diff --git a/DBKKernel/IOPLDispatcher.c b/DBKKernel/IOPLDispatcher.c index 7ed8cde6..9135f21f 100644 --- a/DBKKernel/IOPLDispatcher.c +++ b/DBKKernel/IOPLDispatcher.c @@ -159,7 +159,7 @@ NTSTATUS DispatchIoctl(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp) else IoControlCode=Irp->Flags; - DbgPrint("DispatchIoctl. IoControlCode=%x\n", IoControlCode); + //DbgPrint("DispatchIoctl. IoControlCode=%x\n", IoControlCode); @@ -520,7 +520,7 @@ NTSTATUS DispatchIoctl(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp) if (ntStatus==STATUS_SUCCESS) { offset=(UINT_PTR)(pinp->startaddress)-(UINT_PTR)viewBase.QuadPart; - RtlCopyMemory(&memoryview[offset],&pinp2[8],toread); + RtlCopyMemory(&memoryview[offset],&pinp2[16],toread); ZwUnmapViewOfSection( NtCurrentProcess(), //processhandle @@ -1373,7 +1373,7 @@ NTSTATUS DispatchIoctl(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp) DbgPrint("IOCTL_CE_ULTIMAP:\n"); - DbgPrint("ultimap(%llx, %llx, %d):\n", inp->targetCR3, inp->dbgctl, inp->dsareasize); + DbgPrint("ultimap(%I64x, %I64x, %d):\n", (UINT64)inp->targetCR3, (UINT64)inp->dbgctl, inp->dsareasize); if (inp->savetofile) DbgPrint("filename=%S\n", &inp->filename[0]); diff --git a/DBKKernel/interruptHook.c b/DBKKernel/interruptHook.c index ddbf21c8..5f1c2669 100644 --- a/DBKKernel/interruptHook.c +++ b/DBKKernel/interruptHook.c @@ -189,7 +189,7 @@ int inthook_HookInterrupt(unsigned char intnr, int newCS, ULONG_PTR newEIP, PJUM InterruptHook[intnr].dbvmInterruptEmulation=0; - DbgPrint("int %d will now go to %x:%x\n",intnr, newCS, newEIP); + DbgPrint("int %d will now go to %x:%p\n",intnr, newCS, newEIP); } diff --git a/DBKKernel/ultimap.c b/DBKKernel/ultimap.c index 482252d0..abfdc945 100644 --- a/DBKKernel/ultimap.c +++ b/DBKKernel/ultimap.c @@ -15,9 +15,9 @@ JUMPBACK perfmonJumpBackLocation; #ifdef AMD64 -PAPIC APIC_BASE=(PAPIC)0xfffffffffffe0000; +volatile PAPIC APIC_BASE=(PAPIC)0xfffffffffffe0000; #else -PAPIC APIC_BASE=(PAPIC)0xfffe0000; +volatile PAPIC APIC_BASE=(PAPIC)0xfffe0000; #endif BOOL SaveToFile; //If set it will save the results to a file instead of sending a message to the usermode app that is watching the data @@ -156,6 +156,9 @@ int perfmon_interrupt_centry(void) int causedbyme=(DS_AREA[cpunr()]->BTS_IndexBaseAddress>=DS_AREA[cpunr()]->BTS_InterruptThresholdAddress); UINT_PTR blocksize; + DbgPrint("perfmon_interrupt_centry\n", cpunr()); + + if (causedbyme) { //undo the system flags that got set by this interrupt @@ -401,12 +404,13 @@ Call this for each processor DS_AREA_SIZE=params->DS_AREA_SIZE; - DbgPrint("ultimap(%llx, %llx, %d)", params->cr3, params->dbgctl_msr, params->DS_AREA_SIZE); + DbgPrint("ultimap(%I64x, %I64x, %d)", (UINT64)params->cr3, (UINT64)params->dbgctl_msr, params->DS_AREA_SIZE); DS_AREA[cpunr()]=NULL; if (params->DS_AREA_SIZE) { DS_AREA[cpunr()]=ExAllocatePool(NonPagedPool, params->DS_AREA_SIZE); + RtlZeroMemory(DS_AREA[cpunr()], params->DS_AREA_SIZE); DbgPrint("DS_AREA[%d]=%p", cpunr(), DS_AREA[cpunr()]); @@ -432,8 +436,14 @@ Call this for each processor int perfmonIVT=(APIC_BASE->LVT_Performance_Monitor.a) & 0xff; + DbgPrint("APIC_BASE->LVT_Performance_Monitor.a=%x\n", APIC_BASE->LVT_Performance_Monitor.a); + if (perfmonIVT==0) //if not setup at all then set it up now + perfmonIVT=0xfe; + APIC_BASE->LVT_Performance_Monitor.a=perfmonIVT; //clear mask flag if it was set + DbgPrint("APIC_BASE->LVT_Performance_Monitor.a=%x\n", APIC_BASE->LVT_Performance_Monitor.a); + if (inthook_HookInterrupt((unsigned char)perfmonIVT, getCS(), (ULONG_PTR)perfmon_interrupt, &perfmonJumpBackLocation)) @@ -494,6 +504,10 @@ NTSTATUS ultimap(UINT64 cr3, UINT64 dbgctl_msr, int DS_AREA_SIZE, BOOL savetofil DataBlock=ExAllocatePool(NonPagedPool, sizeof(_DataBlock) * MaxDataBlocks); DataReadyPointerList=ExAllocatePool(NonPagedPool, sizeof(PVOID) * MaxDataBlocks); + RtlZeroMemory(DataBlock, sizeof(_DataBlock) * MaxDataBlocks); + RtlZeroMemory(DataReadyPointerList, sizeof(PVOID) * MaxDataBlocks); + + if ((DataBlock) && (DataReadyPointerList)) { diff --git a/DBKKernel/ultimap.h b/DBKKernel/ultimap.h index 8185f810..3a9fa528 100644 --- a/DBKKernel/ultimap.h +++ b/DBKKernel/ultimap.h @@ -88,7 +88,7 @@ typedef struct { DWORD d; } UINT128; -typedef struct { +typedef volatile struct { UINT128 Reserved1; UINT128 Reserved2; UINT128 LocalAPIC_ID;