search

asamy / ksm

A fast, hackable and simple x64 VT-x hypervisor for Windows and Linux. Builtin userspace sandbox and introspection engine.
https://asamy.github.io/ksm/
GNU General Public License v2.0
826 stars 181 forks source link

Nested support #24

Closed CiraciNicolo closed 6 years ago

CiraciNicolo commented 6 years ago

Is nested support functional? I would like to reproduce this scenario for academic purpose for RDTSC integrity:

L0 KSM -> L1 KSM (Malicious) L0 controls RDTSC/RDTSCP exit handler, L1 tries to controls them. Guest software call RDTSC, L0 returns the bare machine value WITHOUT invoking L1

Can I do this?

asamy commented 6 years ago

Nesting support is minimal, but it's quite trivial to add new code to it.

Yes, you can do it, since L0 gets the real VM exit anyway, or you can just strip their RDTSC/RDTSCP controls in the vmwrite VM exit handler.

CiraciNicolo commented 6 years ago

I'm sorry if I'm being annoying, but do you have some literature on how can I do this or can you give me a brief how to?

asamy commented 6 years ago

nested_can_handle decides whether L0 will exit to L1 to handle the event, you can modify that to your needs or simply modify nested_vmcs_write to mask out the RDTSC exiting bit.

CiraciNicolo commented 6 years ago

Thanks! The nested VM should be KSM or any other?

asamy commented 6 years ago

KSM may not be able to nest itself. Up to you.

CiraciNicolo commented 6 years ago

But should I use any other hypervisor?

asamy commented 6 years ago

Like I said, it's up to you. Some may not work because it doesn't emulate many important features, by they are quite easy to add.

If you decide to go with KSM, then make sure to change device name, etc so it can be loaded a second time.