wbenny

#include <iostream>
#include <thread>
#include <cstdlib>
#include <cstdint>
#include <cinttypes>

static uint64_t win  = 0;
static uint64_t loss = 0;

void thread_printer()

wbenny

Windows system calls

...by stub

x86

Windows XP

B8 ?? ?? ?? ??                mov     eax, ??
BA 00 03 FE 7F                mov     edx, 7FFE0300h

wbenny

#
# Tested on freshly installed Ubuntu 16.04 (amd64)
# with VirtualBox 5.1.14 code base.
#

#
# Note:
# After a build, there was VBoxDD.so file missing in the
# out/linux.amd64/release/bin folder.
# The file is located in the out/linux.amd64/release/obj/VBoxDD folder,

wbenny

VMCS field encoding

Values of VMCS fields are encoded as per section VMREAD, VMWRITE, and Encodings of VMCS Field (24.11.2, Intel Manual Volume 3C - May 2018).

This encoding can be transcribed into C:

union vmcs_component_encoding
{
 struct

wbenny

//
// Merge .CRT section to .rdata (read only)
//

#pragma comment(linker, "/merge:.CRT=.rdata")

//
// Define variables marking the begin and the end
// of the TLS callback array.
//

wbenny

typedef enum _SYSTEM_DLL_TYPE
{
  PsNativeSystemDll = 0,
  PsWowX86SystemDll = 1,
  PsWowArm32SystemDll = 2,
  PsWowAmd64SystemDll = 3,
  PsWowChpeX86SystemDll = 4,
  PsVsmEnclaveRuntimeDll = 5,
  PsSystemDllTotalTypes = 6,
} SYSTEM_DLL_TYPE;

wbenny

//
// sizeof=0x50, align=0x8
//

typedef struct _PS_SYSTEM_DLL_DATA {

    //
    // +0x00
    //
    // _SECTION* object of the DLL.

wbenny

typedef enum _WOW64_SHARED_INFORMATION
{
  SharedNtdll32LdrInitializeThunk = 0,
  SharedNtdll32KiUserExceptionDispatcher = 1,
  SharedNtdll32KiUserApcDispatcher = 2,
  SharedNtdll32KiUserCallbackDispatcher = 3,
  SharedNtdll32RtlUserThreadStart = 4,
  SharedNtdll32pQueryProcessDebugInformationRemote = 5,
  SharedNtdll32BaseAddress = 6,
  SharedNtdll32LdrSystemDllInitBlock = 7,

wbenny

typedef struct _PS_NTDLL_EXPORT_ITEM {
    PCSTR RoutineName;
    PVOID RoutineAddress;
} PS_NTDLL_EXPORT_ITEM, *PPS_NTDLL_EXPORT_ITEM;

PS_NTDLL_EXPORT_ITEM NtdllExports[] = {
    //
    // 19 exports on x64
    // 14 exports on ARM64
    //

wbenny

////////////////////////////////////////////////////////////////////////////////
// General definitions.
////////////////////////////////////////////////////////////////////////////////


//
// Context flags.
// winnt.h (Windows SDK)
//