lirent/vatrog-vm-introspection-engine
1
0
Fork 0
mirror of https://dev.lirent.ru/Vatrog/vm-introspection-engine.git synced 2026-07-09 01:46:38 +03:00
Code Issues Packages Projects Releases Wiki Activity

Take the kernel cr3 in the read-only win32 constructor

Browse Source 
vmie_win32_open_ro_fd now takes a kcr3 and builds the struct-offset
profile read-only from the image (find ntoskrnl, resolve
PsInitialSystemProcess, build the profile, derive the System _EPROCESS),
so a read-only context has the full read surface - including
proc_list/proc_modules, not just the cr3-parameterised PE walks.

The read-only bring-up tail is factored out of host_bootstrap into a
shared helper; host_bootstrap keeps the beacon find / cr3 recovery / ACK
around it, so its behaviour and return codes are unchanged.
This commit is contained in:
Gregory Lirent
2026-06-20 17:02:29 +03:00
parent 02e63f2ff0
commit 3028a4eb11
2 changed files with 52 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/engine/win32/host.c
+40 -25
View File
@@ -6,6 +6,9 @@
#define MZ 0x5A4Du
__attribute__((cold))
static int host_profile_from_cr3(vmie_win32* v, uintptr_t cr3);
/* ---- lifecycle (cold) ---------------------------------------------------- */
__attribute__((cold))
@@ -34,10 +37,12 @@ vmie_win32* vmie_win32_open_fd(int fd, uint64_t low) {
return v;
}
/* Read-only context: no bootstrap, the cr3 is supplied per read call. The mem is
* mapped PROT_READ (gpa_from_ro_fd), so every write through it returns -1. */
/* Read-only consumer context: maps the backing file PROT_READ and builds the
* struct-offset profile from the image under the caller-supplied kcr3 (no
* beacon, no cr3 recovery, no ACK write). All read APIs work, incl.
* proc_list/proc_modules; writes return -1. */
__attribute__((cold))
vmie_win32* vmie_win32_open_ro_fd(int fd, uint64_t low) {
vmie_win32* vmie_win32_open_ro_fd(int fd, uint64_t low, uint64_t kcr3) {
vmie_win32* v = calloc(1, sizeof *v);
if (!v) {
return NULL;
@@ -46,6 +51,10 @@ vmie_win32* vmie_win32_open_ro_fd(int fd, uint64_t low) {
free(v);
return NULL;
}
if (host_profile_from_cr3(v, (uintptr_t)kcr3)) {
vmie_win32_close(v);
return NULL;
}
return v;
}
@@ -181,6 +190,31 @@ static uint32_t ko_export_rva(vmie_mem* m, uintptr_t cr3, uint64_t kbase, const
return 0;
}
__attribute__((cold))
static int host_profile_from_cr3(vmie_win32* v, uintptr_t cr3) {
vmie_mem* m = &v->mem;
uint8_t guid[16];
uint32_t age, rva;
uint64_t sys_ep, dtb;
if (find_ntoskrnl(m, cr3, &v->kbase, guid, &age)) {
return -3;
}
rva = ko_export_rva(m, cr3, v->kbase, "PsInitialSystemProcess");
if (!rva || gva_read(m, cr3, v->kbase + rva, &sys_ep, 8)) {
return -4;
}
if (profile_build(v, cr3, sys_ep, guid, age)) {
return -5;
}
if (gva_read(m, cr3, sys_ep + v->prof.ep_dtb, &dtb, 8)) {
return -6;
}
v->kcr3 = dtb & PFN_MASK;
v->sysproc = sys_ep;
return 0;
}
static void beacon_ack(vmie_mem* m, uint64_t anchor_pa) {
uint64_t ack = CONTRACT_MAGIC_R;
gpa_write(m, anchor_pa + offsetof(contract, ack), &ack, 8);
@@ -195,10 +229,6 @@ int host_bootstrap(vmie_win32* v) {
vmie_mem* m = &v->mem;
uint64_t anchor_pa, va_self;
uintptr_t cr3boot;
uint32_t rva;
uint8_t guid[16];
uint32_t age;
uint64_t sys_ep;
if (beacon_find(m, &anchor_pa, &va_self)) {
return -1;
@@ -208,26 +238,11 @@ int host_bootstrap(vmie_win32* v) {
return -2;
}
if (find_ntoskrnl(m, cr3boot, &v->kbase, guid, &age)) {
return -3;
const int rc = host_profile_from_cr3(v, cr3boot);
if (rc) {
return rc;
}
rva = ko_export_rva(m, cr3boot, v->kbase, "PsInitialSystemProcess");
if (!rva || gva_read(m, cr3boot, v->kbase + rva, &sys_ep, 8)) {
return -4;
}
if (profile_build(v, cr3boot, sys_ep, guid, age)) {
return -5;
}
uint64_t dtb;
if (gva_read(m, cr3boot, sys_ep + v->prof.ep_dtb, &dtb, 8)) {
return -6;
}
v->kcr3 = dtb & PFN_MASK;
v->sysproc = sys_ep;
beacon_ack(m, anchor_pa);
return 0;
}