This commit is contained in:
Mateico
2026-07-01 09:55:05 +02:00
parent e14946aa0a
commit 39818a69e8
2 changed files with 17 additions and 7 deletions

View File

@@ -29,11 +29,15 @@
__attribute__((section(".entry_point"), naked)) uint32_t main(void) {
volatile int fw_version = 0x11AA11AA; // To be updated by loader
uint64_t hv_pml4 = *(uint64_t *) (fw_version==0x0650 ? HV_PML4_0650 : HV_PML4_07xx);
uint64_t hv_base = fw_version==0x0650 ? (*(uint64_t *) HV_ENTRY_0650 - HV_MAIN_0650) : (*(uint64_t *) HV_ENTRY_07xx - HV_MAIN_07xx);
uint64_t hv_pml4 =
*(uint64_t *)(fw_version == 0x0650 ? HV_PML4_0650 : HV_PML4_07xx);
uint64_t hv_base = fw_version == 0x0650
? (*(uint64_t *)HV_ENTRY_0650 - HV_MAIN_0650)
: (*(uint64_t *)HV_ENTRY_07xx - HV_MAIN_07xx);
uintptr_t *g_vm_tab =
(uintptr_t *)vtophys_custom(hv_base + (fw_version==0x0650 ? G_VM_TAB_0650 : G_VM_TAB_07xx), hv_pml4);
uintptr_t *g_vm_tab = (uintptr_t *)vtophys_custom(
hv_base + (fw_version == 0x0650 ? G_VM_TAB_0650 : G_VM_TAB_07xx),
hv_pml4);
for (int i = 0; i < 16; i++) {
uintptr_t vc = vtophys_custom(g_vm_tab[i], hv_pml4);
uintptr_t vmcb = vtophys_custom(*(uintptr_t *)(vc + 0x08), hv_pml4);
@@ -52,10 +56,15 @@ __attribute__((section(".entry_point"), naked)) uint32_t main(void) {
wrmsr(MSR_APICBASE, DEFAULT_APIC_BASE | APICBASE_ENABLED | APICBASE_BSP);
// Restore gs base.
wrmsr(MSR_GSBASE, ((uint64_t *) (fw_version==0x0650 ? HV_STACK_TABLE_0650 : HV_STACK_TABLE_07xx) )[0] + 0x1000);
wrmsr(MSR_GSBASE,
((uint64_t *)(fw_version == 0x0650 ? HV_STACK_TABLE_0650
: HV_STACK_TABLE_07xx))[0] +
0x1000);
// Reenter hypercore.
void (*hv_reenter_hypercore)(void) = (void *) (fw_version==0x0650 ? HV_REENTER_HYPERCORE_0650 : HV_REENTER_HYPERCORE_07xx) ;
void (*hv_reenter_hypercore)(void) =
(void *)(fw_version == 0x0650 ? HV_REENTER_HYPERCORE_0650
: HV_REENTER_HYPERCORE_07xx);
hv_reenter_hypercore();
while (1)
;

View File

@@ -110,7 +110,8 @@ int hv_defeat_0607(void *shellcode_kernel, size_t shellcode_kernel_len) {
PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, -1, 0);
memcpy(shellcode_0607, shellcode_0607_bin, shellcode_0607_bin_len);
if(update_sc_fw_version((uint64_t) shellcode_0607)) return -1;
if (update_sc_fw_version((uint64_t)shellcode_0607))
return -1;
for (int i = 0; i < shellcode_0607_bin_len; i += PAGE_SIZE) {
install_page_syscore(kernel_cave_shellcode_0761 + i,