From 3028a4eb11b4bb85f7d9d4406fce684fa90df2c4 Mon Sep 17 00:00:00 2001 From: Gregory Lirent Date: Sat, 20 Jun 2026 17:02:29 +0300 Subject: [PATCH] Take the kernel cr3 in the read-only win32 constructor vmie_win32_open_ro_fd now takes a kcr3 and builds the struct-offset profile read-only from the image (find ntoskrnl, resolve PsInitialSystemProcess, build the profile, derive the System _EPROCESS), so a read-only context has the full read surface - including proc_list/proc_modules, not just the cr3-parameterised PE walks. The read-only bring-up tail is factored out of host_bootstrap into a shared helper; host_bootstrap keeps the beacon find / cr3 recovery / ACK around it, so its behaviour and return codes are unchanged. --- include/win32.h | 24 +++++++-------- src/engine/win32/host.c | 65 +++++++++++++++++++++++++---------------- 2 files changed, 52 insertions(+), 37 deletions(-) diff --git a/include/win32.h b/include/win32.h index 3027fd2..e7926c7 100644 --- a/include/win32.h +++ b/include/win32.h @@ -93,18 +93,18 @@ vmie_win32* vmie_win32_open(const char* ram_path, uint64_t low); vmie_win32* vmie_win32_open_fd(int fd, uint64_t low); /* Open a READ-ONLY context over the RAM backing file `fd`, for a consumer that - * only reads. Unlike vmie_win32_open_fd this does NOT bootstrap (the magic- - * signature handshake needs RW): the caller supplies the address space by passing - * a cr3 to each read call. Every read API that takes a cr3 works - the section / - * function / import / export / callgraph / hook surfaces, gva_read_text, and the - * generic gva_* and scanner surfaces via vmie_win32_mem(); writes (gva_write) -1 - * because the mapping is PROT_READ. proc_list/proc_modules are NOT available here: - * they need the bootstrap-recovered profile, which a read-only context does not - * carry. `fd` is BORROWED (dup()'d internally; the caller's fd stays valid after - * this call AND after vmie_win32_close()); an O_RDONLY fd is accepted. `low` is - * the below-4G split, as in vmie_win32_open_fd. Returns a new context, or NULL on - * dup/fstat/mmap failure. Free with vmie_win32_close(). */ -vmie_win32* vmie_win32_open_ro_fd(int fd, uint64_t low); + * only reads. It takes a caller-supplied `kcr3` (kernel cr3 / System DirectoryTableBase) + * and builds the struct-offset profile read-only from the image (no bootstrap + * handshake - beacon and ACK are not used). The result has the FULL read + * capability: proc_list/proc_modules AND the section / function / import / export + * / callgraph / hook surfaces, gva_read_text, and the generic gva_* and scanner + * surfaces via vmie_win32_mem(). Any write (gva_write) returns -1 because the + * mapping is PROT_READ. `fd` is BORROWED (dup()'d internally; the caller's fd + * stays valid after this call AND after vmie_win32_close()); an O_RDONLY fd is + * accepted. `low` is the below-4G split, as in vmie_win32_open_fd. Returns a new + * context, or NULL if `kcr3` does not resolve a kernel (ntoskrnl not found under + * it) or on dup/fstat/mmap failure. Free with vmie_win32_close(). */ +vmie_win32* vmie_win32_open_ro_fd(int fd, uint64_t low, uint64_t kcr3); /* Unmap, close, and free a context. Safe on NULL. After this, every pointer * into guest memory obtained through this context is invalid. */ diff --git a/src/engine/win32/host.c b/src/engine/win32/host.c index 6837668..380c650 100644 --- a/src/engine/win32/host.c +++ b/src/engine/win32/host.c @@ -6,6 +6,9 @@ #define MZ 0x5A4Du +__attribute__((cold)) +static int host_profile_from_cr3(vmie_win32* v, uintptr_t cr3); + /* ---- lifecycle (cold) ---------------------------------------------------- */ __attribute__((cold)) @@ -34,10 +37,12 @@ vmie_win32* vmie_win32_open_fd(int fd, uint64_t low) { return v; } -/* Read-only context: no bootstrap, the cr3 is supplied per read call. The mem is - * mapped PROT_READ (gpa_from_ro_fd), so every write through it returns -1. */ +/* Read-only consumer context: maps the backing file PROT_READ and builds the + * struct-offset profile from the image under the caller-supplied kcr3 (no + * beacon, no cr3 recovery, no ACK write). All read APIs work, incl. + * proc_list/proc_modules; writes return -1. */ __attribute__((cold)) -vmie_win32* vmie_win32_open_ro_fd(int fd, uint64_t low) { +vmie_win32* vmie_win32_open_ro_fd(int fd, uint64_t low, uint64_t kcr3) { vmie_win32* v = calloc(1, sizeof *v); if (!v) { return NULL; @@ -46,6 +51,10 @@ vmie_win32* vmie_win32_open_ro_fd(int fd, uint64_t low) { free(v); return NULL; } + if (host_profile_from_cr3(v, (uintptr_t)kcr3)) { + vmie_win32_close(v); + return NULL; + } return v; } @@ -181,6 +190,31 @@ static uint32_t ko_export_rva(vmie_mem* m, uintptr_t cr3, uint64_t kbase, const return 0; } +__attribute__((cold)) +static int host_profile_from_cr3(vmie_win32* v, uintptr_t cr3) { + vmie_mem* m = &v->mem; + uint8_t guid[16]; + uint32_t age, rva; + uint64_t sys_ep, dtb; + + if (find_ntoskrnl(m, cr3, &v->kbase, guid, &age)) { + return -3; + } + rva = ko_export_rva(m, cr3, v->kbase, "PsInitialSystemProcess"); + if (!rva || gva_read(m, cr3, v->kbase + rva, &sys_ep, 8)) { + return -4; + } + if (profile_build(v, cr3, sys_ep, guid, age)) { + return -5; + } + if (gva_read(m, cr3, sys_ep + v->prof.ep_dtb, &dtb, 8)) { + return -6; + } + v->kcr3 = dtb & PFN_MASK; + v->sysproc = sys_ep; + return 0; +} + static void beacon_ack(vmie_mem* m, uint64_t anchor_pa) { uint64_t ack = CONTRACT_MAGIC_R; gpa_write(m, anchor_pa + offsetof(contract, ack), &ack, 8); @@ -195,10 +229,6 @@ int host_bootstrap(vmie_win32* v) { vmie_mem* m = &v->mem; uint64_t anchor_pa, va_self; uintptr_t cr3boot; - uint32_t rva; - uint8_t guid[16]; - uint32_t age; - uint64_t sys_ep; if (beacon_find(m, &anchor_pa, &va_self)) { return -1; @@ -208,26 +238,11 @@ int host_bootstrap(vmie_win32* v) { return -2; } - if (find_ntoskrnl(m, cr3boot, &v->kbase, guid, &age)) { - return -3; + const int rc = host_profile_from_cr3(v, cr3boot); + if (rc) { + return rc; } - rva = ko_export_rva(m, cr3boot, v->kbase, "PsInitialSystemProcess"); - if (!rva || gva_read(m, cr3boot, v->kbase + rva, &sys_ep, 8)) { - return -4; - } - - if (profile_build(v, cr3boot, sys_ep, guid, age)) { - return -5; - } - - uint64_t dtb; - if (gva_read(m, cr3boot, sys_ep + v->prof.ep_dtb, &dtb, 8)) { - return -6; - } - v->kcr3 = dtb & PFN_MASK; - v->sysproc = sys_ep; - beacon_ack(m, anchor_pa); return 0; }