Skip to content
GitLab
Explore
Sign in
Primary navigation
Search or go to…
Project
H
hypervisor rootkit
Manage
Activity
Members
Labels
Plan
Issues
Issue boards
Milestones
Wiki
Code
Merge requests
Repository
Branches
Commits
Tags
Repository graph
Compare revisions
Snippets
Build
Pipelines
Jobs
Pipeline schedules
Artifacts
Deploy
Releases
Package registry
Model registry
Operate
Environments
Terraform modules
Monitor
Incidents
Analyze
Value stream analytics
Contributor analytics
CI/CD analytics
Repository analytics
Model experiments
Help
Help
Support
GitLab documentation
Compare GitLab plans
Community forum
Contribute to GitLab
Provide feedback
Keyboard shortcuts
?
Snippets
Groups
Projects
Show more breadcrumbs
flg_bachelors
TS
2024
hypervisor rootkit
Commits
58e0e324
Commit
58e0e324
authored
5 months ago
by
iliya.saroukha
Browse files
Options
Downloads
Patches
Plain Diff
feat: added updated logs (vmxon fail and success)
parent
24835c08
Branches
Branches containing commit
No related tags found
No related merge requests found
Changes
1
Hide whitespace changes
Inline
Side-by-side
Showing
1 changed file
docs/re.md
+58
-0
58 additions, 0 deletions
docs/re.md
with
58 additions
and
0 deletions
docs/re.md
+
58
−
0
View file @
58e0e324
...
...
@@ -329,6 +329,64 @@ static int vmxon_region_alloc(void) {
[
1851.028965] Executing VMXON with address
=
0x18d342800 as its operand
```
```
bash
=================================
FAILING
=================================
[
1312.331549]
[
hypervisor.c:85
in
my_init
()]
: Querying CS
(
lowest 2 bits
)
for
CPL
[
1312.331552]
[
hypervisor.c:91
in
my_init
()]
: CPL level
=
0
[
1312.331553] Checking VMX support using CPUID
[
1312.331554]
[
hypervisor.c:46
in
vmx_support_cpuid
()]
: Vendor ID
=
GenuineIntel
[
1312.331555]
[
hypervisor.c:56
in
vmx_support_cpuid
()]
: Physical address width
=
39
[
1312.331555]
[
hypervisor.c:102
in
my_init
()]
: IA32_VMX_BASIC_MSR
=
0x1da050000000013
[
1312.331556] Initializing VMXON region
[
1312.331557]
[
vmxon_reg.c:26
in
alloc_vmxon_internals
()]
: Reading IA32_VMX_BASIC MSR
for
allocation size
(
in
bytes
)
=
1280
[
1312.331558]
[
vmxon_reg.c:43
in
write_vmcs_rev_id_to_vmxon
()]
: Reading IA32_VMX_BASIC MSR
for
VMCS revision identifier
=
0x13
[
1312.331559]
[
vmxon_reg.c:47
in
write_vmcs_rev_id_to_vmxon
()]
: Writing VMCS Revision ID to VMXON region
[
1312.331559] VA of the allocated region
=
0xffff8e7329e24000
[
1312.331560] PA of the allocated region
=
0x1e9e24000
[
1312.331561] Reading VMXON region
for
VMCS ID: 0x13
[
1312.331561] Patching CR0 and CR4 depending on the value of their respective MSRs
[
1312.331562]
[
msr.c:39
in
patch_control_registers
()]
: Pre-patch: CR0
=
0x80050033
[
1312.331562]
[
msr.c:40
in
patch_control_registers
()]
: Pre-patch: CR4
=
0xf72ef0
[
1312.331563]
[
msr.c:54
in
patch_control_registers
()]
: Post-patch: CR0
=
0x80050033
[
1312.331564]
[
msr.c:55
in
patch_control_registers
()]
: Post-patch: CR4
=
0xf72ef0
[
1312.331565] Enabling VMX
in
CR4
[
1312.331565]
[
hypervisor.c:36
in
cr4_enable_vmx
()]
: CR4[13].VMXE
set
?
true
[
1312.331566] Checking the necessary flags of the IA32_FEATURE_CONTROL_MSR
[
1312.331566]
[
msr.c:8
in
ia32_feature_control_flags
()]
: IA32_FEATURE_CONTROL value
=
5
[
1312.331567] Executing VMXON with address
=
0x1e9e24000 as its operand
[
1312.331567]
[
hypervisor.c:76
in
vmxon
()]
: RFLAGS: 0x203
[
1312.331568]
`
vmxon
`
failed with
return
code 1
=================================
SUCCEEDING
=================================
[
1319.298789]
[
hypervisor.c:85
in
my_init
()]
: Querying CS
(
lowest 2 bits
)
for
CPL
[
1319.298792]
[
hypervisor.c:91
in
my_init
()]
: CPL level
=
0
[
1319.298793] Checking VMX support using CPUID
[
1319.298793]
[
hypervisor.c:46
in
vmx_support_cpuid
()]
: Vendor ID
=
GenuineIntel
[
1319.298794]
[
hypervisor.c:56
in
vmx_support_cpuid
()]
: Physical address width
=
39
[
1319.298795]
[
hypervisor.c:102
in
my_init
()]
: IA32_VMX_BASIC_MSR
=
0x1da050000000013
[
1319.298796] Initializing VMXON region
[
1319.298797]
[
vmxon_reg.c:26
in
alloc_vmxon_internals
()]
: Reading IA32_VMX_BASIC MSR
for
allocation size
(
in
bytes
)
=
1280
[
1319.298798]
[
vmxon_reg.c:43
in
write_vmcs_rev_id_to_vmxon
()]
: Reading IA32_VMX_BASIC MSR
for
VMCS revision identifier
=
0x13
[
1319.298798]
[
vmxon_reg.c:47
in
write_vmcs_rev_id_to_vmxon
()]
: Writing VMCS Revision ID to VMXON region
[
1319.298799] VA of the allocated region
=
0xffff8e733b1d4000
[
1319.298800] PA of the allocated region
=
0x1fb1d4000
[
1319.298800] Reading VMXON region
for
VMCS ID: 0x13
[
1319.298801] Patching CR0 and CR4 depending on the value of their respective MSRs
[
1319.298801]
[
msr.c:39
in
patch_control_registers
()]
: Pre-patch: CR0
=
0x80050033
[
1319.298802]
[
msr.c:40
in
patch_control_registers
()]
: Pre-patch: CR4
=
0xf72ef0
[
1319.298803]
[
msr.c:54
in
patch_control_registers
()]
: Post-patch: CR0
=
0x80050033
[
1319.298803]
[
msr.c:55
in
patch_control_registers
()]
: Post-patch: CR4
=
0xf72ef0
[
1319.298804] Enabling VMX
in
CR4
[
1319.298804]
[
hypervisor.c:36
in
cr4_enable_vmx
()]
: CR4[13].VMXE
set
?
true
[
1319.298805] Checking the necessary flags of the IA32_FEATURE_CONTROL_MSR
[
1319.298805]
[
msr.c:8
in
ia32_feature_control_flags
()]
: IA32_FEATURE_CONTROL value
=
5
[
1319.298806] Executing VMXON with address
=
0x1fb1d4000 as its operand
[
1319.298807]
[
hypervisor.c:76
in
vmxon
()]
: RFLAGS: 0x202
[
1319.298808]
`
vmxon
`
was successfully executed!
```
## References
[
^1
]:
[The
Linux Kernel Module Programming Guide](https://sysprog21.github.io/lkmpg/)
...
...
This diff is collapsed.
Click to expand it.
Preview
0%
Loading
Try again
or
attach a new file
.
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Save comment
Cancel
Please
register
or
sign in
to comment