memtables.c

Go to the documentation of this file.

/*
 * Copyright (c) 2020 Bitdefender
 * SPDX-License-Identifier: Apache-2.0
 */
#include "memtables.h"
#include "guests.h"
#include "icache.h"
#include "memcloak.h"
#include "ptfilter.h"
#include "slack.h"

static LIST_HEAD gMemTables = LIST_HEAD_INIT(gMemTables); 




static INTSTATUS
IntMtblRemoveEntry(
    _In_ PMEM_TABLE_RELOC Reloc
    )
{
    if (NULL != Reloc->InsCloak)
    {
        IntMemClkUncloakRegion(Reloc->InsCloak, MEMCLOAK_OPT_APPLY_PATCH);

        Reloc->InsCloak = NULL;

        // Flush the cache.
        IntIcFlushAddress(gGuest.InstructionCache, Reloc->Rip, IC_ANY_VAS);
    }

    if (NULL != Reloc->SlackCloak)
    {
        IntMemClkUncloakRegion(Reloc->SlackCloak, MEMCLOAK_OPT_APPLY_PATCH);

        Reloc->SlackCloak = NULL;
    }

    Reloc->Patched = FALSE;

    return INT_STATUS_SUCCESS;
}


static INTSTATUS
IntMtblPatchInstruction(
    _Inout_ PMEM_TABLE_RELOC Reloc,
    _In_ PINSTRUX Instrux,
    _In_ PIG_ARCH_REGS Regs
    )
//
{
    INTSTATUS status;
    QWORD slackAddr;
    DWORD tableSize, slackSize, regDst, regIdx, table[MAX_MEM_TABLE_SIZE + 1], cb, rel;
    BYTE code[MAX_MEM_TABLE_SLACK_SIZE], jins[ND_MAX_INSTRUCTION_LENGTH], origins[ND_MAX_INSTRUCTION_LENGTH];
    BOOLEAN inAgent = FALSE;

    // Safe: note that table is DWORD[MAX_MEM_TABLE_SIZE + 1].
    status = IntKernVirtMemRead(Reloc->TableGva, (MAX_MEM_TABLE_SIZE + 1) * 4, table, NULL);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntKernVirtMemRead failed: 0x%08x\n", status);
        return status;
    }

    // Extract the table size. Each entry must be a dword RVA inside the NT image. We support max 16 entries per table.
    for (tableSize = 0; tableSize < MAX_MEM_TABLE_SIZE + 1; tableSize++)
    {
        if (table[tableSize] >= gGuest.KernelSize)
        {
            break;
        }
    }

    // Can't reliably get the size, bail out.
    if (tableSize > MAX_MEM_TABLE_SIZE)
    {
        WARNING("[WARNING] Table size at %llx is %d, bailing out.\n", Reloc->TableGva, tableSize);
        return INT_STATUS_NOT_SUPPORTED;
    }

    regDst = Instrux->Operands[0].Info.Register.Reg;
    regIdx = Instrux->Operands[1].Info.Memory.Index;

    slackSize = MEM_TABLE_HEADER_SIZE + MEM_TABLE_ENTRY_SIZE * tableSize;

    slackAddr = IntPtiAllocMemtableSpace(Regs->Rip + Instrux->Length, slackSize);
    if (0 != slackAddr)
    {
        TRACE("[MEMTABLE] We could allocated space in PT filter agent!\n");
        inAgent = TRUE;
    }
    else
    {
        status = IntSlackAlloc(gGuest.KernelVa, FALSE, slackSize, &slackAddr, 0);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntSlackAlloc failed: 0x%08x\n", status);
            return status;
        }
    }

    Reloc->InAgent = inAgent;
    Reloc->SlackAddress = slackAddr;
    Reloc->SlackSize = slackSize;

    cb = 0;

    // Store the "PUSHFQ" instruction.
    code[cb++] = 0x9C;

    // Store the "PUSH dst" instruction.
    code[cb++] = 0x48 | (regDst >= 8 ? 0x1 : 0x0);
    code[cb++] = 0x50 | (regDst & 7);

    // Store the "PUSH idx" instruction.
    code[cb++] = 0x48 | (regIdx >= 8 ? 0x1 : 0x0);
    code[cb++] = 0x50 | (regIdx & 7);

    // Overwrite the saved dst with the slack target address.

    // Store the "MOV [rsp + 8], addr low" instruction
    code[cb++] = 0xC7;
    code[cb++] = 0x44;
    code[cb++] = 0x24;
    code[cb++] = 0x08;
    code[cb++] = ((slackAddr + MEM_TABLE_HEADER_SIZE) >> 0) & 0xFF;
    code[cb++] = ((slackAddr + MEM_TABLE_HEADER_SIZE) >> 8) & 0xFF;
    code[cb++] = ((slackAddr + MEM_TABLE_HEADER_SIZE) >> 16) & 0xFF;
    code[cb++] = ((slackAddr + MEM_TABLE_HEADER_SIZE) >> 24) & 0xFF;

    // Store the "MOV [rsp + C], addr high" instruction
    code[cb++] = 0xC7;
    code[cb++] = 0x44;
    code[cb++] = 0x24;
    code[cb++] = 0x0C;
    code[cb++] = ((slackAddr + MEM_TABLE_HEADER_SIZE) >> 32) & 0xFF;
    code[cb++] = ((slackAddr + MEM_TABLE_HEADER_SIZE) >> 40) & 0xFF;
    code[cb++] = ((slackAddr + MEM_TABLE_HEADER_SIZE) >> 48) & 0xFF;
    code[cb++] = ((slackAddr + MEM_TABLE_HEADER_SIZE) >> 56) & 0xFF;

    // Store the "IMUL idx, idx, 11" instruction.
    code[cb++] = 0x48 | (regIdx >= 8 ? 0x5 : 0x0);
    code[cb++] = 0x6B;
    code[cb++] = 0xC0 | (((regIdx & 7) << 3) | (regIdx & 7));
    code[cb++] = MEM_TABLE_ENTRY_SIZE;

    // Store the "ADD [rsp + 8], idx" instruction.
    code[cb++] = 0x48 | (regIdx >= 8 ? 0x4 : 0x0);
    code[cb++] = 0x01;
    code[cb++] = 0x44 | ((regIdx & 7) << 3);
    code[cb++] = 0x24;
    code[cb++] = 0x08;

    // Store the "POP idx" instruction.
    code[cb++] = 0x48 | (regIdx >= 8 ? 0x1 : 0x0);
    code[cb++] = 0x58 | (regIdx & 7);

    // Store the "POP dst" instruction.
    code[cb++] = 0x48 | (regDst >= 8 ? 0x1 : 0x0);
    code[cb++] = 0x58 | (regDst & 7);

    // Store the "MOV [rsp - 8], 0" instruction, which will remove the pointer which may still point inside of us.
    code[cb++] = 0x48;
    code[cb++] = 0xc7;
    code[cb++] = 0x44;
    code[cb++] = 0x24;
    code[cb++] = 0xF8;
    code[cb++] = 0x00;
    code[cb++] = 0x00;
    code[cb++] = 0x00;
    code[cb++] = 0x00;

    // Store the "POPFQ" instruction.
    code[cb++] = 0x9D;

    // Store the "JMP regDst" instruction.
    code[cb++] = 0x40 | ((regDst >= 8) ? 0x1 : 0x0);                // REX prefix.
    code[cb++] = 0xFF;                                              // Opcode.
    code[cb++] = 0xE0 | (regDst & 0x7);                             // Mod R/M, mod 3, reg 4, rm regDst.

    // Store the "MOV regDst, imm/JMP back" stubs.
    for (QWORD i = 0; i < tableSize; i++)
    {
        // Store the "MOV regDst, imm" instruction.
        code[cb++] = 0x40 | ((regDst >= 8) ? 0x1 : 0x0);
        code[cb++] = 0xB8 + (regDst % 8);
        code[cb++] = (table[i] >>  0) & 0xFF;
        code[cb++] = (table[i] >>  8) & 0xFF;
        code[cb++] = (table[i] >> 16) & 0xFF;
        code[cb++] = (table[i] >> 24) & 0xFF;

        if (inAgent)
        {
            // Store the "IRETQ"
            code[cb++] = 0x48;
            code[cb++] = 0xCF;
            // For padding, to make it as long as a "JMP near"
            code[cb++] = 0x90;
            code[cb++] = 0x90;
            code[cb++] = 0x90;
        }
        else
        {
            // Store the "JMP original_code" instruction.
            code[cb++] = 0xE9;
            rel = (DWORD)((gVcpu->Regs.Rip + Instrux->Length) -
                          (slackAddr + MEM_TABLE_HEADER_SIZE + MEM_TABLE_ENTRY_SIZE * (i + 1)));
            code[cb++] = (rel >> 0) & 0xFF;
            code[cb++] = (rel >> 8) & 0xFF;
            code[cb++] = (rel >> 16) & 0xFF;
            code[cb++] = (rel >> 24) & 0xFF;
        }
    }

    if (inAgent)
    {
        // We are using the PT filter agent, we can just INT 20 into it.
        memset(jins, 0x66, sizeof(jins));
        jins[Instrux->Length - 2] = 0xCD;
        jins[Instrux->Length - 1] = 0x14;
    }
    else
    {
        // Patch the instruction with a JMP.
        memset(jins, 0x90, sizeof(jins));
        jins[0] = 0xE9;
        *((DWORD *)&jins[1]) = (DWORD)(slackAddr - (Regs->Rip + 5));
    }

    // Save the old instruction.
    memcpy(origins, Instrux->InstructionBytes, Instrux->Length);

    // Now do the actual patching.
    IntPauseVcpus();

    status = IntMemClkCloakRegion(Regs->Rip, 0, Instrux->Length, MEMCLOAK_OPT_APPLY_PATCH,
                                  origins, jins, NULL, &Reloc->InsCloak);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntMemClkCloakRegion failed: 0x%08x\n", status);
        goto _resume_and_exit;
    }

    if (!inAgent)
    {
        status = IntMemClkCloakRegion(slackAddr, 0, slackSize, MEMCLOAK_OPT_APPLY_PATCH,
                                      NULL, code, NULL, &Reloc->SlackCloak);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntMemClkCloakRegion failed: 0x%08x\n", status);
            goto _resume_and_exit;
        }
    }
    else
    {
        // No need to use IntVirtMemSafeWrite, as this is a pointer "allocated" by Introcore. Plus, it's EPT protected.
        status = IntKernVirtMemWrite(slackAddr, slackSize, code);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntKernVirtMemWrite failed: 0x%08x\n", status);
            goto _resume_and_exit;
        }
    }

    // Flush the RIP address. This is needed because a read violation may be generated for the same RIP
    // for more than one VCPU. The first exit that is handled will also patch the instruction and if the cache
    // is not flushed, the other VCPUs will patch it again (because instead of decoding a jump, they will decode
    // a mov from memory
    status = IntIcFlushAddress(gGuest.InstructionCache, gVcpu->Regs.Rip, IC_ANY_VAS);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntIcFlushAddress failed: 0x%08x\n", status);
        goto _resume_and_exit;
    }

    Reloc->Patched = TRUE;

    // Indicate that we've patched the instruction.
    status = INT_STATUS_INSTRUCTION_PATCHED;

_resume_and_exit:
    if (!INT_SUCCESS(status))
    {
        IntMtblRemoveEntry(Reloc);
    }

    IntResumeVcpus();

    return status;
}


INTSTATUS
IntMtblCheckAccess(
    void
    )
{
    INTSTATUS status;
    QWORD gva;
    QWORD tableStart;
    BYTE base;
    QWORD disp;
    PIG_ARCH_REGS pRegs;
    PINSTRUX instr;
    LIST_ENTRY *list;
    BOOLEAN foundTable;
    PMEM_TABLE_RELOC pTable;

    if (gGuest.OSType != introGuestWindows)
    {
        return INT_STATUS_NOT_NEEDED_HINT;
    }

    if (!gGuest.Guest64)
    {
        return INT_STATUS_NOT_NEEDED_HINT;
    }

    if (gVcpu->State != CPU_STATE_EPT_VIOLATION)
    {
        return INT_STATUS_NOT_NEEDED_HINT;
    }

    pRegs = &gVcpu->Regs;
    gva = gVcpu->Gla;
    instr = &gVcpu->Instruction;
    base = 0;
    disp = 0;
    foundTable = FALSE;
    status = INT_STATUS_SUCCESS;

    if (instr->Instruction != ND_INS_MOV)
    {
        return INT_STATUS_NOT_NEEDED_HINT;
    }

    // Make sure we can reloc this instruction + table.
    if ((instr->OperandsCount != 2) || (instr->Operands[0].Type != ND_OP_REG) ||
        (instr->Operands[1].Type != ND_OP_MEM) || !instr->HasSib ||
        !instr->Operands[1].Info.Memory.HasIndex || (instr->MemoryAccess != ND_ACCESS_READ) ||
        (instr->Operands[0].Size != 4) || (instr->Operands[1].Size != 4) ||
        (instr->Length < 5))
    {
        return INT_STATUS_NOT_NEEDED_HINT;
    }

    // Ignore anything outside the NT image.
    if ((gva < gGuest.KernelVa) || (gva >= gGuest.KernelVa + gGuest.KernelSize) ||
        (pRegs->Rip < gGuest.KernelVa) || (pRegs->Rip >= gGuest.KernelVa + gGuest.KernelSize))
    {
        return INT_STATUS_NOT_NEEDED_HINT;
    }

    if (gWinGuest->Ssdt && gWinGuest->NumberOfServices)
    {
        if ((gva >= gWinGuest->Ssdt) &&
            (gva < gWinGuest->Ssdt + ((QWORD)gWinGuest->NumberOfServices * gGuest.WordSize)))
        {
            return INT_STATUS_NOT_NEEDED_HINT;
        }
    }

    if (instr->Operands[1].Info.Memory.HasBase)
    {
        base = instr->Operands[1].Info.Memory.Base;
    }

    if (instr->Operands[1].Info.Memory.HasDisp)
    {
        disp = instr->Operands[1].Info.Memory.Disp;
    }

    tableStart = *((QWORD *)pRegs + base) + disp;
    if (tableStart == 0)
    {
        return INT_STATUS_NOT_NEEDED_HINT;
    }

    list = gMemTables.Flink;
    while (list != &gMemTables)
    {
        pTable = CONTAINING_RECORD(list, MEM_TABLE_RELOC, Link);
        list = list->Flink;

        if (pTable->TableGva != tableStart)
        {
            continue;
        }

        foundTable = TRUE;

        ++pTable->Hits;

        if (pTable->Ignored || pTable->Patched)
        {
            continue;
        }

        if (pTable->Hits % 10000 == 0)
        {
            TRACE("[MEMTABLE] Table at %llx accessed for %lld time, from RIP %llx\n",
                  pTable->TableGva, pTable->Hits, pRegs->Rip);
        }

        if (pTable->Hits >= 100000 && !pTable->Dumped)
        {
            ERROR("[ERROR] Table at %llx accessed too many times (%lld), from RIP %llx, event %lld\n",
                  pTable->TableGva, pTable->Hits, pRegs->Rip, gEventId);

            IntDisasmGva(pRegs->Rip, ND_MAX_INSTRUCTION_LENGTH);
            IntDumpGvaEx(pTable->TableGva, MAX_MEM_TABLE_SIZE, 0, 16, 4, TRUE, FALSE);

            pTable->Dumped = TRUE;
        }

        if (pTable->Hits >= 50 && (!gGuest.BootstrapAgentAllocated || IntPtiGetAgentAddress()))
        {
            // Try to patch this instruction. Note that we won't relocate the instruction and table if the bootstrap
            // agent is active, because we would generate slack holes when we would free the it.
            status = IntMtblPatchInstruction(pTable, instr, pRegs);
            if (!INT_SUCCESS(status))
            {
                WARNING("[WARNING] IntMemTablesPatchInstruction failed: 0x%08x\n", status);

                pTable->Ignored = TRUE;
            }
            else
            {
                CHAR text[ND_MIN_BUF_SIZE];

                NdToText(instr, pRegs->Rip, sizeof(text), text);

                LOG("[MEMTABLE] [%d] Successfully patched instruction %llx:%s, will return 0x%x\n",
                    gVcpu->Index, pRegs->Rip, text, status);
            }
        }

        break;
    }

    if (foundTable)
    {
        return status;
    }

    pTable = HpAllocWithTag(sizeof(*pTable), IC_TAG_MTBL);
    if (NULL == pTable)
    {
        return INT_STATUS_INSUFFICIENT_RESOURCES;
    }

    pTable->Rip = pRegs->Rip;
    pTable->Hits = 1;
    pTable->TableGva = tableStart;

    InsertTailList(&gMemTables, &pTable->Link);

    return status;
}


BOOLEAN
IntMtblIsPtrInReloc(
    _In_ QWORD Ptr,
    _In_ THS_PTR_TYPE Type,
    _Out_opt_ QWORD *Table
    )
{
    LIST_ENTRY *list;

    list = gMemTables.Flink;
    while (list != &gMemTables)
    {
        PMEM_TABLE_RELOC pTable = CONTAINING_RECORD(list, MEM_TABLE_RELOC, Link);
        list = list->Flink;

        if ((Ptr >= pTable->SlackAddress) && (Ptr < pTable->SlackAddress + pTable->SlackSize))
        {
            WARNING("[WARNING] Found %s ptr 0x%016llx in memtable relocs: slack addr 0x%016llx, "
                    "instruction addr 0x%016llx\n",
                    Type == ptrLiveRip ? "live RIP" : "stack value", Ptr, pTable->SlackAddress, pTable->Rip);

            if (NULL != Table)
            {
                *Table = pTable->TableGva;
            }

            return TRUE;
        }
    }

    if (NULL != Table)
    {
        *Table = 0;
    }

    return FALSE;
}


void
IntMtblDisable(
    void
    )
{
    LIST_ENTRY *list;

    list = gMemTables.Flink;
    while (list != &gMemTables)
    {
        PMEM_TABLE_RELOC pTable = CONTAINING_RECORD(list, MEM_TABLE_RELOC, Link);
        list = list->Flink;

        if (pTable->InsCloak)
        {
            IntMemClkUncloakRegion(pTable->InsCloak, MEMCLOAK_OPT_APPLY_PATCH);

            pTable->InsCloak = NULL;

            // Flush the icache entry.
            IntIcFlushAddress(gGuest.InstructionCache, pTable->Rip, IC_ANY_VAS);
        }
    }
}


BOOLEAN
IntMtblInsRelocated(
    _In_ QWORD Rip
    )
{
    LIST_ENTRY *list;

    list = gMemTables.Flink;
    while (list != &gMemTables)
    {
        PMEM_TABLE_RELOC pTable = CONTAINING_RECORD(list, MEM_TABLE_RELOC, Link);
        list = list->Flink;

        if (pTable->Rip == Rip)
        {
            return TRUE;
        }
    }

    return FALSE;
}


INTSTATUS
IntMtblRemoveAgentEntries(
    void
    )
{
    LIST_ENTRY *list;

    list = gMemTables.Flink;
    while (list != &gMemTables)
    {
        PMEM_TABLE_RELOC pTable = CONTAINING_RECORD(list, MEM_TABLE_RELOC, Link);
        list = list->Flink;

        if (pTable->InAgent)
        {
            // No need to pause here, uninit functions are called with all the VCPUs paused.
            IntMtblRemoveEntry(pTable);

            RemoveEntryList(&pTable->Link);

            HpFreeAndNullWithTag(&pTable, IC_TAG_MTBL);
        }
    }

    return INT_STATUS_SUCCESS;
}


INTSTATUS
IntMtblUninit(
    void
    )
{
    PMEM_TABLE_RELOC pTable;
    LIST_ENTRY *list;

    list = gMemTables.Flink;
    while (list != &gMemTables)
    {
        pTable = CONTAINING_RECORD(list, MEM_TABLE_RELOC, Link);
        list = list->Flink;

        LOG("[MEMTABLE] Table at %llx accessed for %lld time, from RIP %llx, ignored = %d\n",
            pTable->TableGva, pTable->Hits, pTable->Rip, pTable->Ignored);

        // No need to pause here, uninit functions are called with all the VCPUs paused.
        IntMtblRemoveEntry(pTable);

        RemoveEntryList(&pTable->Link);

        HpFreeAndNullWithTag(&pTable, IC_TAG_MTBL);
    }

    return INT_STATUS_SUCCESS;
}