Cheat Engine

[kabachi]

[Dark Byte]

Yes, bit 0 indicates it's supported

[kabachi]

Ok, while my RS232 cable is in the mail here are some thoughts that you hopefully can validate:

1. That PET you mentioned in this thread, it is EPT right? Google returns some weird stuff when you google for intel pets
2. EPT is not in DBVM in the present, so it needs to be added. First, added as 1:1 mapping to the physical addresses to make things easier
3. A new command commands to DBVM that would allow taking a snapshot of a certain page given its address and store it in the reserved space
4. Add another command that would mark this page as "split", meaning two pages are used. Either the snapshot with "Read" access or the actual copy with "Execute only" access. Flip them in the VM exit that is supposed to happen in case of access violation from EPT permissions.
5. If a write happens when a snapshot is active, invalidate the snapshot and restore the original page contents from it.
6. Two more new commands to invalidate the snapshot and to check the page state. This should get us to the point where you can set INT 3 breakpoints on a code page or add some instrumentation to it and then trick any consistency checks in the malware we are trying to analyse More can be done to deal with self-modifying code, but this should be enough for the 1st cut.
7. If the page gets swapped out, the effect should disappear when its "guest" physical memory is overwritten. That means all our instrumentation would be gone - just disable the swap file for better effect.
8. Debugging it inside vmware or virtualbox is not feasible because they likely don't emulate EPT. That means I'll need RS232 to USB converter plus a null modem cable to debug it from my laptop (PC has a com port, laptop doesn't)
9. Virtual box implements EPT and can be used as an example with its source code
10. Same thing can be added to virtualbox built-in debugger and that would convert it into a badass malware analysis tool

Am I making sense here or just babbling?

I also noticed that when kernel debugging is enabled in CE only hardware breakpoints can be used. Would regular breakpoints be hard to implement and is anything happening to hide debug registers from the OS or the process?

[Dark Byte]

1: yes, I meant EPT
2: correct. Some architectures (like your support huge page mapping, so that can make things easier)
It will probably still require a bit more memory than the default 4MB

3: that's one posibility yes. Alternatively, allocate the copy in the target process and adjust read/write registers to there on access violation (a bit easier to detect, but faster)
4: you could probably add that in the one of 3

5: restore the original page, and set the TF flag in eflags. This will cause the current cpu to execute the instruction referencing the memory and then raise an debug exception.
Resume and block external interrupts for at least one cpu cycle, else there could be task switching anoyances(alternatively, the timed vmexit could be used to exit after 1 instruction cycle, but not sure if it can be that accurate)

6:

7: Code that is executed will almost never get paged out by windows so shouldn't be an issue. Besides, when it's loaded back, it's a write operation, and thus an access violation which you can deny

8: should work, but expect a BSOD once in a while on the laptop if there's a LOT of data coming through at once. (two of my usb com devices tend to cause a bsod when flooded, different manufacturers, so could be a generic driver things)

9-10: it might be easier to start with virtualbox

[kabachi]

[John111]

Looks like there was a talk on blackhat 2014 about using EPT with a small hypervisor.
Slides and hypervisor code is on github (dot) com (slash) ainfosec (slash) MoRE

[kabachi]

[tigerite]

Did anyone have any luck with merging the memory code from the MoRE source with DBVM? As MoRE's VM/hypervisor is nothing compared to DBVM's..

[kabachi]

[tigerite]

Thanks for posting this, it's really useful, so do I take that to mean you're using Linux and running Windows as a (K)VM within it? If so, it's funny because I've started doing something similar, you may want to look into DRAKVUF as well, it's mostly for malware analysis but could come in useful to monitor what system calls games are making.

[kabachi]