Implementing process protection with Intel VT

Intel VT is the virtualization technology virtualization Technology of Intel Corporation that completes the virtualization of the computer at the hardware level. To achieve hardware virtualization, VT added 12 new VMX directives. VT allows a CPU to work like multiple CPUs in parallel, making it possible to run multiple operating systems simultaneously on a single computer. In the area of security, the 64-bit system can be protected against 32-bit levels of strength using VT technology.

First, VT debugging method

1. Modify the Vmx file

DebugStub.listen.guest32.remote = "TRUE"

DebugStub.listen.guest64.remote = "TRUE"

Monitor.debugonstartguest64 = "TRUE"

debugstub.hidebreakpoints = "TRUE"

Bios.bootdelay = "3000"

2. Enter the virtual machine, the system stops

3. Start 64-bit Ida

4. Connection port

5. Will be broken at this address

Obvious wrong address, fix address:

F9 continues to run, after entering Windows , pausing again, which will break in kernel space.

6. Load Driver

Record the base address

7. Ida Load Symbol

SYS and PDB need to be placed in the same directory as the real machine

Prompt symbol loading succeeded

Breakpoint can be successfully broken down

second, from the user state to the kernel state

The sysenter/sysexit instruction is provided from the PENTIUM®II processor, and is used for user-level to privileged stack and instruction pointer conversions. And there is a set of special registers to aid the implementation, such special registers in the IA-32 called the MSR (Model specific register).

The MSR is a set of 64-bit registers of CPUs that can be read and written through the RDMSR and WRMSR two instructions respectively, provided that the address of the MSR is written in ECX. For the RDMSR instruction, the 64bit information in the corresponding MSR is returned to the (EDX:EAX) register, and for the WRMSR instruction, the information to be written is deposited (EDX:EAX), and after the write instruction is executed, the corresponding information can be stored in the designated MSR ECX.

Get Kifastcalllentry Address:

_asm

{

movecx,0x176

Rdmsr

Movkifastcalllentryaddr,eax

}

third, using VT to achieve "SSDT hook"

1. Set up MSR bitmap:

Pucharbitmapreadlow = g_data->msrbitmap;

Rtlinitializebitmap (&bitmapreadhighheader, (Pulong) Bitmapreadhigh, 1024 * 8);

Rtlsetbit (&bitmapreadhighheader, msr_lstar-0xc0000000);

__vmx_vmwrite (Msr_bitmap, Mmgetphysicaladdress (G_data->msrbitmap). QuadPart);

2. Setting up VM Entry

__vmx_vmwrite (Host_rip, (ULONG_PTR) vmxvmentry);

2.1 Vmxpexithandler, using __vmx_vmread (Vm_exit_reason, &fielddata), get VM EXIT REASON.

2.2 When Exit_reason_msr_read, the original LStar function address is written to gueststate-> when the value is Msr_lstar, according to the parameter GUESTSTATE->GPREGS->RCX The GPREGS->RAX/RDX.

The final realization of the purpose: PatchGuard, security software, such as __READMSR (Msr_lstar), the return to its original value, used to evade detection.

3. Start the VM

__vmx_vmlaunch

4. Setting the hook function

Send __vmx_vmcall custom Exit event, event handler inside with __WRITEMSR (MSR_LSTAR,GUESTSTATE->GPREGS->RDX), will Kisystemcall_ Emulate writing to the MSR Register

Kisystemcall64_emulate: Determine whether the index is a hook function, if not, go to the original Kisystemcall64 function, if so, go kisystemcall64_emulate- Kisystemservicestart_emulate->kisystemservicerepeat_emulate

5. Initialize Hooktable

Suppresses the end of the Notepad process.

Unable to end Notepad, and Pchunter cannot detect "SSDT" passive hands and feet.

Iv. Reference Documents

1.Linux kerneldebugging with IDA Pro and VMware HTTP://DORGAMZA.TISTORY.COM/1

2.minimalisticvt-x hypervisor with Hooks Https://github.com/DarthTon/HyperBone