/// <summary> /// Per-CPU page hook/unhook routine /// </summary> /// <param name="Dpc">Unused</param> /// <param name="Context">Valid PHOOK_CONTEXT</param> /// <param name="SystemArgument1">Unused</param> /// <param name="SystemArgument2">Unused</param> VOID PHpHookCallbackDPC( IN PRKDPC Dpc, IN PVOID Context, IN PVOID SystemArgument1, IN PVOID SystemArgument2 ) { UNREFERENCED_PARAMETER( Dpc ); PHOOK_CONTEXT pCTX = (PHOOK_CONTEXT)Context; if (pCTX != NULL) __vmx_vmcall( pCTX->Hook ? HYPERCALL_HOOK_PAGE : HYPERCALL_UNHOOK_PAGE, pCTX->DataPagePFN, pCTX->CodePagePFN, pCTX->Type ); KeSignalCallDpcSynchronize( SystemArgument2 ); KeSignalCallDpcDone( SystemArgument1 ); }
static NTSTATUS __ksm_exit_cpu(struct ksm *k) { VCPU_DEBUG_RAW("going down\n"); struct vcpu *vcpu = NULL; size_t err = __vmx_vmcall(HYPERCALL_STOP, &vcpu); if (err) VCPU_DEBUG("%d\n", err); else VCPU_DEBUG("stopped\n"); k->vcpu_list[vcpu->nr] = NULL; vcpu_free(vcpu); k->active_vcpus--; return err ? STATUS_UNSUCCESSFUL : STATUS_SUCCESS; }
/// <summary> /// Revert CPU to non-root mode /// </summary> /// <param name="Vcpu">Virtual CPU data</param> VOID VmxShutdown( IN PVCPU Vcpu ) { //DPRINT( "HyperBone: CPU %d: %s: CR3 load count %d\n", CPU_IDX, __FUNCTION__, Vcpu->Cr3Loads ); __vmx_vmcall( HYPERCALL_UNLOAD, 0, 0, 0 ); VmxVMCleanup( KGDT64_R3_DATA | RPL_MASK, KGDT64_R3_CMTEB | RPL_MASK ); EptFreeIdentityMap( &Vcpu->EPT ); if (Vcpu->VMXON) MmFreeContiguousMemory( Vcpu->VMXON ); if (Vcpu->VMCS) MmFreeContiguousMemory( Vcpu->VMCS ); if (Vcpu->VMMStack) MmFreeContiguousMemory( Vcpu->VMMStack ); Vcpu->VMXON = NULL; Vcpu->VMCS = NULL; Vcpu->VMMStack = NULL; }