Cheat Engine

[linden]

A question for Dark Byte...
I'm a complete noob regarding CPU hardware features and OS basics...but seeing DBVM, I came up with this question.

Is it possible to circumvent PatchGuard on 64bit Vista using VT features that come with Core2Duo?

Is it possible to write something like DBVM for 64bit Vista that will, for example, redirect int handlers, or change control path upon access on certain memory address (such that it achieves the effect of an inline function hook but without actually changing the function bytes), or going further, rendering driver signature verification useless by changing control path on driver loading routines?

I think we all hate these Vista features

[Dark Byte]

yes, currently DBVM can already redirect int handlers to a different address than what is in the IDT even for 64-bit (I mainly use it for int1)
You can even change the path when CR3 is changed to a specific process

Also, you can just give a usermode application kernelmode access. That is how I loaded my driver in vista64 : http://forum.cheatengine.org/viewtopic.php?t=115819

I guess you could use it to set a breakpoint on a read on the kernel, and then redirect the read to a clean copy

(with intel-vt you can hook a lot of stuff, including debug registers, control registers, and even cpuid: http://forum.cheatengine.org/files/properties_206.png )

[linden]

Thanx for your reply DB

It's good to hear about the possibilities of circumventing those fucking security features in Vista64.

Now, I shall goto those Intel IA manuals to study more about this VT feature and see if I can write my own VM some time

[Dark Byte]

Good luck with that, if you ever need specific help you can always ask me.

Also, since your intention is targeted to vista 64, you'll be making something like dbvm.
It has to run before the operating system starts, because you won't be able to load a device driver that offloads the os into the new vm. (or you boot up with f8 pressed, but that kinda spoils the reason, and disables some features and can probably be detected)
So, also look into boot sectors and low level bios calls. (int13h for reading the disk to load the rest of your vm, and int15h for the memory region list)

Then the problem that intel-VT does not support real-mode 8086, it MUST run in protected mode, including the boot up code that is in realmode. You can fix this by running that code in a realmode container and handle the privileged instructions seperatly, emulate, or switch to protected mode, execute it, and go back. (And not to mention emulating real mode interrupts, including one interrupt you probably want to modify the result off, mem region, so the os will not overwrite your vm)


but when those problems are gone it's pretty straightforward: guest os breaks on a event, your virtual machine handles the event, and the guest os continues running