jonomango / hv

Lightweight Intel VT-x Hypervisor.
MIT License
406 stars 86 forks source link

Why is this EPT installation not working? #40

Closed untyper closed 1 year ago

untyper commented 1 year ago

Why is it that when I call original_func() after installing the EPT hook, it still prints "Hello, this the original function."? I was expecting execute_func()'s content to print instead but that isn't the case in the below code? What am I misunderstanding

#include "hv.h"
#include <iostream>

void original_func() {
  std::cout << "Hello, this the original function." << std::endl;
}

void execute_func() {
  std::cout << "Oops, different function..." << std::endl;
}

int main() {
  if (!hv::is_hv_running()) {
    printf("HV not running.\n");
    return 0;
  }

  auto cr3 = hv::query_process_cr3(GetCurrentProcessId());

  auto const exec_phys = hv::get_physical_address(cr3, &execute_func);
  auto const orig_phys = hv::get_physical_address(cr3, &original_func);

  hv::for_each_cpu([&](uint32_t) {
    hv::install_ept_hook(orig_phys >> 12, exec_phys >> 12);
  });

  original_func(); // <-- Still calls original, why?

  std::cin.get();
}
jonomango commented 1 year ago

Print out orig_phys >> 12 and exec_phys >> 12 and you'll most likely see the problem 😄

untyper commented 1 year ago

Seems like I have the same issue as https://github.com/jonomango/hv/issues/11 Prints out the original first then crashes on subsequent calls. I'll just go with classic ptr hooks for now and figure out the EPT stuff later.

On a sidenote, your coding style is pure art and the lib is very clean

hhuiwang commented 2 months ago

Print out orig_phys >> 12 and exec_phys >> 12 and you'll most likely see the problem 😄

So what exactly is the problem? Looking through the whole project, no example of use.

jonomango commented 1 month ago

Print out orig_phys >> 12 and exec_phys >> 12 and you'll most likely see the problem 😄

So what exactly is the problem? Looking through the whole project, no example of use.

The problem is that they reside in the same page, most likely (since the functions are so close to each other).