Shadowing of pages on different cr3s about gbhv HOT 3 CLOSED

Hey, thanks for the positive feedback.

I've known people who have successfully implemented this, though I don't know too much of the specifics of what they did. I believe what they did was set the vm controls to exit on cr3, and when the target cr3 they cared for was swapped in, they would apply the EPT hook, and if the target cr3 was swapping out, it would remove the hook. The problem they dealt with was the Meltdown patch, which means that now there are two cr3 pointers per process now, so you have to watch out for either of those pointers during the cr3 exit. The EPT violation will happen for the process's usermode cr3 (probably, though a syscall could make the exit come from the kernel cr3), but as part of the exit the VMCS_HOST_CR3 control dictates that the System DTB will be loaded in, so you won't actually see the user process's memory by default in the exit handler. You'll need to set your cr3 value to the value from the cr3 exit or read the guest's cr3 value.

Hopefully that provides some insight.

from gbhv.

Note that usermode pages are always tradable. That means that, at any time, the memory manager can choose to copy the page to a different physical page in order to defragment the physical memory layout. This happens to free up larger contiguous physical ranges for things like network buffers when the system is under memory pressure or has been running for a very long time. It's probably unlikely to happen, but still definitely possible. So, be aware of this, because that means that the kernel might cause an EPT violation on your page when you're not expecting it.

from gbhv.

Thank you for the invaluable insight. I'll keep working on it.

from gbhv.