kernel
Loading...
Searching...
No Matches
instruction.c
Go to the documentation of this file.
1#include "../../includes/exception.h"
2
3bool
4ExpIsPrivilegedInstruction(uint8_t* Ip /*, bool Wow64*/)
5
6// Desc: This will check if the instruction ran in the instruction pointer from user mode (or from anywhere really)
7// Is a privileged instruction or not (meaning, it could only be executed in KernelMode (CPL == 0)
8
9// This is taken DIRECTLY from ReactOS, why? Because I dont really want to make my own parser right now.
10// And they are already brilliant people so I trust them
11
12// Link to code: https://github.com/reactos/reactos/blob/5047e62e3dde76635a46516b289968b951348f74/ntoskrnl/ke/amd64/except.c#L446
13// Thanks Timo Kreuzer and Alex Ionescu
14
15{
16 uint32_t i;
17
18 /* Handle prefixes */
19 for (i = 0; i < 15; i++)
20 {
21 /*
22 if (!Wow64)
23 */
24 //{
25 /* Check for REX prefix */
26 if ((Ip[0] >= 0x40) && (Ip[0] <= 0x4F))
27 {
28 Ip++;
29 continue;
30 }
31 //}
32
33 switch (Ip[0])
34 {
35 /* Check prefixes */
36 case 0x26: // ES
37 case 0x2E: // CS / null
38 case 0x36: // SS
39 case 0x3E: // DS
40 case 0x64: // FS
41 case 0x65: // GS
42 case 0x66: // OP
43 case 0x67: // ADDR
44 case 0xF0: // LOCK
45 case 0xF2: // REP
46 case 0xF3: // REP INS/OUTS
47 Ip++;
48 continue;
49 }
50
51 break;
52 }
53
54 if (i == 15)
55 {
56 /* Too many prefixes. Should only happen, when the code was concurrently modified. */
57 return false;
58 }
59
60 switch (Ip[0])
61 {
62 case 0xF4: // HLT
63 case 0xFA: // CLI
64 case 0xFB: // STI
65 return true;
66
67 case 0x0F:
68 {
69 switch (Ip[1])
70 {
71 case 0x06: // CLTS
72 case 0x07: // SYSRET
73 case 0x08: // INVD
74 case 0x09: // WBINVD
75 case 0x20: // MOV CR, XXX
76 case 0x21: // MOV DR, XXX
77 case 0x22: // MOV XXX, CR
78 case 0x23: // MOV YYY, DR
79 case 0x30: // WRMSR
80 case 0x32: // RDMSR
81 case 0x33: // RDPMC
82 case 0x35: // SYSEXIT
83 case 0x78: // VMREAD
84 case 0x79: // VMWRITE
85 return true;
86
87 case 0x00:
88 {
89 /* Check MODRM Reg field */
90 switch ((Ip[2] >> 3) & 0x7)
91 {
92 case 2: // LLDT
93 case 3: // LTR
94 return true;
95 }
96 break;
97 }
98
99 case 0x01:
100 {
101 switch (Ip[2])
102 {
103 case 0xC1: // VMCALL
104 case 0xC2: // VMLAUNCH
105 case 0xC3: // VMRESUME
106 case 0xC4: // VMXOFF
107 case 0xC8: // MONITOR
108 case 0xC9: // MWAIT
109 case 0xD1: // XSETBV
110 case 0xF8: // SWAPGS
111 return true;
112 }
113
114 /* Check MODRM Reg field */
115 switch ((Ip[2] >> 3) & 0x7)
116 {
117 case 2: // LGDT
118 case 3: // LIDT
119 case 6: // LMSW
120 case 7: // INVLPG / SWAPGS / RDTSCP
121 return true;
122 }
123 break;
124 }
125
126 case 0x38:
127 {
128 switch (Ip[2])
129 {
130 case 0x80: // INVEPT
131 case 0x81: // INVVPID
132 return true;
133 }
134 break;
135 }
136
137 case 0xC7:
138 {
139 /* Check MODRM Reg field */
140 switch ((Ip[2] >> 3) & 0x7)
141 {
142 case 0x06: // VMPTRLD, VMCLEAR, VMXON
143 case 0x07: // VMPTRST
144 return true;
145 }
146 break;
147 }
148 }
149
150 break;
151 }
152 }
153
154 return false;
155}
ExpIsPrivilegedInstruction
bool ExpIsPrivilegedInstruction(uint8_t *Ip)
Definition instruction.c:4