Changeset 81118 in vbox for trunk/src/VBox/HostDrivers/Support/win
- Timestamp:
- Oct 6, 2019 1:02:53 AM (5 years ago)
- Location:
- trunk/src/VBox/HostDrivers/Support/win
- Files:
-
- 3 edited
-
SUPHardenedVerifyProcess-win.cpp (modified) (2 diffs)
-
SUPR3HardenedMain-win.cpp (modified) (8 diffs)
-
SUPR3HardenedMainA-win.asm (modified) (2 diffs)
Legend:
- Unmodified
- Added
- Removed
-
trunk/src/VBox/HostDrivers/Support/win/SUPHardenedVerifyProcess-win.cpp
r80216 r81118 875 875 */ 876 876 uint32_t cSkipAreas = 0; 877 SUPHNTVPSKIPAREA aSkipAreas[ 6];877 SUPHNTVPSKIPAREA aSkipAreas[7]; 878 878 if (pImage->fNtCreateSectionPatch) 879 879 { … … 909 909 aSkipAreas[cSkipAreas].uRva = (uint32_t)uValue; 910 910 aSkipAreas[cSkipAreas++].cb = 14; 911 912 #ifndef VBOX_WITHOUT_HARDENDED_XCPT_LOGGING 913 /* Ignore our patched KiUserExceptionDispatcher hack. */ 914 rc = RTLdrGetSymbolEx(pImage->pCacheEntry->hLdrMod, pbBits, 0, UINT32_MAX, "KiUserExceptionDispatcher", &uValue); 915 if (RT_FAILURE(rc)) 916 return supHardNtVpSetInfo2(pThis, rc, "%s: Failed to find 'KiUserExceptionDispatcher': %Rrc", pImage->pszName, rc); 917 aSkipAreas[cSkipAreas].uRva = (uint32_t)uValue + (HC_ARCH_BITS == 64); 918 aSkipAreas[cSkipAreas++].cb = HC_ARCH_BITS == 64 ? 13 : 12; 919 #endif 911 920 912 921 /* LdrSystemDllInitBlock is filled in by the kernel. It mainly contains addresses of 32-bit ntdll method for wow64. */ -
trunk/src/VBox/HostDrivers/Support/win/SUPR3HardenedMain-win.cpp
r80242 r81118 306 306 static uint8_t g_abLdrLoadDllPatch[16]; 307 307 308 #ifndef VBOX_WITHOUT_HARDENDED_XCPT_LOGGING 309 /** Pointer to the bit of assembly code that will perform the original 310 * KiUserExceptionDispatcher operation. */ 311 static VOID (NTAPI *g_pfnKiUserExceptionDispatcherReal)(void); 312 /** Pointer to the KiUserExceptionDispatcher function in NtDll (for patching purposes). */ 313 static uint8_t *g_pbKiUserExceptionDispatcher; 314 /** The patched KiUserExceptionDispatcher bytes (for restoring). */ 315 static uint8_t g_abKiUserExceptionDispatcherPatch[16]; 316 #endif 317 308 318 /** Pointer to the bit of assembly code that will perform the original 309 319 * KiUserApcDispatcher operation. */ 310 320 static VOID (NTAPI *g_pfnKiUserApcDispatcherReal)(void); 311 /** Pointer to the KiUserApcDispatcher function in NtDll (for patching 312 * purposes). */ 321 /** Pointer to the KiUserApcDispatcher function in NtDll (for patching purposes). */ 313 322 static uint8_t *g_pbKiUserApcDispatcher; 314 323 /** The patched KiUserApcDispatcher bytes (for restoring). */ 315 324 static uint8_t g_abKiUserApcDispatcherPatch[16]; 325 316 326 /** Pointer to the LdrInitializeThunk function in NtDll for 317 327 * supR3HardenedMonitor_KiUserApcDispatcher_C() to use for APC vetting. */ … … 408 418 DECLASM(void) supR3HardenedEarlyProcessInitThunk(void); 409 419 DECLASM(void) supR3HardenedMonitor_KiUserApcDispatcher(void); 420 #ifndef VBOX_WITHOUT_HARDENDED_XCPT_LOGGING 421 DECLASM(void) supR3HardenedMonitor_KiUserExceptionDispatcher(void); 422 #endif 410 423 extern "C" void __stdcall suplibHardenedWindowsMain(void); 411 424 … … 2535 2548 2536 2549 2550 /** 2551 * SUP_DPRINTF on pCtx, with lead-in text. 2552 */ 2553 static void supR3HardNtDprintCtx(PCONTEXT pCtx, const char *pszLeadIn) 2554 { 2555 #ifdef RT_ARCH_AMD64 2556 SUP_DPRINTF(("%s\n" 2557 " rax=%016RX64 rbx=%016RX64 rcx=%016RX64 rdx=%016RX64\n" 2558 " rsi=%016RX64 rdi=%016RX64 r8 =%016RX64 r9 =%016RX64\n" 2559 " r10=%016RX64 r11=%016RX64 r12=%016RX64 r13=%016RX64\n" 2560 " r14=%016RX64 r15=%016RX64 P1=%016RX64 P2=%016RX64\n" 2561 " rip=%016RX64 rsp=%016RX64 rbp=%016RX64 ctxflags=%08x\n" 2562 " cs=%04x ss=%04x ds=%04x es=%04x fs=%04x gs=%04x eflags=%08x mxcrx=%08x\n" 2563 " P3=%016RX64 P4=%016RX64 P5=%016RX64 P6=%016RX64\n" 2564 " dr0=%016RX64 dr1=%016RX64 dr2=%016RX64 dr3=%016RX64\n" 2565 " dr6=%016RX64 dr7=%016RX64 vcr=%016RX64 dcr=%016RX64\n" 2566 " lbt=%016RX64 lbf=%016RX64 lxt=%016RX64 lxf=%016RX64\n" 2567 , 2568 pszLeadIn, 2569 pCtx->Rax, pCtx->Rbx, pCtx->Rcx, pCtx->Rdx, 2570 pCtx->Rsi, pCtx->Rdi, pCtx->R8, pCtx->R9, 2571 pCtx->R10, pCtx->R11, pCtx->R12, pCtx->R13, 2572 pCtx->R14, pCtx->R15, pCtx->P1Home, pCtx->P2Home, 2573 pCtx->Rip, pCtx->Rsp, pCtx->Rbp, pCtx->ContextFlags, 2574 pCtx->SegCs, pCtx->SegSs, pCtx->SegDs, pCtx->SegEs, pCtx->SegFs, pCtx->SegGs, pCtx->EFlags, pCtx->MxCsr, 2575 pCtx->P3Home, pCtx->P4Home, pCtx->P5Home, pCtx->P6Home, 2576 pCtx->Dr0, pCtx->Dr1, pCtx->Dr2, pCtx->Dr3, 2577 pCtx->Dr6, pCtx->Dr7, pCtx->VectorControl, pCtx->DebugControl, 2578 pCtx->LastBranchToRip, pCtx->LastBranchFromRip, pCtx->LastExceptionToRip, pCtx->LastExceptionFromRip )); 2579 #elif defined(RT_ARCH_X86) 2580 SUP_DPRINTF(("%s\n" 2581 " eax=%08RX32 ebx=%08RX32 ecx=%08RX32 edx=%08RX32 esi=%08rx64 edi=%08RX32\n" 2582 " eip=%08RX32 esp=%08RX32 ebp=%08RX32 eflags=%08RX32\n" 2583 " cs=%04RX16 ds=%04RX16 es=%04RX16 fs=%04RX16 gs=%04RX16\n" 2584 " dr0=%08RX32 dr1=%08RX32 dr2=%08RX32 dr3=%08RX32 dr6=%08RX32 dr7=%08RX32\n", 2585 pCtx->Eax, pCtx->Ebx, pCtx->Ecx, pCtx->Edx, pCtx->Esi, pCtx->Edi, 2586 pCtx->Eip, pCtx->Esp, pCtx->Ebp, pCtx->EFlags, 2587 pCtx->SegCs, pCtx->SegDs, pCtx->SegEs, pCtx->SegFs, pCtx->SegGs, 2588 pCtx->Dr0, pCtx->Dr1, pCtx->Dr2, pCtx->Dr3, pCtx->Dr6, pCtx->Dr7)); 2589 #else 2590 # error "Unsupported arch." 2591 #endif 2592 2593 } 2594 2595 2596 #ifndef VBOX_WITHOUT_HARDENDED_XCPT_LOGGING 2597 /** 2598 * This is called when ntdll!KiUserExceptionDispatcher is invoked (via 2599 * supR3HardenedMonitor_KiUserExceptionDispatcher). 2600 * 2601 * For 64-bit processes there is a return and two parameters on the stack. 2602 * 2603 * @returns Where to go to run the original code. 2604 * @param pXcptRec The exception record. 2605 * @param pCtx The exception context. 2606 */ 2607 DECLASM(uintptr_t) supR3HardenedMonitor_KiUserExceptionDispatcher_C(PEXCEPTION_RECORD pXcptRec, PCONTEXT pCtx) 2608 { 2609 /* 2610 * Ignore the guard page violation. 2611 */ 2612 if (pXcptRec->ExceptionCode == STATUS_GUARD_PAGE_VIOLATION) 2613 return (uintptr_t)g_pfnKiUserExceptionDispatcherReal; 2614 2615 /* 2616 * Log the exception and context. 2617 */ 2618 char szLeadIn[384]; 2619 if (pXcptRec->NumberParameters == 0) 2620 RTStrPrintf(szLeadIn, sizeof(szLeadIn), "KiUserExceptionDispatcher: %#x @ %p (flags=%#x)", 2621 pXcptRec->ExceptionCode, pXcptRec->ExceptionAddress, pXcptRec->ExceptionFlags); 2622 else if (pXcptRec->NumberParameters == 1) 2623 RTStrPrintf(szLeadIn, sizeof(szLeadIn), "KiUserExceptionDispatcher: %#x (%p) @ %p (flags=%#x)", 2624 pXcptRec->ExceptionCode, pXcptRec->ExceptionInformation[0], 2625 pXcptRec->ExceptionAddress, pXcptRec->ExceptionFlags); 2626 else if (pXcptRec->NumberParameters == 2) 2627 RTStrPrintf(szLeadIn, sizeof(szLeadIn), "KiUserExceptionDispatcher: %#x (%p, %p) @ %p (flags=%#x)", 2628 pXcptRec->ExceptionCode, pXcptRec->ExceptionInformation[0], pXcptRec->ExceptionInformation[1], 2629 pXcptRec->ExceptionAddress, pXcptRec->ExceptionFlags); 2630 else if (pXcptRec->NumberParameters == 3) 2631 RTStrPrintf(szLeadIn, sizeof(szLeadIn), "KiUserExceptionDispatcher: %#x (%p, %p, %p) @ %p (flags=%#x)", 2632 pXcptRec->ExceptionCode, pXcptRec->ExceptionInformation[0], pXcptRec->ExceptionInformation[1], 2633 pXcptRec->ExceptionInformation[2], pXcptRec->ExceptionAddress, pXcptRec->ExceptionFlags); 2634 else 2635 RTStrPrintf(szLeadIn, sizeof(szLeadIn), "KiUserExceptionDispatcher: %#x (#%u: %p, %p, %p, %p, %p, %p, %p, %p, ...) @ %p (flags=%#x)", 2636 pXcptRec->ExceptionCode, pXcptRec->NumberParameters, 2637 pXcptRec->ExceptionInformation[0], pXcptRec->ExceptionInformation[1], 2638 pXcptRec->ExceptionInformation[2], pXcptRec->ExceptionInformation[3], 2639 pXcptRec->ExceptionInformation[4], pXcptRec->ExceptionInformation[5], 2640 pXcptRec->ExceptionInformation[6], pXcptRec->ExceptionInformation[7], 2641 pXcptRec->ExceptionAddress, pXcptRec->ExceptionFlags); 2642 supR3HardNtDprintCtx(pCtx, szLeadIn); 2643 2644 return (uintptr_t)g_pfnKiUserExceptionDispatcherReal; 2645 } 2646 #endif /* !VBOX_WITHOUT_HARDENDED_XCPT_LOGGING */ 2647 2648 2537 2649 static void supR3HardenedWinHookFailed(const char *pszWhich, uint8_t const *pbPrologue) 2538 2650 { … … 2696 2808 } const s_aPatches[] = 2697 2809 { 2698 { sizeof(g_abNtCreateSectionPatch), g_abNtCreateSectionPatch, &g_pbNtCreateSection, "NtCreateSection" }, 2699 { sizeof(g_abLdrLoadDllPatch), g_abLdrLoadDllPatch, &g_pbLdrLoadDll, "LdrLoadDll" }, 2700 { sizeof(g_abKiUserApcDispatcherPatch), g_abKiUserApcDispatcherPatch, &g_pbKiUserApcDispatcher, "KiUserApcDispatcher" }, 2810 { sizeof(g_abNtCreateSectionPatch), g_abNtCreateSectionPatch, &g_pbNtCreateSection, "NtCreateSection" }, 2811 { sizeof(g_abLdrLoadDllPatch), g_abLdrLoadDllPatch, &g_pbLdrLoadDll, "LdrLoadDll" }, 2812 { sizeof(g_abKiUserApcDispatcherPatch), g_abKiUserApcDispatcherPatch, &g_pbKiUserApcDispatcher, "KiUserApcDispatcher" }, 2813 #ifndef VBOX_WITHOUT_HARDENDED_XCPT_LOGGING 2814 { sizeof(g_abKiUserExceptionDispatcherPatch), g_abKiUserExceptionDispatcherPatch, &g_pbKiUserExceptionDispatcher, "KiUserExceptionDispatcher" }, 2815 #endif 2701 2816 }; 2702 2817 … … 2812 2927 SUPR3HARDENED_ASSERT(g_pfnLdrInitializeThunk != NULL); 2813 2928 2929 #ifndef VBOX_WITHOUT_HARDENDED_XCPT_LOGGING 2930 PFNRT pfnKiUserExceptionDispatcher = supR3HardenedWinGetRealDllSymbol("ntdll.dll", "KiUserExceptionDispatcher"); 2931 SUPR3HARDENED_ASSERT(pfnKiUserExceptionDispatcher != NULL); 2932 #endif 2933 2814 2934 /* 2815 2935 * Exec page setup & management. … … 3056 3176 *(uint32_t *)&g_abKiUserApcDispatcherPatch[1] = (uintptr_t)supR3HardenedMonitor_KiUserApcDispatcher - (uintptr_t)&pbKiUserApcDispatcher[1+4]; 3057 3177 #endif 3178 3179 #ifndef VBOX_WITHOUT_HARDENDED_XCPT_LOGGING 3180 /* 3181 * Hook #4 - KiUserExceptionDispatcher 3182 * Purpose: Logging crashes. 3183 * 3184 * This differs from the first function in that is no a system call and 3185 * we're at the mercy of the handwritten assembly. This is not mandatory, 3186 * so we ignore failures here. 3187 */ 3188 uint8_t * const pbKiUserExceptionDispatcher = (uint8_t *)(uintptr_t)pfnKiUserExceptionDispatcher; 3189 g_pbKiUserExceptionDispatcher = pbKiUserExceptionDispatcher; 3190 memcpy(g_abKiUserExceptionDispatcherPatch, pbKiUserExceptionDispatcher, sizeof(g_abKiUserExceptionDispatcherPatch)); 3191 3192 # ifdef RT_ARCH_AMD64 3193 /* 3194 * Patch 64-bit hosts. 3195 * 3196 * Assume the following sequence and replacing the loaded Wow64PrepareForException 3197 * function pointer with our callback: 3198 * cld 3199 * mov rax, Wow64PrepareForException ; Wow64PrepareForException(PCONTEXT, PEXCEPTION_RECORD) 3200 * test rax, rax 3201 * jz skip_wow64_callout 3202 * <do_callout_thru_rax> 3203 * (We're not a WOW64 process, so the callout should normally never happen.) 3204 */ 3205 if ( pbKiUserExceptionDispatcher[ 0] == 0xfc /* CLD */ 3206 && pbKiUserExceptionDispatcher[ 1] == 0x48 /* MOV RAX, symbol wrt rip */ 3207 && pbKiUserExceptionDispatcher[ 2] == 0x8b 3208 && pbKiUserExceptionDispatcher[ 3] == 0x05 3209 && pbKiUserExceptionDispatcher[ 8] == 0x48 /* TEST RAX, RAX */ 3210 && pbKiUserExceptionDispatcher[ 9] == 0x85 3211 && pbKiUserExceptionDispatcher[10] == 0xc0 3212 && pbKiUserExceptionDispatcher[11] == 0x74) 3213 { 3214 /* Assemble the KiUserExceptionDispatcher patch. */ 3215 g_abKiUserExceptionDispatcherPatch[1] = 0x48; /* MOV RAX, supR3HardenedMonitor_KiUserExceptionDispatcher */ 3216 g_abKiUserExceptionDispatcherPatch[2] = 0xb8; 3217 *(uint64_t *)&g_abKiUserExceptionDispatcherPatch[3] = (uint64_t)supR3HardenedMonitor_KiUserExceptionDispatcher; 3218 g_abKiUserExceptionDispatcherPatch[11] = 0x90; /* NOP (was JZ) */ 3219 g_abKiUserExceptionDispatcherPatch[12] = 0x90; /* NOP (was DISP8 of JZ) */ 3220 } 3221 else 3222 SUP_DPRINTF(("supR3HardenedWinInstallHooks: failed to patch KiUserExceptionDispatcher (%.20Rhxs)\n", 3223 pbKiUserExceptionDispatcher)); 3224 # else 3225 /* 3226 * Patch 32-bit hosts. 3227 */ 3228 /* Just use the disassembler to skip 5 bytes or more. */ 3229 offJmpBack = 0; 3230 while (offJmpBack < 5) 3231 { 3232 cbInstr = 1; 3233 int rc = DISInstr(pbKiUserExceptionDispatcher + offJmpBack, DISCPUMODE_32BIT, &Dis, &cbInstr); 3234 if ( RT_FAILURE(rc) 3235 || (Dis.pCurInstr->fOpType & (DISOPTYPE_CONTROLFLOW)) ) 3236 { 3237 SUP_DPRINTF(("supR3HardenedWinInstallHooks: failed to patch KiUserExceptionDispatcher (off %#x in %.20Rhxs)\n", 3238 offJmpBack, pbKiUserExceptionDispatcher)); 3239 break; 3240 } 3241 offJmpBack += cbInstr; 3242 } 3243 if (offJmpBack >= 5) 3244 { 3245 /* Assemble the code for resuming the call.*/ 3246 *(PFNRT *)&g_pfnKiUserExceptionDispatcherReal = (PFNRT)(uintptr_t)&g_abSupHardReadWriteExecPage[offExecPage]; 3247 3248 memcpy(&g_abSupHardReadWriteExecPage[offExecPage], pbKiUserExceptionDispatcher, offJmpBack); 3249 offExecPage += offJmpBack; 3250 3251 g_abSupHardReadWriteExecPage[offExecPage++] = 0xe9; /* jmp rel32 */ 3252 *(uint32_t *)&g_abSupHardReadWriteExecPage[offExecPage] = (uintptr_t)&pbKiUserExceptionDispatcher[offJmpBack] 3253 - (uintptr_t)&g_abSupHardReadWriteExecPage[offExecPage + 4]; 3254 offExecPage = RT_ALIGN_32(offExecPage + 4, 16); 3255 3256 /* Assemble the KiUserExceptionDispatcher patch. */ 3257 memcpy(g_abKiUserExceptionDispatcherPatch, pbKiUserExceptionDispatcher, sizeof(g_abKiUserExceptionDispatcherPatch)); 3258 Assert(offJmpBack >= 5); 3259 g_abKiUserExceptionDispatcherPatch[0] = 0xe9; 3260 *(uint32_t *)&g_abKiUserExceptionDispatcherPatch[1] = (uintptr_t)supR3HardenedMonitor_KiUserExceptionDispatcher - (uintptr_t)&pbKiUserExceptionDispatcher[1+4]; 3261 } 3262 # endif 3263 #endif /* !VBOX_WITHOUT_HARDENDED_XCPT_LOGGING */ 3058 3264 3059 3265 /* … … 4007 4213 4008 4214 4009 4010 4215 /** 4011 4216 * Sets up the early process init. … … 4119 4324 { 4120 4325 #ifdef RT_ARCH_AMD64 4121 SUP_DPRINTF(("supR3HardenedWinSetupChildInit: Initial context:\n"4122 " RAX=%016RX64 RBX=%016RX64 RCX=%016RX64 RDX=%016RX64\n"4123 " RSI=%016RX64 RDI=%016RX64 R8=%016RX64 R9=%016RX64\n"4124 " R10=%016RX64 R11=%016RX64 R12=%016RX64 R13=%016RX64\n"4125 " R14=%016RX64 R15=%016RX64\n"4126 " RIP=%016RX64 RSP=%016RX64 RBP=%016RX64 RFLAGS=%08RX32\n"4127 " P1=%016RX64 P2=%016RX64 P3=%016RX64 P4=%016RX64\n"4128 " P5=%016RX64 P6=%016RX64\n"4129 " CS=%04RX16 DS=%04RX16 ES=%04RX16 FS=%04RX16 GS=%04RX16 SS=%04RX16\n"4130 " DR0=%016RX64 DR1=%016RX64 DR2=%016RX64 DR3=%016RX64\n"4131 " DR6=%016RX64 DR7=%016RX64\n",4132 Ctx.Rax, Ctx.Rbx, Ctx.Rcx, Ctx.Rdx,4133 Ctx.Rsi, Ctx.Rdi, Ctx.R8, Ctx.R9,4134 Ctx.R10, Ctx.R11, Ctx.R12, Ctx.R13,4135 Ctx.R14, Ctx.R15,4136 Ctx.Rip, Ctx.Rsp, Ctx.Rbp, Ctx.EFlags,4137 Ctx.P1Home, Ctx.P2Home, Ctx.P3Home,4138 Ctx.P4Home, Ctx.P5Home, Ctx.P6Home,4139 Ctx.SegCs, Ctx.SegDs, Ctx.SegEs, Ctx.SegFs, Ctx.SegGs, Ctx.SegSs,4140 Ctx.Dr0, Ctx.Dr1, Ctx.Dr2, Ctx.Dr3,4141 Ctx.Dr6, Ctx.Dr7));4142 4326 DWORD64 *pPC = &Ctx.Rip; 4143 4327 #elif defined(RT_ARCH_X86) 4144 SUP_DPRINTF(("supR3HardenedWinSetupChildInit: Initial context:\n"4145 " EAX=%08RX32 EBX=%08RX32 ECX=%08RX32 EDX=%08RX32 ESI=%08RX64 EDI=%08RX32\n"4146 " EIP=%08RX32 ESP=%08RX32 EBP=%08RX32 EFLAGS=%08RX32\n"4147 " CS=%04RX16 DS=%04RX16 ES=%04RX16 FS=%04RX16 GS=%04RX16\n"4148 " DR0=%08RX32 DR1=%08RX32 DR2=%08RX32 DR3=%08RX32 DR6=%08RX32 DR7=%08RX32\n",4149 Ctx.Eax, Ctx.Ebx, Ctx.Ecx, Ctx.Edx, Ctx.Esi, Ctx.Edi,4150 Ctx.Eip, Ctx.Esp, Ctx.Ebp, Ctx.EFlags,4151 Ctx.SegCs, Ctx.SegDs, Ctx.SegEs, Ctx.SegFs, Ctx.SegGs,4152 Ctx.Dr0, Ctx.Dr1, Ctx.Dr2, Ctx.Dr3, Ctx.Dr6, Ctx.Dr7));4153 4328 DWORD *pPC = &Ctx.Eip; 4154 4329 #else 4155 4330 # error "Unsupported arch." 4156 4331 #endif 4332 supR3HardNtDprintCtx(&Ctx, "supR3HardenedWinSetupChildInit: Initial context:"); 4333 4157 4334 /* Entrypoint for the executable: */ 4158 4335 uintptr_t const uChildMain = uChildExeAddr + ( (uintptr_t)&suplibHardenedWindowsMain -
trunk/src/VBox/HostDrivers/Support/win/SUPR3HardenedMainA-win.asm
r80212 r81118 35 35 extern NAME(supR3HardenedEarlyProcessInit) 36 36 extern NAME(supR3HardenedMonitor_KiUserApcDispatcher_C) 37 %ifndef VBOX_WITHOUT_HARDENDED_XCPT_LOGGING 38 extern NAME(supR3HardenedMonitor_KiUserExceptionDispatcher_C) 39 %endif 37 40 38 41 … … 184 187 ENDPROC supR3HardenedMonitor_KiUserApcDispatcher 185 188 189 190 %ifndef VBOX_WITHOUT_HARDENDED_XCPT_LOGGING 191 ;; 192 ; Hook for KiUserExceptionDispatcher that logs exceptions. 193 ; 194 ; For the AMD64 variant, we're not directly intercepting the function itself, but 195 ; patching into a Wow64 callout that's done at the very start of the routine. RCX 196 ; and RDX are set to PEXCEPTION_RECORD and PCONTEXT respectively and there is a 197 ; return address. Also, we don't need to do any return-via-copied-out-code stuff. 198 ; 199 ; For X86 we hook the function and have PEXCEPTION_RECORD and PCONTEXT pointers on 200 ; the stack, but no return address. 201 202 ; We just call C code here, just like supR3HardenedEarlyProcessInitThunk and 203 ; supR3HardenedMonitor_KiUserApcDispatcher does. 204 ; 205 ; @sa supR3HardenedMonitor_KiUserExceptionDispatcher_C 206 ; 207 BEGINPROC supR3HardenedMonitor_KiUserExceptionDispatcher 208 ; 209 ; Prologue. 210 ; 211 212 %ifndef RT_ARCH_AMD64 213 ; Reserve space for the "return" address. 214 push 0 215 %endif 216 217 ; Create a stack frame, saving xBP. 218 push xBP 219 SEH64_PUSH_xBP 220 mov xBP, xSP 221 SEH64_SET_FRAME_xBP 0 ; probably wrong... 222 223 ; Save all volatile registers. 224 push xAX 225 push xCX 226 push xDX 227 %ifdef RT_ARCH_AMD64 228 push r8 229 push r9 230 push r10 231 push r11 232 %endif 233 234 ; Reserve spill space and align the stack. 235 sub xSP, 20h 236 and xSP, ~0fh 237 SEH64_END_PROLOGUE 238 239 ; 240 ; Call the C/C++ code that does the actual work. For x86 this returns 241 ; the resume address in xAX, which we put in the "return" stack position. 242 ; 243 ; On both AMD64 and X86 we have two parameters on the stack that we 244 ; passes along to the C code (see function description for details). 245 ; 246 %ifdef RT_ARCH_X86 247 mov xCX, [xBP + xCB*2] 248 mov xDX, [xBP + xCB*3] 249 mov [xSP], xCX 250 mov [xSP+4], xDX 251 %endif 252 call NAME(supR3HardenedMonitor_KiUserExceptionDispatcher_C) 253 %ifdef RT_ARCH_X86 254 mov [xBP + xCB], xAX 255 %endif 256 257 ; 258 ; Restore volatile registers. 259 ; 260 mov xAX, [xBP - xCB*1] 261 mov xCX, [xBP - xCB*2] 262 mov xDX, [xBP - xCB*3] 263 %ifdef RT_ARCH_AMD64 264 mov r8, [xBP - xCB*4] 265 mov r9, [xBP - xCB*5] 266 mov r10, [xBP - xCB*6] 267 mov r11, [xBP - xCB*7] 268 %endif 269 ; 270 ; Use the leave instruction to restore xBP and set up xSP to point at 271 ; the resume address. Then use the 'ret' instruction to execute the 272 ; original KiUserExceptionDispatcher code as if we've never been here... 273 ; 274 leave 275 ret 276 ENDPROC supR3HardenedMonitor_KiUserExceptionDispatcher 277 %endif ; !VBOX_WITHOUT_HARDENDED_XCPT_LOGGING 186 278 187 279 ;;
Note:
See TracChangeset
for help on using the changeset viewer.
