virtualbox原理构架分析文档格式.docx

1、VMMR3DECL（int） PATMR3InstallPatch（PVM pVM, RTRCPTR pInstrGC, uint64_t flags）Jump back to guest if IF=1, else fault ;BEGINPROC PATMJumpToGuest_IF1PATMJumpToGuest_IF1_Start:mov dword ss:PATM_INTERRUPTFLAG, 0pushf test dword ss:PATM_VMFLAGS, X86_EFL_IF jnz PATMJumpToGuest_IF1_Safe nop ; IF=0 - unsafe,

2、so faultpopf PATM_INTERRUPTFLAG, 1PATM_INT3PATMJumpToGuest_IF1_Safe: IF=1 - we can safely jump back to the original instructionDB 0xE9PATMJumpToGuest_IF1_Jump:DD PATM_JUMPDELTA PATMJumpToGuest_IF1_End:ENDPROC PATMJumpToGuest_IF1 Patch record for call instructionsPATM_JUMPDELTA在补丁代码生成时会被提换为虚拟机中被打补丁的下

3、一条指令以PATM开头的标签都会在补丁代码生成时被替换成相应的地址或变量的值全局定义类:VBoxGlobal.h 1,虚拟化分类:一,基于软件虚拟化:1,解释执行;2,扫描与修补技术3,BT技术qemu,vmware 二,硬件辅助虚拟化,三,类/泛/半虚拟化（xen）Ring0ring3技术;Vm.cpp Gmm- Global Memory Manager, ring-3 request wrappers.Em.cpp :EM - Execution Monitor / Manager. * execution loop （the outer loop being in EMR3Execut

4、eVM（）.* Execute VM.* This function is the main loop of the VM. The emulation thread* calls this function when the VM has been successfully constructed* and were ready for executing the VM.* Returning from this function means that the VM is turned off or* suspended （state already saved） and deconstru

5、ction in next in line.VMMR3DECL（int） EMR3ExecuteVM（PVM pVM, PVMCPU pVCpu）VMEmt.cpp: Virtual Machine, The Emulation Thread.The emulation thread main function, with Virtual CPU ID for debugging.int vmR3EmulationThreadWithId（RTTHREAD ThreadSelf, PUVMCPU pUVCpu, VMCPUID idCpu）PUVM pUVM = pUVCpu-pUVM;Sta

6、rtvm_int main （int argc, char *argv, char *envp）for （int i = 1; i rc=%Rrc, /* forever */-static int emR3RemExecute（PVM pVM, PVMCPU pVCpu, bool *pfFFDone）Vmmr0.cpp -gvmmr0.cpp-SUPDrv.c-vbox-Pci.c-底层（RTSemFastMutexCreate）VMMRC.cpp * VMM - Raw-mode Context.* CSAM - Guest OS Code Scanning and Analysis M

7、anager扫描主函数:* Execute VM.* This function is the main loop of the VM. The emulation threadre ready for executing the VM.VMMR3DECL（int） EMR3ExecuteVM（PVM pVM, PVMCPU pVCpu）.驱动文件执行扫描主函数:int vmR3EmulationThreadWithId（RTTHREAD ThreadSelf,PUVMCPU pUVCpu,VMCPUID idCpu）PUVM pUVM = pUVCpu-rc = EMR3ExecuteVM（

8、pVM, pVCpu）;EMR3ExecuteVM（）-rc=%Rrc,enmVMState=%dn, rc, pVM-enmVMState）;if （EMGetState（pVCpu） = EMSTATE_GURU_MEDITATION）vmR3SetGuruMeditation（pVM）; /* forever */-EMR3ExecuteVM-vmR3EmulationThreadWithId vmR3EmulationThread-RTThreadCreateF-vmR3CreateUVM-VMR3Create-VMPowerUpThread-RTThreadCreate-Truste

9、dMain-main（） （main.cpp * VBox frontends: Qt GUI （VirtualBox）:* The main（） function ）另外还有: */int main（int argc, char *argv）（vboxbfe.cpp）return TrustedMain（argc, argv, NULL）;int main（int argc, char *argv, char *envp）（vboxheadless.cpp）/ initialize VBox Runtimeint rc = RTR3InitAndSUPLib（）; return Truste

10、dMain（argc, argv, envp）;* Start the emulation threads for all VMCPUs.for （i = 0; cCpus; i+）rc =RTThreadCreateF（&pUVM-aCpusi.vm.s.ThreadEMT, vmR3EmulationThread, &aCpusi,_1M,RTTHREADTYPE_EMULATION, RTTHREADFLAGS_WAITABLE,cCpus 1?EMT-%u : EMT, i）;break;* Executes one （or perhaps a few more） instructio

11、n（s）.* returns VBox status code suitable for EM.*/static int emR3ExecuteInstructionWorker（PVM pVM,PVMCPU pVCpu,int rcGC,const char *pszPrefix）patch过程:CPUMR3RawEnter（pVCpu,NULL）;-PATMRawEnter（pVM,pCtxCore）;-VMMR3DECL（int） PATMR3InstallPatch（PVM pVM, RTRCPTR pInstrGC, uint64_t flags）- static int patmD

12、uplicateFunction（PVM pVM,RTRCPTR pInstrGC,PPATMPATCHREC pPatchRec,PPATMP2GLOOKUPREC pCacheRec）-int patmPatchGenSetPIF（PVM pVM, PPATCHINFO pPatch,RTRCPTR pInstrGC）-size = patmPatchGenCode（pVM, pPatch, pPB, &PATMSetPIFRecord,0, false）; -PATMSetPIFRecord - GLOBALNAME PATMSetPIFRecord RTCCPTR_DEF PATMSe

13、tPIF_Start DD 0DD PATMSetPIF_End - PATMSetPIF_Start DD 1DD PATM_INTERRUPTFLAG DD 0ffffhint main（int argc, char *argv）return TrustedMain（argc, argv, NULL）; - DECLEXPORT（int） TrustedMain （int argc, char *argv, char *envp） -DECLCALLBACK（int） VMPowerUpThread（RTTHREAD Thread, void *pvUser）-VMMR3DECL（int）

14、VMR3Create（uint32_t cCpus,PCVMM2USERMETHODS .）static int vmR3CreateUVM（uint32_t cCpus,PCVMM2USERMETHODS pVmm2UserMethods, PUVM *ppUVM） -DECLCALLBACK（int） vmR3EmulationThread（RTTHREAD ThreadSelf, void *pvArgs）-int vmR3EmulationThreadWithId（RTTHREAD ThreadSelf,PUVMCPU pUVCpu,VMCPUID idCpu） * execution

15、 loop （the outer loop being in EMR3ExecuteVM（）. -int emR3ForcedActions（PVM pVM, PVMCPU pVCpu, int rc）-VMMR3DECL（int）TRPMR3InjectEvent（PVM pVM,PVMCPU pVCpu,TRPMEVENT enmEvent） -VMMR3DECL（int） CSAMR3CheckGates（PVM pVM, uint32_t iGate, uint32_t cGates）-static int CSAMR3AnalyseCallback（PVM pVM,DISCPUSTA

16、TE *pCpu,RCPTRTYPE（uint8_t *） pInstrGC, RCPTRTYPE（uint8_t *） pCurInstrGC,PCSAMP2GLOOKUPREC pCacheRec,void *pUserData） -VMMR3DECL（int） PATMR3InstallPatch（PVM pVM, RTRCPTR pInstrGC, uint64_t flags）-VMMR3DECL（int）PATMR3PatchBlock（PVM pVM,RTRCPTR pInstrGC,R3PTRTYPE（uint8_t *） pInstrHC,uint32_t uOpcode,u

17、int32_t uOpSize,PPATMPATCHREC pPatchRec） -PATMClearInhibitIRQContIF0Record,0, false, &callInfo）; -GLOBALNAME PATMClearInhibitIRQContIF0Record RTCCPTR_DEF PATMClearInhibitIRQContIF0_Start DD PATMClearInhibitIRQContIF0_End - PATMClearInhibitIRQContIF0_Start DD 11DD PATM_INHIBITIRQADDR DD PATM_VMFLAGS DD PATM_VM_FORCEDACTIONS DD PATM_TEMP_EAX DD PATM_TEMP_ECX DD PATM_TEMP_EDI DD PATM_TEMP_RESTORE_FLAGS DD PATM_PENDINGACTION DD PATM_NEXTINSTRADDR Privilege 0patch0源代码二进制SCANvboxdrvPrivilege 1patch1 patchn dpPrivilege patchOs-imageVMMKERNEL