magic no execute

[a5498828]

I havea problem. I want to return to disable paging, return to real mode, and display a string on screen.

1st step is create address in wich i can drop paging, it physical = virtual.
I run windbg !pte 0, and found out address of pte. PDE is used, but pte i chose isnt (nonpresent). I understand that mwthod im doing is illegal and lead to corruption, but chances are low since this memory contain ivt or other bios code. I do it only for test purposes, so it shouldnt be a problem.

i chose last address handled by 1st pde, wich is 0x3FF000.

mov dword [0xC0000FFC],0x3
invlpg [0x3FF000]
xchg eax,[0x3FF000]

works fine, and OS is NOT crashing. I can do it many times, and it wont crash, meaning memory is fine.


However when i try to execute a code in this memory - immieditly i get freeze, not even a bsod/reboot.

thats a code i used, it use entry point instead of ioctl because i recompile it all the time and its simplier this way. Also i return error so i dont need unload, test is simple. driver load with error - fine, bsod/reset/freeze - not fine.

Code: Select all

entry $
pushad
mov dword [0xC0000FFC],0x3
invlpg [0x3FF000]
mov edi,0x3FF000
mov esi,_data
mov ecx,_data_size/4
cld
rep movsd
mov eax, [0x3FF000]
push eax
push f
call [DbgPrint]
add esp,8
call 0x3FF000

popad
mov eax,-1
retn 8


align 4
_data:


retn


align 4
_data_size = $ - _data

f db '%.8X',0

When i remove call - its working as expected.

Note that PAE is disabled, its just basic 32bit paging with 1024 4byte PTEs. I have tried diffrent pages - exactly same effect. Whats going on? Did i missed something from manuals? Something so basic its not even coming to me now?
Im using virtualbox/vmware for testing, vtx enabled.

[Gigasoft]

The assembler should have given you an error. Which assembler are you using? PE files only support relocations of the form ImageBase+constant. You must rewrite the call as mov eax,0x3ff000, call eax.

[Tosi]

call [DbgPrint]

Unless your assembler uses some strange syntax, this will jump to the DWORD stored at the address of DbgPrint, rather than jumping to DbgPrint itself. Remove the indirection and see if that helps.

[Gigasoft]

DbgPrint refers to an IAT entry, so that's OK.

[a5498828]

its not assembler issue...
i wrote that when i remove:

Code: Select all

call 0x3FF000

change into:

Code: Select all

;call 0x3FF000

my code works...


Whats wrong with it? Segments are ok, obviously code segment can execute, and has a base 0, so it doesnt care about lowest address.
I can write to that page, why can i execute it? PAE is disabled, there is no way it shouldnt work!

call [var] is absolute indeirect call, referring to iat.

call var is relative direct call, address is calculated.

PE files only support relocations of the form ImageBase+constant

What has it do do with my problem?! Relacation is written for every address in absolute form.

Unless your assembler uses some strange syntax, this will jump to the DWORD stored at the address of DbgPrint

call DbgPrint is diffrent than call [DbgPrint]. First one do direct relative call, second indirect absolute.

[Tosi]

I didn't know it was an indirect call, now I understand. Sorry.

[a5498828]

anyone know what mightr cause this strange behaviour?
Maybe some uncommon feature of cpu, maybe its trapping execution access on some range of memory. Although i do not know about anything other than HW bp behaving this way, it would be used in debuggers thus made common.

I belive it has something to do with my vmm, because on vmware problem was caused by vmx driver. Virtualbox doesnt even bsod, so i do not know.

Anyway i dont see how anything might be affected from vmm, because it should work this way:

- guest execution
- special event like exception, interrupt, special instruction
- vmexit
- host execution
- host view and modify data from guest
- vmenter
- guest execution, seemlesly emulated event



I dont think how guest destroying data in lowest 1mb might affect this, especially if read/write WORK FINE!!
I DONT GET IT, EITHER IM TOO STUPID OR I REALLY MISSED SOME CRUCIAL PART OF MANUAL!!!

[Gigasoft]

What has it do do with my problem?! Relacation is written for every address in absolute form.

The operand of an immediate near call or jump is relative to the current EIP. So, the operand must be fixed up by subtracting the difference between the old and new image base. This isn't supported by the PE format. Therefore, you can't use the immediate form of the instruction to call an absolute address.

[a5498828]

The operand of an immediate near call or jump is relative to the current EIP. So, the operand must be fixed up by subtracting the difference between the old and new image base.

if its relative why u think fix is needed

fix is required only by absolute address.


relative = X bytes up, or X bytes down, image base is without concern

absolute = pointed address, include image base



...and this post also do not solv my problem.

[Gigasoft]

The address of the instruction following the "call 0x3ff000" instruction is equal to the image base plus a constant. Subtracting this from 0x3ff000, you get an expression containing the negative image base.

If you load your SYS file up in IDA Pro, select "Manual Load" and change the image base, you'll see what I mean.