{"action":"closed","issue":{"url":"https://api.github.com/repos/tklengyel/drakvuf/issues/180","repository_url":"https://api.github.com/repos/tklengyel/drakvuf","labels_url":"https://api.github.com/repos/tklengyel/drakvuf/issues/180/labels{/name}","comments_url":"https://api.github.com/repos/tklengyel/drakvuf/issues/180/comments","events_url":"https://api.github.com/repos/tklengyel/drakvuf/issues/180/events","html_url":"https://github.com/tklengyel/drakvuf/issues/180","id":162175393,"number":180,"title":"Bug MEMACCESS event not working on page with BREAKPOINT","user":{"login":"masthoon","id":11626511,"avatar_url":"https://avatars.githubusercontent.com/u/11626511?v=3","gravatar_id":"","url":"https://api.github.com/users/masthoon","html_url":"https://github.com/masthoon","followers_url":"https://api.github.com/users/masthoon/followers","following_url":"https://api.github.com/users/masthoon/following{/other_user}","gists_url":"https://api.github.com/users/masthoon/gists{/gist_id}","starred_url":"https://api.github.com/users/masthoon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/masthoon/subscriptions","organizations_url":"https://api.github.com/users/masthoon/orgs","repos_url":"https://api.github.com/users/masthoon/repos","events_url":"https://api.github.com/users/masthoon/events{/privacy}","received_events_url":"https://api.github.com/users/masthoon/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-06-24T15:46:48Z","updated_at":"2016-06-24T17:35:37Z","closed_at":"2016-06-24T17:35:37Z","body":"When you register a BREAKPOINT then a MEMACCESS on the same page, the MEMACCESS event won't work.\r\n\r\nPOC : \r\n```cpp\r\nthis->trap_test.breakpoint.addr = exAllocatePoolWithTag; // addr_type is ADDR_VA\r\n\t\r\nif ( !drakvuf_add_trap(drakvuf, &this->trap_test) ) {\r\n\tthrow -1;\r\n}\r\n\r\nvmi_get_vcpureg(vmi, &cr3, CR3, 0);\r\nkernel_page = vmi_pagetable_lookup(vmi, cr3, exAllocatePoolWithTag);\r\nassert(kernel_page != NULL);\r\nthis->trap_pagetest.memaccess.gfn = kernel_page >> 12;\r\n\r\nif ( !drakvuf_add_trap(drakvuf, &this->trap_pagetest) ) { // access = VMI_MEMACCESS_X\r\n\tthrow -1;\r\n}\r\nassert(vmi_get_mem_event(vmi, kernel_page) != NULL); // FAIL\r\n```\r\n\r\nDrakvuf uses [vmi_swap_events](https://github.com/tklengyel/drakvuf/blob/master/src/libdrakvuf/vmi.c#L574) to replace old event (Breakpoint guard RW) to new event with according rights (_mem_event.in_access_).\r\nThen, it deletes the old event using [vmi_clear_event](https://github.com/tklengyel/drakvuf/blob/master/src/libdrakvuf/vmi.c#L581).\r\n\r\nI think the problem is the current implementation of _vmi_clear_event_, it calls [_clear_mem_event_](https://github.com/tklengyel/libvmi/blob/drakvuf/libvmi/events.c#L367) who resets page access rights and removes the page from vmi->mem_events.\r\n\r\nSo, both events are removed (from _vmi->mem_events_) and the page right is reset however the breakpoint will still trigger thanks to the interrupt."}}
{"actor":{"display_login":"tklengyel"}}