Cheat Engine

buraktamturk · Newbie cheater Reputation: 0 Joined: 29 Jun 2014 Posts: 18

Hello,

CE driver does not try to offload dbvm when running in kvm, CE thinks DBVM is loaded already, because all vmcall instructions goes to kvm and kvm returns -1000 to all calls that CE made. (Nested virtualization is enabled)

Is there any change to get it running on kvm? Like something patching linux kernel to answer vmcall_getversion to give invalid instruction, or patching the driver offload when dbvm version is -1000. After offloading will dbvm overwrite vmcalls?

Attaching a picture.

Thanks.

Dark Byte · Posted: Sun Jun 29, 2014 5:46 pm Post subject:

hmm, that may be a problem

I could change the vmx_getversion() function to only accept vmx versions bigger than 0, but the general implementation of dbvm's virtual machine is to emulate that intel-vt has been disabled in the bios.
It therefore intercepts vmcall instructions and cause all vmcall commands that do not have recognized commands nor a valid password to raise an #UD

so not sure if KVM is able to continue when all vmcall instruction suddenly start failing with exception

buraktamturk · Newbie cheater Reputation: 0 Joined: 29 Jun 2014 Posts: 18

Dark Byte · Posted: Sun Jun 29, 2014 6:30 pm Post subject:

I've uploaded a 64bit ce exe and driver with some checks for a proper dbvm signature at http://cheatengine.org/temp/vmxversionaware.rar (untested, extract to a ce install folder)

Just see what happens (or if it encounters another blocking issue)

buraktamturk · Newbie cheater Reputation: 0 Joined: 29 Jun 2014 Posts: 18

Dark Byte · Posted: Sun Jun 29, 2014 6:47 pm Post subject:

copy the vmdisk files from http://cheatengine.org/temp/vmdisk.rar to that folder, perhaps the .sig doesn't match the vmdisk.img (did you compile/edit it ?)

buraktamturk · Newbie cheater Reputation: 0 Joined: 29 Jun 2014 Posts: 18

buraktamturk · Newbie cheater Reputation: 0 Joined: 29 Jun 2014 Posts: 18

The guest complately freezes while offloading dbvm, i don't know why and where. DebugView does not show anything after the freeze, it may freeze quickly so doesn't let a task switch to DebugView.

And now looking to the KVM source code, looks like kvm_emulate_hypercall handling vmcalls. I compared RDX with the password which come with dbvm source code, if yes it answers all vmcalls with rax = 9, and wrote a dummy kernel mode driver that call vmcall_getversion, i successfully managed to get 9 at guest side. I could give UD but since you patched the code it will not change anything.

I don't know how to get memory dump of a frozen system, so we can look where the code is freezing, is there any way to find where is the problem? If it will not work with the KVM, i understant dbvm is written without nested virtualization in mind, i would like to start porting it to KVM, if you permit (i don't know much, but i want to learn).

Thanks.

Dark Byte · Posted: Mon Jun 30, 2014 5:44 am Post subject:

When it freezes without BSOD it means dbvm encountered an event it doesn't know how to handle (e.g a triple fault)

I have no experience with KVM at all so can't really say much (I'll check it out when I get time. It looks useful for debugging dbvm for which I use Bochs right now)

If possible, configure your KVM to use only 1 cpu (that way, if it crashes, you know it's the first and only cpu) DBVM has a chance of crashing each time a cpu is offloaded (there are some bugs which I haven't been able to find yet as my systems now always run 100%)

Also, can it emulate serial ports ? If so, I could build a debug build of dbvm which outputs debug data to the serial port and provides some interactivity (disassembling, vm state, etc...)
I would need an IO port I can use for that though (e.g 0x3f8 ? )

buraktamturk · Newbie cheater Reputation: 0 Joined: 29 Jun 2014 Posts: 18

Dark Byte · Posted: Mon Jun 30, 2014 7:22 am Post subject:

The debug build needs a bi-directional serial port connection
Once it has started the serial port menu will be sent and then it waits for a command on how to continue, so just saving the output won't have an effect

In vmware in windows i use a pipe with putty
In bochs i use a sleeping terminal for output
Perhaps kvm has something like that

Also, if you build your own dbvm you should compile the driver yourself as well and then boot windows with unsigned driver support (or sign the driver). You won't need the .sig then

buraktamturk · Newbie cheater Reputation: 0 Joined: 29 Jun 2014 Posts: 18

Dark Byte · Posted: Mon Jun 30, 2014 9:42 am Post subject:

Weird, it looks like debug register 2 caused an interrupt inside dbvm itself

this may indicate that restoring DR7 on vmexit isn't properly implemented in kvm (with a serial connection you could send '3' and get the vm state and confirm that DR2+DR7 in the guest was set to cause a breakpoint)

or it's a leftover debug thing I put in myself which i forgot to remove. I'll check it out later today (I doubt it as I'm more a DR0 guy)

Dark Byte · Posted: Wed Jul 02, 2014 6:00 am Post subject:

it looks like vmlaunch fails due to incorrect parameters so I'll check it out (I fixed the issue with the weird exception, it was stack corruption)

also, a tip for debugging with serial:
open a new terminal window or tab
type in tty, write down the path and then sleep 10000000

then just launch kvm with parameter -serial pathoftty (e.g: -serial /dev/pts/3 )
keyboard input is accepted

(also found a small bug in kvm that under normal usage should never cause any issues, but if vmlaunch fails, it returns one byte later than it should)

buraktamturk · Newbie cheater Reputation: 0 Joined: 29 Jun 2014 Posts: 18