RE: [Xen-devel] [PATCH V2] kdd.c: Add support for initial handshake in KD protocol for Win 7, 8 and 10 (64 bit)

[Paul Durrant <xadimgnik@xxxxxxxxx>]

De-htmling...

-----
From: Xen-devel <xen-devel-bounces@xxxxxxxxxxxxxxxxxxxx> On Behalf Of George 
Dunlap
Sent: 09 June 2020 15:42
To: Paul Durrant <pdurrant@xxxxxxxxx>
Cc: Wei Liu <wei.liu2@xxxxxxxxxx>; Tim Deegan <tim@xxxxxxx>; Jenish Rakholiya 
<rjenish@xxxxxxx>; Ian Jackson <ian.jackson@xxxxxxxxxxxxx>; Julian Tuminaro 
<jtuminar@xxxxxxxxxxxxxx>; George Dunlap <george.dunlap@xxxxxxxxxx>; xen-devel 
<xen-devel@xxxxxxxxxxxxxxxxxxxx>; Julian Tuminaro <julian.tuminaro@xxxxxxxxx>
Subject: Re: [Xen-devel] [PATCH V2] kdd.c: Add support for initial handshake in 
KD protocol for Win 7, 8 and 10 (64 bit)



On Fri, Nov 15, 2019 at 1:31 PM Paul Durrant <mailto:pdurrant@xxxxxxxxx> wrote:
On Thu, 14 Nov 2019 at 04:57, Julian Tuminaro 
<mailto:julian.tuminaro@xxxxxxxxx> wrote:
>
> From: Julian Tuminaro and Jenish Rakholiya <mailto:julian.tuminaro@xxxxxxxxx 
> and mailto:rakholiyajenish.07@xxxxxxxxx>
>
> Current implementation of find_os is based on the hard-coded values for
> different Windows version. It uses the value for get the address to
> start looking for DOS header in the given specified range. However, this
> is not scalable to all version of Windows as it will require us to keep
> adding new entries and also due to KASLR, chances of not hitting the PE
> header is significant. We implement a way for 64-bit systems to use IDT
> entry to get a valid exception/interrupt handler and then move back into
> the memory to find the valid DOS header. Since IDT entries are protected
> by PatchGuard, we think our assumption that IDT entries will not be
> corrupted is valid for our purpose. Once we have the image base, we
> search for the DBGKD_GET_VERSION64 structure type in .data section to
> get information required for handshake.
>
> Currently, this is a work in progress feature and current patch only
> supports the handshake and memory read/write on 64-bit systems.
>
> NOTE: This is the Updated version of the previous patch submitted
> NOTE: This has currently been only tested when debugging was not enabled
> on the guest Windows.
>
> Signed-off-by: Jenish Rakholiya <mailto:rjenish@xxxxxxx>
> Signed-off-by: Julian Tuminaro <mailto:jtuminar@xxxxxxxxxxxxxx>

LGTM.

Reviewed-by: Paul Durrant <mailto:paul@xxxxxxx>

Paul, is this something worth adding a line to CHANGELOG about?

 -George
-----

Yes, I'd completely forgotten this had fallen in the 4.14 timeline. I'll send a 
patch.

  Paul