Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

HV fails to subvert in UEFI mode on Intel i9 13900k #11

Open
ghost opened this issue Feb 15, 2023 · 3 comments
Open

HV fails to subvert in UEFI mode on Intel i9 13900k #11

ghost opened this issue Feb 15, 2023 · 3 comments

Comments

@ghost
Copy link

ghost commented Feb 15, 2023

Hi, this is a new github account, although I have worked closely with you before a few years ago over email regarding. I built an introspection engine for detecting bootkits with MiniVisorPkg back when it was first released.

I just upgraded to an i9 13900k from an i7 10900k and it doesn't seem to work. I'll investigate, but I'm leaving this here so if anyone else has this issue in the future, we can provide a solution.

Fails out at in HandleHostException seemingly during the execution of EnableHypervisor on all cores. InterruptNumber 0x6C (undocumented, reserved as far as I can tell) and error code 0x0. Note that at this stage, cr2 is 0. I believe that should be expected though at this phase of subverting the cores.

@ghost
Copy link
Author

ghost commented Feb 15, 2023

I cannot test serial, as this is a new build and i don't have a serial card yet. Will get one in for testing soon. VMWare same version of Win10 works fine, as does testing the same version on my i9 build. The only difference in this build is CPU change.

@ghost
Copy link
Author

ghost commented Feb 18, 2023

I updated ia32. @tandasat you might want to start the transition to new ia32 (I think MV is back in 2018 in terms of that). I'd be happy to contribute my update to ia32 Dec 2022.

That + disabling e-cores (only subvert p-cores) solves the problem. In the future I'd like to not have to hurt my CPU by 50% performance to subvert, so I'll come up w a solution eventually for dealing with e-cores.

@tandasat
Copy link
Owner

@spectra-analytics are you referring to ia32-doc headers? If so, I am happy to update the headers. Please consider making a PR against https://github.com/ia32-doc.

HandleHostException getting 0x6c is interesting. IIRC, I have seen 0x6c before and guessed it might be a UEFI thing, though did not take a deeper look. Are you sure that it is received in HandleHostException over, say UEFI's exception handler? The host should run with interrupt disabled, so I do not see why HandleHostException would receive an interrupt. Where does rip point to?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant