vmw_backdoor 0.2.4

A pure-Rust library for VMware host-guest protocol ("VMXh backdoor")
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151

//! FFI bridge to ASM functions.

use log::trace;

extern "C" {
    /// External, low-bandwidth IN.
    fn _vmw_backdoor_lb_in(arg: &LowBandwidthBuf, res: &mut LowBandwidthBuf);
    /// External, low-bandwidth OUT.
    fn _vmw_backdoor_lb_out(arg: &LowBandwidthBuf, res: &mut LowBandwidthBuf);

    /// External, high-bandwidth IN.
    fn _vmw_backdoor_hb_in(arg: &HighBandwidthBuf, res: &mut HighBandwidthBuf);
    /// External, high-bandwidth OUT.
    fn _vmw_backdoor_hb_out(arg: &HighBandwidthBuf, res: &mut HighBandwidthBuf);
}

/// Exchange buffer for low-bandwidth backdoor calls.
#[derive(Default)]
#[repr(C, packed)]
pub(crate) struct LowBandwidthBuf {
    pub(crate) eax: u32,
    pub(crate) ebx: u32,
    pub(crate) ecx: u32,
    pub(crate) edx: u32,
    pub(crate) ebp: u32,
    pub(crate) edi: u32,
    pub(crate) esi: u32,
}

/// Low-bandwidth IN.
pub(crate) fn low_bw_in(arg: &LowBandwidthBuf, res: &mut LowBandwidthBuf) {
    trace!(
        "lb_in, req: A={:x} - B={:x} - C={:x} - D={:x}",
        { arg.eax },
        { arg.ebx },
        { arg.ecx },
        { arg.edx }
    );

    unsafe { _vmw_backdoor_lb_in(arg, res) };

    trace!(
        "lb_in, resp: A={:x} - B={:x} - C={:x} - D={:x}",
        { res.eax },
        { res.ebx },
        { res.ecx },
        { res.edx }
    );
}

pub(crate) fn low_bw_out(arg: &LowBandwidthBuf, res: &mut LowBandwidthBuf) {
    trace!(
        "lb_out, req: {:x} - {:x} - {:x} - {:x}",
        { arg.eax },
        { arg.ebx },
        { arg.ecx },
        { arg.edx }
    );

    unsafe { _vmw_backdoor_lb_out(arg, res) };

    trace!(
        "lb_out, resp: {:x} - {:x} - {:x} - {:x}",
        { res.eax },
        { res.ebx },
        { res.ecx },
        { res.edx }
    );
}

/// Exchange buffer for high-bandwidth backdoor calls.
#[derive(Default)]
#[repr(C, packed)]
pub(crate) struct HighBandwidthBuf {
    pub(crate) eax: u32,
    pub(crate) ebx: u32,
    pub(crate) ecx: u32,
    pub(crate) edx: u32,
    pub(crate) ebp: u32,
    pub(crate) rdi: u64,
    pub(crate) rsi: u64,
}

pub(crate) fn hb_in(arg: &HighBandwidthBuf, res: &mut HighBandwidthBuf) {
    trace!(
        "hb_in, req: {:x} - {:x} - {:x} - {:x} - {:x}",
        { arg.eax },
        { arg.ebx },
        { arg.ecx },
        { arg.edx },
        { arg.rsi }
    );

    unsafe { _vmw_backdoor_hb_in(arg, res) };

    trace!(
        "hb_in, resp: {:x} - {:x} - {:x} - {:x} - {:x}",
        { res.eax },
        { res.ebx },
        { res.ecx },
        { res.edx },
        { res.rsi }
    );
}

pub(crate) fn hb_out(arg: &HighBandwidthBuf, res: &mut HighBandwidthBuf) {
    trace!(
        "hb_out, req: {:x} - {:x} - {:x} - {:x} - {:x}",
        { arg.eax },
        { arg.ebx },
        { arg.ecx },
        { arg.edx },
        { arg.rsi }
    );

    unsafe { _vmw_backdoor_hb_out(arg, res) };

    trace!(
        "hb_out, resp: {:x} - {:x} - {:x} - {:x} - {:x}",
        { res.eax },
        { res.ebx },
        { res.ecx },
        { res.edx },
        { res.rsi }
    );
}

/// Check whether this is running on VMware virtual CPU.
///
/// [Detection]:
///  * CPUID leaf 0x1 (ECX) contains the virtualization bit.
///  * CPUID leaf 0x4000_0000 (EBX+ECX+EDX) contains the vendor label.
///
/// [Detection]: https://kb.vmware.com/s/article/1009458
pub fn is_vmware_cpu() -> bool {
    use core::arch::x86_64::__cpuid;

    let leaf_1 = unsafe { __cpuid(0x0000_0001) };
    if (leaf_1.ecx & 0x8000_0000) != 0 {
        let leaf_vmw = unsafe { __cpuid(0x4000_0000) };
        let mut buf = Vec::with_capacity(12);
        buf.extend_from_slice(&leaf_vmw.ebx.to_le_bytes());
        buf.extend_from_slice(&leaf_vmw.ecx.to_le_bytes());
        buf.extend_from_slice(&leaf_vmw.edx.to_le_bytes());
        if buf.as_slice() == b"VMwareVMware" {
            return true;
        }
    }

    false
}