The problem about trap external interrupt

[Donghai Tian]

Hi joystick,

I try to configure the HDBG to configure HDBG to capture external interrupts.

To do so, I first set the PIN_BASED_VM_EXEC_CONTROL field.

VmxVmcsWrite(PIN_BASED_VM_EXEC_CONTROL, 1);

After that, the interrupt cause a VMExist, I add the code to handle the interrupt:

  case EXIT_REASON_EXTERNAL_INTERRUPT:

  {

Bit32u trap, error_code;

    Log("EXIT_REASON_EXTERNAL_INTERRUPT!!!");

trap = vmxcontext.ExitInterruptionInformation & INTR_INFO_VECTOR_MASK;

error_code = HVM_DELIVER_NO_ERROR_CODE;

VmxInternalHvmInjectException(INTR_TYPE_EXT_INTR, trap, error_code);

    goto Resume;

    

    /* Unreachable */

    break;

   }

Unfortunately, the system gets crashed after I inject the interrupt into the guest by using the function

VmxInternalHvmInjectException.

I am not sure about the reason. Anything wrong?

Thanks.

Best

Donghai

[Aristide Fattori]

At a first glance ( I have never worked with external interrupts), the
problem may be that you need to reset context.Guest_Context.resumerip
to the value of the instruction that was being executed when the exit
was triggered (i.e., context.Guest_Context.guest_context.rip). By
default, indeed, hyperdbg assumes that it needs to enter to the
instruction *following* the one that triggered an exit, so if you want
to re-exec the instruction (such as the case, for example, when you
intercept page faults), you need to explicitly set resumerip to rip.

Let me know if it helps ;-)

> --
> You received this message because you are subscribed to the Google Groups
> "hyperdbg" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to hyperdbg+u...@googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.



--
GnuPG Key on keyserver.pgp.com ID 0x25578128
http://security.di.unimi.it/~joystick/