hello
I am trying develop my branch trace store for my x64 windows 7 sp1.i have done in my machine and it records the recent branch.The problem is that it records golbaly means it records it for every process in my system , i want it for just single process. is it possiable by hooking KiSwapContext , through "WriteMSR(DEBUGCNTRL,0xc0,0); //Enabling TR and BTS" for that process that i want... my windows internals skill is not so good. I hope if this possible i will able to log every jmp,call ,j* instruction. it will very help full for live debugging.
branch trace store details canbe found in Intel SDM Vol3 17.4
I am trying develop my branch trace store for my x64 windows 7 sp1.i have done in my machine and it records the recent branch.The problem is that it records golbaly means it records it for every process in my system , i want it for just single process. is it possiable by hooking KiSwapContext , through "WriteMSR(DEBUGCNTRL,0xc0,0); //Enabling TR and BTS" for that process that i want... my windows internals skill is not so good. I hope if this possible i will able to log every jmp,call ,j* instruction. it will very help full for live debugging.
branch trace store details canbe found in Intel SDM Vol3 17.4
Code: Select all
Thanking you...#include <wdm.h>
#pragma pack(1)
#define IA32_MISC_ENABLE 0x1A0
#define IA32_PREF_CAPABILITIES 0x345
#define MSR_LASTBRANCH_0_FROM_IP 0x680 // 16 Contigous Block
#define MSR_LASTBRACH_TOS 0x1c9
#define MSR_LER_TO_LIP 0x1dd
#define MSR_LER_FROM_LIP 0x1de
#define MSR_LASTBRANCH_0_TO_IP 0x6c0 // 16 Contigous Block
#define IA32_DS_AREA 0x600
#define DEBUGCNTRL 0x1d9
#define MSR_LASTBRANCH_FORM 0x1db
#define MSR_LASTBRANCH_TO 0x1dc
typedef struct _CR_REGS
{
ULONG64 CR0;
ULONG64 CR2;
ULONG64 CR3;
ULONG64 CR4;
ULONG64 CR8;
}CR_REGS , *PCR_REGS;
extern VOID GetCRSet(PCR_REGS) ;
extern VOID EnablePCE();
extern ULONG64 ReadMSR(ULONG MSRIndex);
extern VOID WriteMSR ( ULONG Index, ULONG LowPart,ULONG HiPart);
VOID DriverUnload(PDRIVER_OBJECT pDriverObject)
{
DbgPrint("Unload Called!!!!");
}
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject,PUNICODE_STRING RegistryPath)
{
CR_REGS CR_REG_PROCESSOR [4];
KAFFINITY kAffinity;
ULONG64 LBR_TOS;
PULONG64 ds_area=NULL,bts_buffer_base,bts_index,bts_absulute_max ;
UCHAR ProcessorNum;
pDriverObject->DriverUnload=DriverUnload;
DbgPrint("Loadiing DS Save Area in Processor 0");
KeSetSystemAffinityThreadEx(1);
ds_area=(PULONG64) ExAllocatePoolWithTag(NonPagedPool ,0x3fffff ,'BTS0');
DbgPrint("Loading DS_AREA %llx",ds_area);
memset(ds_area,0,0x3fffff);
bts_buffer_base=(PULONG64)((ULONG64)ds_area+ 0x100); //recording starts here..
bts_index=bts_buffer_base;
bts_absulute_max=bts_buffer_base+0x400000;
DbgPrint("Setuping bts_buffer_base") ;
*(PULONG64 )((ULONG64)ds_area+0)=(ULONG64 )bts_buffer_base;
*(PULONG64 )((ULONG64)ds_area+0x8)=(ULONG64 )bts_index;
*(PULONG64 )((ULONG64)ds_area+0x10)=(ULONG64 )bts_absulute_max;
*(PULONG64 )((ULONG64)ds_area+0x18)=(ULONG64 )bts_absulute_max; // When Max Generate Interrupt
WriteMSR ( IA32_DS_AREA, ((ULONG64) ds_area & 0xffffffff),((ULONG64)ds_area>>32));
WriteMSR(DEBUGCNTRL,0xc0,0); //Enabling TR and BTS
return STATUS_SUCCESS;
}