Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] Hypercall Submit Panic doesn't work when no Intel PT #64

Open
MahnurA opened this issue Apr 29, 2024 · 0 comments
Open

[BUG] Hypercall Submit Panic doesn't work when no Intel PT #64

MahnurA opened this issue Apr 29, 2024 · 0 comments

Comments

@MahnurA
Copy link

MahnurA commented Apr 29, 2024

As the title states, HYPERCALL_KAFL_SUBMIT_PANIC always uses the KAFL_HYPERCALL_PT version with vmcall, so doesn't work on targets that don't have Intel PT enabled.

A quick and dirty patch to get it to work on No PT targets was to replace the panic payload bytes in hypercall.h to the following:
#define PANIC_PAYLOAD_64 "\xFA\xB8\x1F\x80\x80\x80\xBB\x08\x00\x00\x00\x48\xC7\xC1\x00\x00\x00\x00\xBA\x58\x56\x00\x00\xEF\xF4"

This however will result in the panic payload to always be for NO_PT, so some sort of auto detection should be added. It should perhaps check whether PT is enabled or not / what version are the other hypercalls in the agent using and then use the same.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant