     287{
     288    union
     289    {
     290        uint8_t  ab[SUPR3HARDENED_NT_PATCH_SIZE];
     291        uint32_t au32[SUPR3HARDENED_NT_PATCH_SIZE / 4];
     292        uint64_t au64[SUPR3HARDENED_NT_PATCH_SIZE / 8];
     293    };
     294    uint32_t     cb;
     295} SUPR3HARDNTPATCH;
     296
     297
    269298/*********************************************************************************************************************************
    270299*   Global Variables                                                                                                             *
    … …  
    307336static uint8_t             *g_pbNtCreateSection;
    308337/** The patched NtCreateSection bytes (for restoring). */
    309 static uint8_t              g_abNtCreateSectionPatch[16];
     338static SUPR3HARDNTPATCH     g_NtCreateSectionPatch;
    310339/** Pointer to the bit of assembly code that will perform the original
    311340 *  LdrLoadDll operation. */
    … …  
    314343static uint8_t             *g_pbLdrLoadDll;
    315344/** The patched LdrLoadDll bytes (for restoring). */
    316 static uint8_t              g_abLdrLoadDllPatch[16];
     345static SUPR3HARDNTPATCH     g_LdrLoadDllPatch;
    317346
    318347#ifndef VBOX_WITHOUT_HARDENDED_XCPT_LOGGING
    … …  
    323352static uint8_t             *g_pbKiUserExceptionDispatcher;
    324353/** The patched KiUserExceptionDispatcher bytes (for restoring). */
    325 static uint8_t              g_abKiUserExceptionDispatcherPatch[16];
     354static SUPR3HARDNTPATCH     g_KiUserExceptionDispatcherPatch;
    326355#endif
    327356
    … …  
    332361static uint8_t             *g_pbKiUserApcDispatcher;
    333362/** The patched KiUserApcDispatcher bytes (for restoring). */
    334 static uint8_t              g_abKiUserApcDispatcherPatch[16];
     363static SUPR3HARDNTPATCH     g_KiUserApcDispatcherPatch;
    335364
    336365/** Pointer to the LdrInitializeThunk function in NtDll for
    … …  
    367396/** The backup of our own LdrInitializeThunk code, for enabling and disabling
    368397 * thread creation in this process. */
    369 static uint8_t              g_abLdrInitThunkSelfBackup[16];
     398static SUPR3HARDNTPATCH     g_LdrInitThunkSelfBackup;
    370399
    371400/** Mask of adversaries that we've detected (SUPHARDNT_ADVERSARY_XXX). */
    … …  
    25912620    PCONTEXT   pCtx        = (PCONTEXT)pvApcArgs;
    25922621    uintptr_t *ppfnRoutine = (uintptr_t *)&pCtx->P4Home;
    2593 #else
    2594     struct X86APCCTX
     2622#elif defined(RT_ARCH_X86) || defined(RT_ARCH_ARM64)
     2623    struct GENAPCCTX
    25952624    {
    25962625        uintptr_t   pfnRoutine;
    … …  
    25992628        uintptr_t   pvUser2;
    26002629        CONTEXT     Ctx;
    2601     } *pCtx = (struct X86APCCTX *)pvApcArgs;
     2630    } *pCtx = (struct GENAPCCTX *)pvApcArgs;
    26022631    uintptr_t *ppfnRoutine = &pCtx->pfnRoutine;
     2632# ifdef RT_ARCH_ARM64
     2633    __debugbreak(); /** @todo debug & check this */
     2634# endif
     2635#else
     2636# error "port me"
    26032637#endif
    26042638    uintptr_t  pfnRoutine = *ppfnRoutine;
    … …  
    26602694                 pCtx->SegCs, pCtx->SegDs, pCtx->SegEs, pCtx->SegFs, pCtx->SegGs,
    26612695                 pCtx->Dr0, pCtx->Dr1, pCtx->Dr2, pCtx->Dr3, pCtx->Dr6, pCtx->Dr7));
     2696#elif defined(RT_ARCH_ARM64)
     2697    SUP_DPRINTF(("%s\n"
     2698                 "  x0 =%016RX64 x1 =%016RX64 x2 =%016RX64 x3 =%016RX64\n"
     2699                 "  x4 =%016RX64 x5 =%016RX64 x6 =%016RX64 x7 =%016RX64\n"
     2700                 "  x8 =%016RX64 x9 =%016RX64 x10=%016RX64 x11=%016RX64\n"
     2701                 "  x12=%016RX64 x13=%016RX64 x14=%016RX64 x15=%016RX64\n"
     2702                 "  x16=%016RX64 x17=%016RX64 x18=%016RX64 x19=%016RX64\n"
     2703                 "  x20=%016RX64 x21=%016RX64 x22=%016RX64 x23=%016RX64\n"
     2704                 "  x24=%016RX64 x25=%016RX64 x26=%016RX64 x27=%016RX64\n"
     2705                 "  x28=%016RX64 fp =%016RX64 lr =%016RX64\n"
     2706                 "  pc =%016RX64 sp =%016RX64 cpsr=%08RX32\n"
     2707                 "  fpcr=%08RX32 fpsr=%08RX32 ContextFlags=%#x\n"
     2708                 ,
     2709                 pszLeadIn,
     2710                 pCtx->X0, pCtx->X1, pCtx->X2, pCtx->X3,
     2711                 pCtx->X4, pCtx->X5, pCtx->X6, pCtx->X7,
     2712                 pCtx->X8, pCtx->X9, pCtx->X10, pCtx->X11,
     2713                 pCtx->X12, pCtx->X13, pCtx->X14, pCtx->X15,
     2714                 pCtx->X16, pCtx->X17, pCtx->X18, pCtx->X19,
     2715                 pCtx->X20, pCtx->X21, pCtx->X22, pCtx->X23,
     2716                 pCtx->X24, pCtx->X25, pCtx->X26, pCtx->X27,
     2717                 pCtx->X28, pCtx->Fp, pCtx->Lr,
     2718                 pCtx->Pc, pCtx->Sp, pCtx->Cpsr, pCtx->ContextFlags,
     2719                 pCtx->Fpcr, pCtx->Fpsr));
    26622720#else
    26632721# error "Unsupported arch."
    … …  
    28752933    struct
    28762934    {
    2877         size_t          cbPatch;
    2878         uint8_t const  *pabPatch;
    2879         uint8_t       **ppbApi;
    2880         const char     *pszName;
     2935        SUPR3HARDNTPATCH *pPatch;
     2936        uint8_t         **ppbApi;
     2937        const char       *pszName;
    28812938    } const s_aPatches[] =
    28822939    {
    2883         { sizeof(g_abNtCreateSectionPatch),           g_abNtCreateSectionPatch,           &g_pbNtCreateSection,           "NtCreateSection"     },
    2884         { sizeof(g_abLdrLoadDllPatch),                g_abLdrLoadDllPatch,                &g_pbLdrLoadDll,                "LdrLoadDll"          },
    2885         { sizeof(g_abKiUserApcDispatcherPatch),       g_abKiUserApcDispatcherPatch,       &g_pbKiUserApcDispatcher,       "KiUserApcDispatcher" },
     2940        { &g_NtCreateSectionPatch,           &g_pbNtCreateSection,           "NtCreateSection"     },
     2941        { &g_LdrLoadDllPatch,                &g_pbLdrLoadDll,                "LdrLoadDll"          },
     2942        { &g_KiUserApcDispatcherPatch,       &g_pbKiUserApcDispatcher,       "KiUserApcDispatcher" },
    28862943#ifndef VBOX_WITHOUT_HARDENDED_XCPT_LOGGING
    2887         { sizeof(g_abKiUserExceptionDispatcherPatch), g_abKiUserExceptionDispatcherPatch, &g_pbKiUserExceptionDispatcher, "KiUserExceptionDispatcher" },
     2944        { &g_KiUserExceptionDispatcherPatch, &g_pbKiUserExceptionDispatcher, "KiUserExceptionDispatcher" },
    28882945#endif
    28892946    };
    … …  
    28932950    for (uint32_t i = 0; i < RT_ELEMENTS(s_aPatches); i++)
    28942951    {
    2895         uint8_t *pbApi = *s_aPatches[i].ppbApi;
    2896         if (memcmp(pbApi, s_aPatches[i].pabPatch, s_aPatches[i].cbPatch) != 0)
     2952        SUPR3HARDNTPATCH * const pPatch = s_aPatches[i].pPatch;
     2953        uint8_t * const          pbApi  = *s_aPatches[i].ppbApi;
     2954        if (memcmp(pbApi, pPatch->ab, pPatch->cb) != 0)
    28972955        {
    28982956            /*
    … …  
    29042962                s_cTimes++;
    29052963                SUP_DPRINTF(("supR3HardenedWinReInstallHooks: Reinstalling %s (%p: %.*Rhxs).\n",
    2906                              s_aPatches[i].pszName, pbApi, s_aPatches[i].cbPatch, pbApi));
     2964                             s_aPatches[i].pszName, pbApi, pPatch->cb, pbApi));
    29072965            }
    29082966
    2909             Assert(s_aPatches[i].cbPatch >= 4);
    2910 
    2911             SUPR3HARDENED_ASSERT_NT_SUCCESS(supR3HardenedWinProtectMemory(pbApi, s_aPatches[i].cbPatch, PAGE_EXECUTE_READWRITE));
     2967            Assert(pPatch->cb >= 4);
     2968
     2969            SUPR3HARDENED_ASSERT_NT_SUCCESS(supR3HardenedWinProtectMemory(pbApi, pPatch->cb, PAGE_EXECUTE_READWRITE));
    29122970
    29132971            /*
    … …  
    29182976                fAmIAlone = supR3HardenedWinAmIAlone();
    29192977            if (fAmIAlone)
    2920                 memcpy(pbApi, s_aPatches[i].pabPatch, s_aPatches[i].cbPatch);
     2978                memcpy(pbApi, pPatch->ab, pPatch->cb);
    29212979            else
    29222980            {
    … …  
    29272985                 */
    29282986                RTUINT32U uJmpDollarMinus;
     2987#if defined(RT_ARCH_AMD64) || defined(RT_ARCH_X86)
    29292988                uJmpDollarMinus.au8[0] = 0xeb;
    29302989                uJmpDollarMinus.au8[1] = 0xfe;
    29312990                uJmpDollarMinus.au8[2] = pbApi[2];
    29322991                uJmpDollarMinus.au8[3] = pbApi[3];
    2933                 ASMAtomicXchgU32((uint32_t volatile *)pbApi, uJmpDollarMinus.u);
     2992#else
     2993                uJmpDollarMinus.u = Armv8A64MkInstrB(0);
     2994#endif
     2995                ASMAtomicWriteU32((uint32_t volatile *)pbApi, uJmpDollarMinus.u);
    29342996
    29352997                NtYieldExecution();
    … …  
    29372999
    29383000                /* Copy in the tail bytes of the patch, then xchg the jmp $-2. */
    2939                 if (s_aPatches[i].cbPatch > 4)
    2940                     memcpy(&pbApi[4], &s_aPatches[i].pabPatch[4], s_aPatches[i].cbPatch - 4);
    2941                 ASMAtomicXchgU32((uint32_t volatile *)pbApi, *(uint32_t *)s_aPatches[i].pabPatch);
     3001                if (pPatch->cb > 4)
     3002                    memcpy(&pbApi[4], &pPatch->ab[4], pPatch->cb - 4);
     3003                ASMAtomicWriteU32((uint32_t volatile *)pbApi, pPatch->au32[0]);
    29423004            }
    29433005
    2944             SUPR3HARDENED_ASSERT_NT_SUCCESS(supR3HardenedWinProtectMemory(pbApi, s_aPatches[i].cbPatch, PAGE_EXECUTE_READ));
     3006            SUPR3HARDENED_ASSERT_NT_SUCCESS(supR3HardenedWinProtectMemory(pbApi, pPatch->cb, PAGE_EXECUTE_READ));
    29453007        }
    29463008    }
    … …  
    30183080    uint8_t * const pbNtCreateSection = (uint8_t *)(uintptr_t)pfnNtCreateSection;
    30193081    g_pbNtCreateSection = pbNtCreateSection;
    3020     memcpy(g_abNtCreateSectionPatch, pbNtCreateSection, sizeof(g_abNtCreateSectionPatch));
     3082    memcpy(g_NtCreateSectionPatch.ab, pbNtCreateSection, sizeof(g_NtCreateSectionPatch.ab));
    30213083
    30223084    g_pfnNtCreateSectionReal = NtCreateSection; /* our direct syscall */
    … …  
    30373099
    30383100    /* Assemble the patch. */
    3039     g_abNtCreateSectionPatch[0]  = 0x48; /* mov rax, qword */
    3040     g_abNtCreateSectionPatch[1]  = 0xb8;
    3041     *(uint64_t *)&g_abNtCreateSectionPatch[2] = (uint64_t)supR3HardenedMonitor_NtCreateSection;
    3042     g_abNtCreateSectionPatch[10] = 0xff; /* jmp rax */
    3043     g_abNtCreateSectionPatch[11] = 0xe0;
    3044 
    3045 #else
     3101    g_NtCreateSectionPatch.ab[0]  = 0x48; /* mov rax, qword */
     3102    g_NtCreateSectionPatch.ab[1]  = 0xb8;
     3103    *(uint64_t *)&g_NtCreateSectionPatch.ab[2] = (uint64_t)supR3HardenedMonitor_NtCreateSection;
     3104    g_NtCreateSectionPatch.ab[10] = 0xff; /* jmp rax */
     3105    g_NtCreateSectionPatch.ab[11] = 0xe0;
     3106    g_NtCreateSectionPatch.cb = 12;
     3107
     3108#elif defined(RT_ARCH_X86)
    30463109    /*
    30473110     * Patch 32-bit hosts.
    … …  
    30693132
    30703133    /* Assemble the patch. */
    3071     g_abNtCreateSectionPatch[0] = 0xe9;  /* jmp rel32 */
    3072     *(uint32_t *)&g_abNtCreateSectionPatch[1] = (uintptr_t)supR3HardenedMonitor_NtCreateSection
    3073                                               - (uintptr_t)&pbNtCreateSection[1+4];
    3074 
     3134    g_NtCreateSectionPatch.ab[0] = 0xe9;  /* jmp rel32 */
     3135    *(uint32_t *)&g_NtCreateSectionPatch.ab[1] = (uintptr_t)supR3HardenedMonitor_NtCreateSection
     3136                                               - (uintptr_t)&pbNtCreateSection[1+4];
     3137    g_NtCreateSectionPatch.cb = 5;
     3138
     3139#elif defined(RT_ARCH_ARM64)
     3140    /*
     3141     * Patch 64-bit ARM hosts.
     3142     * We can make this work, provided the target address doesn't use bits 63:48.
     3143     */
     3144    /* Pattern #1:
     3145       NtCreateSection:
     3146        180022950: d4000941     svc     #0x4a
     3147        180022954: d65f03c0     ret
     3148        180022958: 00000000     udf     #0x00
     3149        18002295c: 00000000     udf     #0x00 */
     3150    uintptr_t uAddr = (uintptr_t)supR3HardenedMonitor_NtCreateSection;
     3151    if (uAddr >= RT_BIT_64(48))
     3152        supR3HardenedFatalMsg("supR3HardenedWinInstallHooks", kSupInitOp_Misc, VERR_GENERAL_FAILURE,
     3153                              "Address of supR3HardenedMonitor_NtCreateSection (%p) is too high for patching!", uAddr);
     3154    uint32_t const * const pu32NtCreateSection = (uint32_t const *)pbNtCreateSection;
     3155
     3156    if (   (pu32NtCreateSection[0] & ~(UINT32_C(0xffff) << 5)) == UINT32_C(0xd0000001)
     3157        || pu32NtCreateSection[1] != ARMV8_A64_INSTR_RET
     3158        || pu32NtCreateSection[2] != 0
     3159        || pu32NtCreateSection[3] != 0)
     3160        supR3HardenedFatalMsg("supR3HardenedWinInstallHooks", kSupInitOp_Misc, VERR_GENERAL_FAILURE,
     3161                              "Unexpected code found at ntdll!NtCreateSection: %.16Rhxs", pu32NtCreateSection);
     3162    g_NtCreateSectionPatch.au32[0] = Armv8A64MkInstrMovZ(ARMV8_A64_REG_X16, uAddr & 0xffff);
     3163    g_NtCreateSectionPatch.au32[1] = Armv8A64MkInstrMovK(ARMV8_A64_REG_X16, (uAddr >> 16) & 0xffff, 1);
     3164    g_NtCreateSectionPatch.au32[2] = Armv8A64MkInstrMovK(ARMV8_A64_REG_X16, (uAddr >> 32) & 0xffff, 2);
     3165    g_NtCreateSectionPatch.au32[3] = Armv8A64MkInstrBr(ARMV8_A64_REG_X16);
     3166    g_NtCreateSectionPatch.cb = 16;
     3167
     3168#else
     3169# error "port me"
    30753170#endif
    30763171
    … …  
    30863181    uint8_t * const pbLdrLoadDll = (uint8_t *)(uintptr_t)pfnLdrLoadDll;
    30873182    g_pbLdrLoadDll = pbLdrLoadDll;
    3088     memcpy(g_abLdrLoadDllPatch, pbLdrLoadDll, sizeof(g_abLdrLoadDllPatch));
    3089 
     3183    memcpy(g_LdrLoadDllPatch.ab, pbLdrLoadDll, sizeof(g_LdrLoadDllPatch.ab));
     3184
     3185#if defined(RT_ARCH_AMD64) || defined(RT_ARCH_X86)
    30903186    DISSTATE Dis;
    30913187    uint32_t cbInstr;
     3188#endif
    30923189    uint32_t offJmpBack = 0;
    30933190
    … …  
    31233220    /* Assemble the LdrLoadDll patch. */
    31243221    Assert(offJmpBack >= 12);
    3125     g_abLdrLoadDllPatch[0]  = 0x48; /* mov rax, qword */
    3126     g_abLdrLoadDllPatch[1]  = 0xb8;
    3127     *(uint64_t *)&g_abLdrLoadDllPatch[2] = (uint64_t)supR3HardenedMonitor_LdrLoadDll;
    3128     g_abLdrLoadDllPatch[10] = 0xff; /* jmp rax */
    3129     g_abLdrLoadDllPatch[11] = 0xe0;
    3130 
    3131 #else
     3222    g_LdrLoadDllPatch.ab[0]  = 0x48; /* mov rax, qword */
     3223    g_LdrLoadDllPatch.ab[1]  = 0xb8;
     3224    *(uint64_t *)&g_LdrLoadDllPatch.ab[2] = (uint64_t)supR3HardenedMonitor_LdrLoadDll;
     3225    g_LdrLoadDllPatch.ab[10] = 0xff; /* jmp rax */
     3226    g_LdrLoadDllPatch.ab[11] = 0xe0;
     3227    g_LdrLoadDllPatch.cb = 12;
     3228
     3229#elif defined(RT_ARCH_X86)
    31323230    /*
    31333231     * Patch 32-bit hosts.
    … …  
    31563254
    31573255    /* Assemble the LdrLoadDll patch. */
    3158     memcpy(g_abLdrLoadDllPatch, pbLdrLoadDll, sizeof(g_abLdrLoadDllPatch));
    31593256    Assert(offJmpBack >= 5);
    3160     g_abLdrLoadDllPatch[0] = 0xe9;
    3161     *(uint32_t *)&g_abLdrLoadDllPatch[1] = (uintptr_t)supR3HardenedMonitor_LdrLoadDll - (uintptr_t)&pbLdrLoadDll[1+4];
     3257    g_LdrLoadDllPatch.ab[0] = 0xe9;
     3258    *(uint32_t *)&g_LdrLoadDllPatch.ab[1] = (uintptr_t)supR3HardenedMonitor_LdrLoadDll - (uintptr_t)&pbLdrLoadDll[1+4];
     3259    g_LdrLoadDllPatch.cb = 5;
     3260
     3261#elif defined(RT_ARCH_ARM64)
     3262    /*
     3263     * Patch 64-bit ARM hosts.
     3264     * 
     3265     * Note! Blindly ASSUMES that the code is at least 20 bytes long, that x17
     3266     *       isn't being used, and that there are no branch instructions.
     3267     *       So, far we've only seen the typical long STP sequence.
     3268     */
     3269    /** @todo disassemble to make sure x17 isn't used and there is no branching!  */
     3270    offJmpBack = 20;
     3271
     3272    /* Assemble the code for resuming the call.*/
     3273    *(PFNRT *)&g_pfnLdrLoadDllReal = (PFNRT)(uintptr_t)&g_abSupHardReadWriteExecPage[offExecPage];
     3274
     3275    memcpy(&g_abSupHardReadWriteExecPage[offExecPage], pbLdrLoadDll, offJmpBack);
     3276    offExecPage += offJmpBack;
     3277
     3278    uAddr = (uintptr_t)&pbLdrLoadDll[offJmpBack];
     3279    *(uint32_t *)&g_abSupHardReadWriteExecPage[offExecPage] = Armv8A64MkInstrMovZ(ARMV8_A64_REG_X17, uAddr & 0xffff);
     3280    offExecPage += 4;
     3281    *(uint32_t *)&g_abSupHardReadWriteExecPage[offExecPage] = Armv8A64MkInstrMovK(ARMV8_A64_REG_X17, (uAddr >> 16) & 0xffff, 1);
     3282    offExecPage += 4;
     3283    *(uint32_t *)&g_abSupHardReadWriteExecPage[offExecPage] = Armv8A64MkInstrMovK(ARMV8_A64_REG_X17, (uAddr >> 32) & 0xffff, 2);
     3284    offExecPage += 4;
     3285    *(uint32_t *)&g_abSupHardReadWriteExecPage[offExecPage] = Armv8A64MkInstrMovK(ARMV8_A64_REG_X17, (uAddr >> 48) & 0xffff, 3);
     3286    offExecPage += 4;
     3287    *(uint32_t *)&g_abSupHardReadWriteExecPage[offExecPage] = Armv8A64MkInstrBr(ARMV8_A64_REG_X17);
     3288    offExecPage = RT_ALIGN_32(offExecPage + 4, 16);
     3289
     3290    /* Assemble the LdrLoadDll patch. */
     3291# if 0
     3292    uAddr = (uintptr_t)supR3HardenedMonitor_LdrLoadDll;
     3293    g_LdrLoadDllPatch.au32[0] = Armv8A64MkInstrMovZ(ARMV8_A64_REG_X17, uAddr & 0xffff);
     3294    g_LdrLoadDllPatch.au32[1] = Armv8A64MkInstrMovK(ARMV8_A64_REG_X17, (uAddr >> 16) & 0xffff, 1);
     3295    g_LdrLoadDllPatch.au32[2] = Armv8A64MkInstrMovK(ARMV8_A64_REG_X17, (uAddr >> 16) & 0xffff, 2);
     3296    g_LdrLoadDllPatch.au32[3] = Armv8A64MkInstrMovK(ARMV8_A64_REG_X17, (uAddr >> 16) & 0xffff, 3);
     3297    g_LdrLoadDllPatch.au32[4] = Armv8A64MkInstrBr(ARMV8_A64_REG_X17);
     3298    g_LdrLoadDllPatch.cb = 20;
     3299# else
     3300    g_LdrLoadDllPatch.au32[0] = Armv8A64MkInstrLdrLitteral(kArmv8A64InstrLdrLitteral_Dword, ARMV8_A64_REG_X17, 8);
     3301    g_LdrLoadDllPatch.au32[1] = Armv8A64MkInstrBr(ARMV8_A64_REG_X17);
     3302    g_LdrLoadDllPatch.au64[1] = (uintptr_t)supR3HardenedMonitor_LdrLoadDll;
     3303    g_LdrLoadDllPatch.cb = 16;
     3304# endif
     3305
     3306#else
     3307# error "port me"
    31623308#endif
    31633309
    … …  
    31763322    uint8_t * const pbKiUserApcDispatcher = (uint8_t *)(uintptr_t)pfnKiUserApcDispatcher;
    31773323    g_pbKiUserApcDispatcher = pbKiUserApcDispatcher;
    3178     memcpy(g_abKiUserApcDispatcherPatch, pbKiUserApcDispatcher, sizeof(g_abKiUserApcDispatcherPatch));
     3324    memcpy(g_KiUserApcDispatcherPatch.ab, pbKiUserApcDispatcher, sizeof(g_KiUserApcDispatcherPatch.ab));
    31793325
    31803326#ifdef RT_ARCH_AMD64
    … …  
    32103356    /* Assemble the KiUserApcDispatcher patch. */
    32113357    Assert(offJmpBack >= 12);
    3212     g_abKiUserApcDispatcherPatch[0]  = 0x48; /* mov rax, qword */
    3213     g_abKiUserApcDispatcherPatch[1]  = 0xb8;
    3214     *(uint64_t *)&g_abKiUserApcDispatcherPatch[2] = (uint64_t)supR3HardenedMonitor_KiUserApcDispatcher;
    3215     g_abKiUserApcDispatcherPatch[10] = 0xff; /* jmp rax */
    3216     g_abKiUserApcDispatcherPatch[11] = 0xe0;
    3217 
    3218 #else
     3358    g_KiUserApcDispatcherPatch.ab[0]  = 0x48; /* mov rax, qword */
     3359    g_KiUserApcDispatcherPatch.ab[1]  = 0xb8;
     3360    *(uint64_t *)&g_KiUserApcDispatcherPatch.ab[2] = (uint64_t)supR3HardenedMonitor_KiUserApcDispatcher;
     3361    g_KiUserApcDispatcherPatch.ab[10] = 0xff; /* jmp rax */
     3362    g_KiUserApcDispatcherPatch.ab[11] = 0xe0;
     3363    g_KiUserApcDispatcherPatch.cb = 12;
     3364
     3365#elif defined(RT_ARCH_X86)
    32193366    /*
    32203367     * Patch 32-bit hosts.
    … …  
    32443391
    32453392    /* Assemble the KiUserApcDispatcher patch. */
    3246     memcpy(g_abKiUserApcDispatcherPatch, pbKiUserApcDispatcher, sizeof(g_abKiUserApcDispatcherPatch));
    32473393    Assert(offJmpBack >= 5);
    3248     g_abKiUserApcDispatcherPatch[0] = 0xe9;
    3249     *(uint32_t *)&g_abKiUserApcDispatcherPatch[1] = (uintptr_t)supR3HardenedMonitor_KiUserApcDispatcher - (uintptr_t)&pbKiUserApcDispatcher[1+4];
     3394    g_KiUserApcDispatcherPatch.ab[0] = 0xe9;
     3395    *(uint32_t *)&g_KiUserApcDispatcherPatch.ab[1] = (uintptr_t)supR3HardenedMonitor_KiUserApcDispatcher - (uintptr_t)&pbKiUserApcDispatcher[1+4];
     3396    g_KiUserApcDispatcherPatch.cb = 5;
     3397
     3398#elif defined(RT_ARCH_ARM64)
     3399    /*
     3400     * Patch 64-bit ARM hosts.
     3401     *
     3402     * Note! Blindly ASSUMES that the code is at least 16 bytes long, that x17
     3403     *       isn't being used, and that there are no branch instructions.
     3404     *       In the code we've been looking at, the 4th instruction is a CBZ,
     3405     *       which means we can only use 16 bytes here to do the patching.
     3406     *
     3407     * w10-1709:
     3408     *      1800243a0: f94003ef     ldr     x15, [sp]                   ; The APC routine address.
     3409     *      1800243a4: 9342fde2     asr     x2, x15, #2
     3410     *      1800243a8: cb0203e2     neg     x2, x2
     3411     *      1800243ac: d360fc40     lsr     x0, x2, #32
     3412     *      1800243b0: 340001a0     cbz     w0, 0x1800243e4 <KiUserApcDispatcher+0x44>  ; jump if WOW stuff.
     3413     *      1800243b4: f94007e0     ldr     x0, [sp, #0x8]              ; APC arg #0
     3414     *      1800243b8: f9400be1     ldr     x1, [sp, #0x10]             ; APC arg #1
     3415     *      1800243bc: f9400fe2     ldr     x2, [sp, #0x18]             ; APC arg #2
     3416     *      1800243c0: 97ffffe4     bl      0x180024350 <RtlFirstEntrySList+0x10>
     3417     *      1800243c4: 910083e0     add     x0, sp, #0x20               ; x0=PCONTEXT
     3418     *      1800243c8: d2800021     mov     x1, #0x1                // =1
     3419     *      1800243cc: 97fff945     bl      0x1800228e0 <ZwContinue>
     3420     */
     3421    /** @todo disassemble to make sure x17 isn't used and there is no branching!  */
     3422    offJmpBack = 16;
     3423    uint32_t const * const pu32KiUserApcDispatcher = (uint32_t const *)pbKiUserApcDispatcher;
     3424    if (   pu32KiUserApcDispatcher[0] != UINT32_C(0xf94003ef)
     3425        || pu32KiUserApcDispatcher[1] != UINT32_C(0x9342fde2)
     3426        || pu32KiUserApcDispatcher[2] != UINT32_C(0xcb0203e2)
     3427        || pu32KiUserApcDispatcher[3] != UINT32_C(0xd360fc40))
     3428        supR3HardenedWinHookFailed("KiUserApcDispatcher", pbKiUserApcDispatcher);
     3429
     3430    /* Assemble the code for resuming the call.*/
     3431    *(PFNRT *)&g_pfnKiUserApcDispatcherReal = (PFNRT)(uintptr_t)&g_abSupHardReadWriteExecPage[offExecPage];
     3432
     3433    memcpy(&g_abSupHardReadWriteExecPage[offExecPage], pbKiUserApcDispatcher, offJmpBack);
     3434    offExecPage += offJmpBack;
     3435
     3436    uAddr = (uintptr_t)&pbKiUserApcDispatcher[offJmpBack];
     3437    *(uint32_t *)&g_abSupHardReadWriteExecPage[offExecPage] = Armv8A64MkInstrMovZ(ARMV8_A64_REG_X17, uAddr & 0xffff);
     3438    offExecPage += 4;
     3439    *(uint32_t *)&g_abSupHardReadWriteExecPage[offExecPage] = Armv8A64MkInstrMovK(ARMV8_A64_REG_X17, (uAddr >> 16) & 0xffff, 1);
     3440    offExecPage += 4;
     3441    *(uint32_t *)&g_abSupHardReadWriteExecPage[offExecPage] = Armv8A64MkInstrMovK(ARMV8_A64_REG_X17, (uAddr >> 32) & 0xffff, 2);
     3442    offExecPage += 4;
     3443    *(uint32_t *)&g_abSupHardReadWriteExecPage[offExecPage] = Armv8A64MkInstrMovK(ARMV8_A64_REG_X17, (uAddr >> 48) & 0xffff, 3);
     3444    offExecPage += 4;
     3445    *(uint32_t *)&g_abSupHardReadWriteExecPage[offExecPage] = Armv8A64MkInstrBr(ARMV8_A64_REG_X17);
     3446    offExecPage = RT_ALIGN_32(offExecPage + 4, 16);
     3447
     3448    /* Assemble the KiUserApcDispatcher patch. */
     3449# if 0
     3450    uAddr = (uintptr_t)supR3HardenedMonitor_LdrLoadDll;
     3451    if (uAddr >= RT_BIT_64(48))
     3452        supR3HardenedFatalMsg("supR3HardenedWinInstallHooks", kSupInitOp_Misc, VERR_GENERAL_FAILURE,
     3453                              "Address of supR3HardenedMonitor_LdrLoadDll (%p) is too high for patching!", uAddr);
     3454    g_KiUserApcDispatcherPatch.au32[0] = Armv8A64MkInstrMovZ(ARMV8_A64_REG_X17, uAddr & 0xffff);
     3455    g_KiUserApcDispatcherPatch.au32[1] = Armv8A64MkInstrMovK(ARMV8_A64_REG_X17, (uAddr >> 16) & 0xffff, 1);
     3456    g_KiUserApcDispatcherPatch.au32[2] = Armv8A64MkInstrMovK(ARMV8_A64_REG_X17, (uAddr >> 16) & 0xffff, 2);
     3457    //g_KiUserApcDispatcherPatch.au32[3] = Armv8A64MkInstrMovK(ARMV8_A64_REG_X17, (uAddr >> 16) & 0xffff, 3);
     3458    g_KiUserApcDispatcherPatch.au32[3] = Armv8A64MkInstrBr(ARMV8_A64_REG_X17);
     3459    g_KiUserApcDispatcherPatch.cb = 16;
     3460# else
     3461    g_KiUserApcDispatcherPatch.au32[0] = Armv8A64MkInstrLdrLitteral(kArmv8A64InstrLdrLitteral_Dword, ARMV8_A64_REG_X17, 8);
     3462    g_KiUserApcDispatcherPatch.au32[1] = Armv8A64MkInstrBr(ARMV8_A64_REG_X17);
     3463    g_KiUserApcDispatcherPatch.au64[1] = (uintptr_t)supR3HardenedMonitor_LdrLoadDll;
     3464# endif
     3465
     3466#else
     3467# error "port me"
    32503468#endif
     3469
    32513470
    32523471#ifndef VBOX_WITHOUT_HARDENDED_XCPT_LOGGING
    … …  
    32613480    uint8_t * const pbKiUserExceptionDispatcher = (uint8_t *)(uintptr_t)pfnKiUserExceptionDispatcher;
    32623481    g_pbKiUserExceptionDispatcher = pbKiUserExceptionDispatcher;
    3263     memcpy(g_abKiUserExceptionDispatcherPatch, pbKiUserExceptionDispatcher, sizeof(g_abKiUserExceptionDispatcherPatch));
     3482    memcpy(g_KiUserExceptionDispatcherPatch.ab, pbKiUserExceptionDispatcher, sizeof(g_KiUserExceptionDispatcherPatch.ab));
    32643483
    32653484# ifdef RT_ARCH_AMD64
    … …  
    32863505    {
    32873506        /* Assemble the KiUserExceptionDispatcher patch. */
    3288         g_abKiUserExceptionDispatcherPatch[1]  = 0x48; /* MOV RAX, supR3HardenedMonitor_KiUserExceptionDispatcher */
    3289         g_abKiUserExceptionDispatcherPatch[2]  = 0xb8;
    3290         *(uint64_t *)&g_abKiUserExceptionDispatcherPatch[3] = (uint64_t)supR3HardenedMonitor_KiUserExceptionDispatcher;
    3291         g_abKiUserExceptionDispatcherPatch[11] = 0x90; /* NOP (was JZ) */
    3292         g_abKiUserExceptionDispatcherPatch[12] = 0x90; /* NOP (was DISP8 of JZ) */
     3507        g_KiUserExceptionDispatcherPatch.ab[1]  = 0x48; /* MOV RAX, supR3HardenedMonitor_KiUserExceptionDispatcher */
     3508        g_KiUserExceptionDispatcherPatch.ab[2]  = 0xb8;
     3509        *(uint64_t *)&g_KiUserExceptionDispatcherPatch.ab[3] = (uint64_t)supR3HardenedMonitor_KiUserExceptionDispatcher;
     3510        g_KiUserExceptionDispatcherPatch.ab[11] = 0x90; /* NOP (was JZ) */
     3511        g_KiUserExceptionDispatcherPatch.ab[12] = 0x90; /* NOP (was DISP8 of JZ) */
     3512        g_KiUserExceptionDispatcherPatch.cb = 13;
    32933513    }
    32943514    else
    32953515        SUP_DPRINTF(("supR3HardenedWinInstallHooks: failed to patch KiUserExceptionDispatcher (%.20Rhxs)\n",
    32963516                     pbKiUserExceptionDispatcher));
    3297 # else
     3517
     3518# elif defined(RT_ARCH_X86)
    32983519    /*
    32993520     * Patch 32-bit hosts.
    … …  
    33283549
    33293550        /* Assemble the KiUserExceptionDispatcher patch. */
    3330         memcpy(g_abKiUserExceptionDispatcherPatch, pbKiUserExceptionDispatcher, sizeof(g_abKiUserExceptionDispatcherPatch));
    33313551        Assert(offJmpBack >= 5);
    3332         g_abKiUserExceptionDispatcherPatch[0] = 0xe9;
    3333         *(uint32_t *)&g_abKiUserExceptionDispatcherPatch[1] = (uintptr_t)supR3HardenedMonitor_KiUserExceptionDispatcher - (uintptr_t)&pbKiUserExceptionDispatcher[1+4];
    3334     }
     3552        g_KiUserExceptionDispatcherPatch.ab[0] = 0xe9;
     3553        *(uint32_t *)&g_KiUserExceptionDispatcherPatch.ab[1] = (uintptr_t)supR3HardenedMonitor_KiUserExceptionDispatcher - (uintptr_t)&pbKiUserExceptionDispatcher[1+4];
     3554        g_KiUserExceptionDispatcherPatch.cb = 5;
     3555    }
     3556
     3557# elif defined(RT_ARCH_ARM64)
     3558    /*
     3559     * Patch 64-bit ARM.
     3560     *
     3561     * This is a bit more interesting as the w10-1709 code looks like this:
     3562     *     0000000180024490 <KiUserExceptionDispatcher>:
     3563     *     180024490: 5800028f     ldr     x15, 0x1800244e0 <KiUserExceptionDispatcher+0x50>
     3564     *     180024494: f94001ef     ldr     x15, [x15]
     3565     *     180024498: b400008f     cbz     x15, 0x1800244a8 <KiUserExceptionDispatcher+0x18>
     3566     *     18002449c: 910e43e0     add     x0, sp, #0x390
     3567     *     1800244a0: 910003e1     mov     x1, sp
     3568     *     1800244a4: d63f01e0     blr     x15
     3569     *     1800244a8: 910e43e0     add     x0, sp, #0x390
     3570     *     1800244ac: 910003e1     mov     x1, sp
     3571     *     1800244b0: 94011b76     bl      0x18006b288 <RtlQueryEnvironmentVariable+0x21d8>
     3572     *     1800244b4: b40000a0     cbz     x0, 0x1800244c8 <KiUserExceptionDispatcher+0x38>
     3573     *
     3574     * What is loaded and checked at the beginning is a function poitner caller
     3575     * Wow64PrepareForException, which we can presume is NULL for a native
     3576     * arm64 process.
     3577     *
     3578     * The easiest thing to do would be to hijack the pointer. Unfortunately
     3579     * that differs too much from the others architectures, as the patching
     3580     * will be done at 0x1800244e0 rather 0000000180024490.  Instead, we can
     3581     * just replace the first three functions and load our own address directly
     3582     * into x15. We will still differ from the others in that we get other
     3583     * parameters and don't have any g_pfnKiUserExceptionDispatcherReal but can
     3584     * just return from the hook.
     3585     */
     3586    uint32_t const * const pu32KiUserExceptionDispatcher = (uint32_t const *)pbKiUserExceptionDispatcher;
     3587    if (   (pu32KiUserExceptionDispatcher[0] & UINT32_C(0xff00001f)) == (UINT32_C(0x58000000) | ARMV8_A64_REG_X15)
     3588        && pu32KiUserExceptionDispatcher[1]                          == UINT32_C(0xf94001ef)
     3589        && (pu32KiUserExceptionDispatcher[2] & UINT32_C(0xff00001f)) == (UINT32_C(0xb4000000) | ARMV8_A64_REG_X15)
     3590        && (pu32KiUserExceptionDispatcher[3] & UINT32_C(0xffc003ff)) == (UINT32_C(0x91000000) | ARMV8_A64_REG_X0 | (ARMV8_A64_REG_SP << 5))
     3591        && pu32KiUserExceptionDispatcher[4]                          == UINT32_C(0x910003e1)
     3592        && pu32KiUserExceptionDispatcher[5]                          == UINT32_C(0xd63f01e0) )
     3593    {
     3594        *(uintptr_t *)&g_pfnKiUserExceptionDispatcherReal = (uintptr_t)&pu32KiUserExceptionDispatcher[6]; /* after BLR */
     3595        uAddr = (uintptr_t)supR3HardenedMonitor_KiUserExceptionDispatcher;
     3596        if (uAddr >= RT_BIT_64(48))
     3597            supR3HardenedFatalMsg("supR3HardenedWinInstallHooks", kSupInitOp_Misc, VERR_GENERAL_FAILURE,
     3598                                  "Address of supR3HardenedMonitor_KiUserExceptionDispatcher (%p) is too high for patching!", uAddr);
     3599        g_KiUserExceptionDispatcherPatch.au32[0] = Armv8A64MkInstrMovZ(ARMV8_A64_REG_X15, uAddr & 0xffff);
     3600        g_KiUserExceptionDispatcherPatch.au32[1] = Armv8A64MkInstrMovK(ARMV8_A64_REG_X15, (uAddr >> 16) & 0xffff, 1);
     3601        g_KiUserExceptionDispatcherPatch.au32[2] = Armv8A64MkInstrMovK(ARMV8_A64_REG_X15, (uAddr >> 16) & 0xffff, 2);
     3602        g_KiUserExceptionDispatcherPatch.cb = 12;
     3603    }
     3604    else
     3605        SUP_DPRINTF(("supR3HardenedWinInstallHooks: failed to patch KiUserExceptionDispatcher (%.20Rhxs)\n",
     3606                     pbKiUserExceptionDispatcher));
     3607
     3608# else
     3609#  error "port me"
    33353610# endif
    33363611#endif /* !VBOX_WITHOUT_HARDENDED_XCPT_LOGGING */
    … …  
    33743649 *                              the NTDLL instance we're patching.  (Must be +/-
    33753650 *                              2GB from the thunk code.)
    3376  * @param   pabBackup           Where to back up the original instruction bytes
     3651 * @param   pBackup             Where to back up the original instruction bytes
    33773652 *                              at pvLdrInitThunk.
    3378  * @param   cbBackup            The size of the backup area. Must be 16 bytes.
    33793653 * @param   pErrInfo            Where to return extended error information.
    33803654 *                              Optional.
    33813655 */
    33823656static int supR3HardNtDisableThreadCreationEx(HANDLE hProcess, void *pvLdrInitThunk, void *pvNtTerminateThread,
    3383                                               uint8_t *pabBackup, size_t cbBackup, PRTERRINFO pErrInfo)
     3657                                              SUPR3HARDNTPATCH *pBackup, PRTERRINFO pErrInfo)
    33843658{
    33853659    SUP_DPRINTF(("supR3HardNtDisableThreadCreation: pvLdrInitThunk=%p pvNtTerminateThread=%p\n", pvLdrInitThunk, pvNtTerminateThread));
    3386     SUPR3HARDENED_ASSERT(cbBackup == 16);
     3660    SUPR3HARDENED_ASSERT(pBackup->cb == 16);
    33873661    SUPR3HARDENED_ASSERT(RT_ABS((intptr_t)pvLdrInitThunk - (intptr_t)pvNtTerminateThread) < 16*_1M);
    33883662
    … …  
    33913665     */
    33923666    SIZE_T  cbIgnored;
    3393     NTSTATUS rcNt = NtReadVirtualMemory(hProcess, pvLdrInitThunk, pabBackup, cbBackup, &cbIgnored);
     3667    NTSTATUS rcNt = NtReadVirtualMemory(hProcess, pvLdrInitThunk, pBackup->ab, sizeof(pBackup->ab), &cbIgnored);
    33943668    if (!NT_SUCCESS(rcNt))
    33953669        return RTErrInfoSetF(pErrInfo, VERR_GENERAL_FAILURE,
    … …  
    33993673     * Cook up replacement code that calls NtTerminateThread.
    34003674     */
    3401     uint8_t abReplacement[16];
    3402     memcpy(abReplacement, pabBackup, sizeof(abReplacement));
     3675    SUPR3HARDNTPATCH Replacement;
     3676    memcpy(Replacement.ab, pBackup->ab, sizeof(Replacement.ab));
    34033677
    34043678#ifdef RT_ARCH_AMD64
    3405     abReplacement[0] = 0x31;    /* xor ecx, ecx */
    3406     abReplacement[1] = 0xc9;
    3407     abReplacement[2] = 0x31;    /* xor edx, edx */
    3408     abReplacement[3] = 0xd2;
    3409     abReplacement[4] = 0xe8;    /* call near NtTerminateThread */
    3410     *(int32_t *)&abReplacement[5] = (int32_t)((uintptr_t)pvNtTerminateThread - ((uintptr_t)pvLdrInitThunk + 9));
    3411     abReplacement[9] = 0xcc;    /* int3 */
     3679    Replacement.ab[0] = 0x31;    /* xor ecx, ecx */
     3680    Replacement.ab[1] = 0xc9;
     3681    Replacement.ab[2] = 0x31;    /* xor edx, edx */
     3682    Replacement.ab[3] = 0xd2;
     3683    Replacement.ab[4] = 0xe8;    /* call near NtTerminateThread */
     3684    *(int32_t *)&Replacement.ab[5] = (int32_t)((uintptr_t)pvNtTerminateThread - ((uintptr_t)pvLdrInitThunk + 9));
     3685    Replacement.ab[9] = 0xcc;    /* int3 */
     3686    Replacement.cb = 10;
     3687
    34123688#elif defined(RT_ARCH_X86)
    3413     abReplacement[0] = 0x6a;    /* push 0 */
    3414     abReplacement[1] = 0x00;
    3415     abReplacement[2] = 0x6a;    /* push 0 */
    3416     abReplacement[3] = 0x00;
    3417     abReplacement[4] = 0xe8;    /* call near NtTerminateThread */
    3418     *(int32_t *)&abReplacement[5] = (int32_t)((uintptr_t)pvNtTerminateThread - ((uintptr_t)pvLdrInitThunk + 9));
    3419     abReplacement[9] = 0xcc;    /* int3 */
     3689    Replacement.ab[0] = 0x6a;    /* push 0 */
     3690    Replacement.ab[1] = 0x00;
     3691    Replacement.ab[2] = 0x6a;    /* push 0 */
     3692    Replacement.ab[3] = 0x00;
     3693    Replacement.ab[4] = 0xe8;    /* call near NtTerminateThread */
     3694    *(int32_t *)&Replacement.ab[5] = (int32_t)((uintptr_t)pvNtTerminateThread - ((uintptr_t)pvLdrInitThunk + 9));
     3695    Replacement.ab[9] = 0xcc;    /* int3 */
     3696    Replacement.cb = 10;
     3697
     3698#elif defined(RT_ARCH_ARM64)
     3699    Replacement.au32[0] = Armv8A64MkInstrEor(ARMV8_A64_REG_X0, ARMV8_A64_REG_X0, ARMV8_A64_REG_X0);
     3700    Replacement.au32[1] = Armv8A64MkInstrEor(ARMV8_A64_REG_X1, ARMV8_A64_REG_X1, ARMV8_A64_REG_X1);
     3701    intptr_t const offDisp = (intptr_t)pvNtTerminateThread - ((intptr_t)pvLdrInitThunk + 8);
     3702    if (offDisp >= (int32_t)RT_BIT_32(25) || offDisp < -(int32_t)RT_BIT_32(25))
     3703        return RTErrInfoSetF(pErrInfo, VERR_GENERAL_FAILURE,
     3704                             "supR3HardNtDisableThreadCreation: relative distance too large for BL: %p", offDisp);
     3705    Replacement.au32[2] = Armv8A64MkInstrBl((int32_t)offDisp);
     3706    Replacement.cb = 12;
     3707
    34203708#else
    34213709# error "Unsupported arch."
    34223710#endif
     3711    pBackup->cb = Replacement.cb;
    34233712
    34243713    /*
    … …  
    34263715     */
    34273716    PVOID  pvProt   = pvLdrInitThunk;
    3428     SIZE_T cbProt   = cbBackup;
     3717    SIZE_T cbProt   = Replacement.cb;
    34293718    ULONG  fOldProt = 0;
    34303719    rcNt = NtProtectVirtualMemory(hProcess, &pvProt, &cbProt, PAGE_EXECUTE_READWRITE, &fOldProt);
    … …  
    34333722                             "supR3HardNtDisableThreadCreationEx: NtProtectVirtualMemory/LdrInitializeThunk failed: %#x", rcNt);
    34343723
    3435     rcNt = NtWriteVirtualMemory(hProcess, pvLdrInitThunk, abReplacement, sizeof(abReplacement), &cbIgnored);
     3724    rcNt = NtWriteVirtualMemory(hProcess, pvLdrInitThunk, Replacement.ab, Replacement.cb, &cbIgnored);
    34363725    if (!NT_SUCCESS(rcNt))
    34373726        return RTErrInfoSetF(pErrInfo, VERR_GENERAL_FAILURE,
    … …  
    34393728
    34403729    pvProt   = pvLdrInitThunk;
    3441     cbProt   = cbBackup;
     3730    cbProt   = pBackup->cb;
    34423731    rcNt = NtProtectVirtualMemory(hProcess, &pvProt, &cbProt, fOldProt, &fOldProt);
    34433732    if (!NT_SUCCESS(rcNt))
    … …  
    34563745 * @param   pvLdrInitThunk      The address of the LdrInitializeThunk code to
    34573746 *                              override.
    3458  * @param   pabBackup           Where to back up the original instruction bytes
     3747 * @param   pBackup             Where to back up the original instruction bytes
    34593748 *                              at pvLdrInitThunk.
    3460  * @param   cbBackup            The size of the backup area. Must be 16 bytes.
    34613749 * @param   pErrInfo            Where to return extended error information.
    34623750 *                              Optional.
    34633751 */
    3464 static int supR3HardNtEnableThreadCreationEx(HANDLE hProcess, void *pvLdrInitThunk, uint8_t const *pabBackup, size_t cbBackup,
     3752static int supR3HardNtEnableThreadCreationEx(HANDLE hProcess, void *pvLdrInitThunk, SUPR3HARDNTPATCH const *pBackup,
    34653753                                             PRTERRINFO pErrInfo)
    34663754{
    34673755    SUP_DPRINTF(("supR3HardNtEnableThreadCreationEx:\n"));
    3468     SUPR3HARDENED_ASSERT(cbBackup == 16);
     3756    SUPR3HARDENED_ASSERT(pBackup->cb > 4);
    34693757
    34703758    PVOID  pvProt   = pvLdrInitThunk;
    3471     SIZE_T cbProt   = cbBackup;
     3759    SIZE_T cbProt   = pBackup->cb;
    34723760    ULONG  fOldProt = 0;
    34733761    NTSTATUS rcNt = NtProtectVirtualMemory(hProcess, &pvProt, &cbProt, PAGE_EXECUTE_READWRITE, &fOldProt);
    … …  
    34773765
    34783766    SIZE_T cbIgnored;
    3479     rcNt = NtWriteVirtualMemory(hProcess, pvLdrInitThunk, pabBackup, cbBackup, &cbIgnored);
     3767    rcNt = NtWriteVirtualMemory(hProcess, pvLdrInitThunk, pBackup->ab, pBackup->cb, &cbIgnored);
    34803768    if (!NT_SUCCESS(rcNt))
    34813769        return RTErrInfoSetF(pErrInfo, VERR_GENERAL_FAILURE,
    … …  
    34843772
    34853773    pvProt   = pvLdrInitThunk;
    3486     cbProt   = cbBackup;
     3774    cbProt   = pBackup->cb;
    34873775    rcNt = NtProtectVirtualMemory(hProcess, &pvProt, &cbProt, fOldProt, &fOldProt);
    34883776    if (!NT_SUCCESS(rcNt))
    … …  
    35133801                                                (void *)(uintptr_t)&LdrInitializeThunk,
    35143802                                                (void *)(uintptr_t)s_pfnNtTerminateThread,
    3515                                                 g_abLdrInitThunkSelfBackup, sizeof(g_abLdrInitThunkSelfBackup),
     3803                                                &g_LdrInitThunkSelfBackup,
    35163804                                                NULL /* pErrInfo*/);
    35173805    g_fSupInitThunkSelfPatched = RT_SUCCESS(rc);
    … …  
    35283816        int rc = supR3HardNtEnableThreadCreationEx(NtCurrentProcess(),
    35293817                                                   (void *)(uintptr_t)&LdrInitializeThunk,
    3530                                                    g_abLdrInitThunkSelfBackup, sizeof(g_abLdrInitThunkSelfBackup),
     3818                                                   &g_LdrInitThunkSelfBackup,
    35313819                                                   RTErrInfoInitStatic(&g_ErrInfoStatic));
    35323820        if (RT_FAILURE(rc))
    … …  
    43504638     *       the process verification code ignores.
    43514639     */
    4352     uint8_t abNew[16];
    4353     memcpy(abNew, pbChildNtDllBits + ((uintptr_t)uLdrInitThunk - pThis->uNtDllAddr), sizeof(abNew));
     4640    SUPR3HARDNTPATCH New;
     4641    memcpy(New.ab, pbChildNtDllBits + ((uintptr_t)uLdrInitThunk - pThis->uNtDllAddr), sizeof(New.ab));
    43544642#ifdef RT_ARCH_AMD64
    4355     abNew[0] = 0xff;
    4356     abNew[1] = 0x25;
    4357     *(uint32_t *)&abNew[2] = 0;
    4358     *(uint64_t *)&abNew[6] = uEarlyProcInitEP;
     4643    New.ab[0] = 0xff;                /* jmp [addr wrt RIP] */
     4644    New.ab[1] = 0x25;
     4645    *(uint32_t *)&New.ab[2] = 0;
     4646    /* addr: */
     4647    *(uint64_t *)&New.ab[6] = uEarlyProcInitEP;
     4648    New.cb = 6+8;
     4649
    43594650#elif defined(RT_ARCH_X86)
    4360     abNew[0] = 0xe9;
    4361     *(uint32_t *)&abNew[1] = uEarlyProcInitEP - ((uint32_t)uLdrInitThunk + 5);
     4651    New.ab[0] = 0xe9;                /* jmp rel32 */
     4652    *(uint32_t *)&New.ab[1] = uEarlyProcInitEP - ((uint32_t)uLdrInitThunk + 5);
     4653    New.cb = 5;
     4654
     4655#elif defined(RT_ARCH_ARM64)
     4656    /* LdrInitializeThunk:
     4657           180088970: f81f0ff3     str     x19, [sp, #-0x10]!
     4658           180088974: a9bf7bfd     stp     x29, x30, [sp, #-0x10]!
     4659           180088978: 910003fd     mov     x29, sp
     4660           18008897c: aa0003f3     mov     x19, x0
     4661           180088980: 94000006     bl      0x180088998 <LdrInitializeThunk+0x28>
     4662           180088984: 52800021     mov     w1, #0x1                // =1
     4663           180088988: aa1303e0     mov     x0, x19
     4664           18008898c: 97fe67d5     bl      0x1800228e0 <ZwContinue> */
     4665# if 0
     4666    New.au32[0] = Armv8A64MkInstrMovZ(ARMV8_A64_REG_X16, uEarlyProcInitEP & 0xffff);
     4667    New.au32[1] = Armv8A64MkInstrMovK(ARMV8_A64_REG_X16, (uEarlyProcInitEP >> 16) & 0xffff, 1);
     4668    New.au32[2] = Armv8A64MkInstrMovK(ARMV8_A64_REG_X16, (uEarlyProcInitEP >> 24) & 0xffff, 2);
     4669    New.au32[3] = Armv8A64MkInstrMovK(ARMV8_A64_REG_X16, (uEarlyProcInitEP >> 32) & 0xffff, 3);
     4670    New.au32[4] = Armv8A64MkInstrBr(ARMV8_A64_REG_X16);
     4671    New.cb = 20;
     4672# else
     4673    New.au32[0] = Armv8A64MkInstrLdrLitteral(kArmv8A64InstrLdrLitteral_Dword, ARMV8_A64_REG_X16, 8);
     4674    New.au32[1] = Armv8A64MkInstrBr(ARMV8_A64_REG_X16);
     4675    New.au64[1] = uEarlyProcInitEP;
     4676    New.cb = 16;
     4677# endif
    43624678#else
    43634679# error "Unsupported arch."
    … …  
    43684684     */
    43694685    PVOID   pvProt = pvLdrInitThunk;
    4370     SIZE_T  cbProt = sizeof(abNew);
     4686    SIZE_T  cbProt = New.cb;
    43714687    ULONG   fOldProt;
    43724688    rcNt = NtProtectVirtualMemory(pThis->hProcess, &pvProt, &cbProt, PAGE_EXECUTE_READWRITE, &fOldProt);
    … …  
    43754691                                  "NtProtectVirtualMemory/LdrInitializeThunk failed: %#x", rcNt);
    43764692
    4377     rcNt = NtWriteVirtualMemory(pThis->hProcess, pvLdrInitThunk, abNew, sizeof(abNew), &cbIgnored);
     4693    rcNt = NtWriteVirtualMemory(pThis->hProcess, pvLdrInitThunk, New.ab, New.cb, &cbIgnored);
    43784694    if (!NT_SUCCESS(rcNt))
    43794695        supR3HardenedWinKillChild(pThis, "supR3HardenedWinSetupChildInit", rcNt,
    … …  
    43814697
    43824698    pvProt = pvLdrInitThunk;
    4383     cbProt = sizeof(abNew);
     4699    cbProt = New.cb;
    43844700    rcNt = NtProtectVirtualMemory(pThis->hProcess, &pvProt, &cbProt, fOldProt, &fOldProt);
    43854701    if (!NT_SUCCESS(rcNt))
    … …  
    44004716#elif defined(RT_ARCH_X86)
    44014717        DWORD   *pPC = &Ctx.Eip;
     4718#elif defined(RT_ARCH_ARM64)
     4719        DWORD64 *pPC = &Ctx.Pc;
    44024720#else
    44034721# error "Unsupported arch."
    … …  
    44794797            SUP_DPRINTF(("Warning! Misaligned RSP: %016RX64\n", Ctx.Rsp));
    44804798#endif
     4799#if defined(RT_ARCH_AMD64) || defined(RT_ARCH_X86)
    44814800        if (Ctx.SegCs != ASMGetCS())
    44824801            SUP_DPRINTF(("Warning! Bogus CS: %04x, expected %04x\n", Ctx.SegCs, ASMGetCS()));
    … …  
    44994818            fUpdateContext = true;
    45004819        }
     4820#endif
    45014821
    45024822        if (fUpdateContext)
    … …  
    45294849    /* Make ImageBaseAddress useless. */
    45304850    Peb.ImageBaseAddress = (PVOID)((uintptr_t)Peb.ImageBaseAddress ^ UINT32_C(0x5f139000));
    4531 #ifdef RT_ARCH_AMD64
     4851#if defined(RT_ARCH_AMD64) || defined(RT_ARCH_ARM64)
    45324852    Peb.ImageBaseAddress = (PVOID)((uintptr_t)Peb.ImageBaseAddress | UINT64_C(0x0313000000000000));
    45334853#endif

  • trunk/src/VBox/HostDrivers/Support/win/SUPR3HardenedMainImports-win.cpp

    r106061 r106893  
    4848#include <iprt/string.h>
    4949#include <iprt/utf16.h>
     50#ifdef RT_ARCH_ARM64
     51# include <iprt/armv8.h>
     52#endif
    5053
    5154#include "SUPLibInternal.h"
    … …  
    104107    /** Assembly system call routine, type 1.  */
    105108    PFNRT                   pfnType1;
     109#if defined(RT_ARCH_AMD64) || defined(RT_ARCH_X86)
    106110    /** Assembly system call routine, type 2.  */
    107111    PFNRT                   pfnType2;
     112#endif
    108113#ifdef RT_ARCH_X86
    109114    /** The parameter size in bytes for a standard call. */
    … …  
    177182    extern PFNRT    RT_CONCAT(g_pfn, a_Name);
    178183#define SUPHARNT_IMPORT_STDCALL_EARLY_OPTIONAL(a_Name, a_cbParamsX86)  SUPHARNT_IMPORT_STDCALL_EARLY(a_Name, a_cbParamsX86)
    179 #define SUPHARNT_IMPORT_SYSCALL(a_Name, a_cbParamsX86) \
     184#if defined(RT_ARCH_AMD64) || defined(RT_ARCH_X86)
     185# define SUPHARNT_IMPORT_SYSCALL(a_Name, a_cbParamsX86) \
    180186    SUPHARNT_IMPORT_STDCALL_EARLY(a_Name, a_cbParamsX86) \
    181187    extern uint32_t RT_CONCAT(g_uApiNo, a_Name); \
    182188    extern FNRT     RT_CONCAT(a_Name, _SyscallType1); \
    183189    extern FNRT     RT_CONCAT(a_Name, _SyscallType2);
     190#else
     191# define SUPHARNT_IMPORT_SYSCALL(a_Name, a_cbParamsX86) \
     192    SUPHARNT_IMPORT_STDCALL_EARLY(a_Name, a_cbParamsX86) \
     193    extern uint32_t RT_CONCAT(g_uApiNo, a_Name); \
     194    extern FNRT     RT_CONCAT(a_Name, _Syscall);
     195#endif
    184196#define SUPHARNT_IMPORT_STDCALL(a_Name, a_cbParamsX86) \
    185197    extern PFNRT    RT_CONCAT(g_pfn, a_Name); \
    … …  
    235247# define SUPHARNT_IMPORT_SYSCALL(a_Name, a_cbParamsX86) \
    236248    { &RT_CONCAT(g_uApiNo, a_Name), &RT_CONCAT(a_Name, _SyscallType1), &RT_CONCAT(a_Name, _SyscallType2) },
     249
     250#elif defined(RT_ARCH_ARM64)
     251# define SUPHARNT_IMPORT_STDCALL(a_Name, a_cbParamsX86) \
     252    { NULL, NULL },
     253# define SUPHARNT_IMPORT_SYSCALL(a_Name, a_cbParamsX86) \
     254    { &RT_CONCAT(g_uApiNo, a_Name), &RT_CONCAT(a_Name, _Syscall) },
     255
    237256#elif defined(RT_ARCH_X86)
    238257# define SUPHARNT_IMPORT_STDCALL(a_Name, a_cbParamsX86) \
    … …  
    240259# define SUPHARNT_IMPORT_SYSCALL(a_Name, a_cbParamsX86) \
    241260    { &RT_CONCAT(g_uApiNo, a_Name), &RT_CONCAT(a_Name,_SyscallType1), &RT_CONCAT(a_Name, _SyscallType2), a_cbParamsX86 },
     261
     262#else
     263# error "port me"
    242264#endif
    243265#define SUPHARNT_IMPORT_STDCALL_OPTIONAL(a_Name, a_cbParamsX86)       SUPHARNT_IMPORT_STDCALL(a_Name, a_cbParamsX86)
    … …  
    466488    }
    467489    uintptr_t offSymbol = (uintptr_t)uValue - (uintptr_t)pDll->pbImageBase;
    468     uint8_t const *pbFunction = &pbBits[offSymbol];
     490    uint8_t const * const  pbFunction  = &pbBits[offSymbol];
    469491
    470492    /*
    … …  
    532554        }
    533555    }
    534 #else
     556
     557#elif defined(RT_ARCH_X86)
    535558    /* Pattern #1: XP thru Windows 7
    536559            kd> u ntdll!NtCreateSection
    … …  
    595618        }
    596619    }
     620
     621#elif defined(RT_ARCH_ARM64)
     622    /* Only pattern (W10-1709):
     623        0000000180022950 <ZwCreateSection>:
     624        180022950: d4000941     svc     #0x4a
     625        180022954: d65f03c0     ret
     626        180022958: 00000000     udf     #0x0
     627        18002295c: 00000000     udf     #0x0 */
     628    uint32_t const * const pu32Function = (uint32_t const *)pbFunction;
     629    if (   pu32Function[1] == ARMV8_A64_INSTR_RET
     630        && (pu32Function[0] & ~(UINT32_C(0xffff) << 5)) == UINT32_C(0xd0000001))
     631    {
     632        *pSyscall->puApiNo = (pu32Function[0] >> 5) & UINT32_C(0xffff);
     633        *pImport->ppfnImport = pSyscall->pfnType1;
     634        return;
     635    }
     636
     637#else
     638# error "port me"
    597639#endif
    598640
Note: See TracChangeset for help on using the changeset viewer.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette