HRESULT WhSeMapHostToGuestVirtualMemory(whpx_state *Partition, uintptr_t HostVa,
                                        uintptr_t *GuestVa, size_t Size,
                                        WHSE_MEMORY_ACCESS_FLAGS Flags)
{
    auto size = ALIGN_UP(Size);
    PWHSE_ALLOCATION_NODE existingNode = nullptr;
    auto hresult =
        WhSeFindAllocationNodeByGva(Partition, *GuestVa, &existingNode);
    uintptr_t suggestedGva = 0;
    if (*GuestVa == 0 || existingNode != nullptr) {
        auto hresult = WhSiSuggestVirtualAddress(
            Partition, size, &suggestedGva, Partition->VirtualProcessor.Mode);     
    } else
        suggestedGva = ALIGN(*GuestVa);
    existingNode = nullptr;
    hresult = WhSeFindAllocationNodeByGva(Partition, suggestedGva, &existingNode);
    auto startingGva = ALIGN(suggestedGva);
    auto endingGva = ALIGN_UP(startingGva + size);
    uintptr_t suggestedGpa = 0;
    hresult = WhSiSuggestPhysicalAddress(Partition, size, &suggestedGpa);
    WHSE_ALLOCATION_NODE node{.BlockType =
                                  MEMORY_BLOCK_TYPE::MemoryBlockVirtual,
                              .HostVirtualAddress = HostVa,
                              .GuestPhysicalAddress = suggestedGpa,
                              .GuestVirtualAddress = startingGva,
                              .Size = size};
    hresult = WhSeInsertAllocationTrackingNode(Partition, node);
     // Setup matching PTEs
    for (auto gva = startingGva, page = suggestedGpa; gva < endingGva;
         gva += PAGE_SIZE, page += PAGE_SIZE) {
        hresult = WhSiInsertPageTableEntry(Partition, gva, page);     
    hresult = ::WHvMapGpaRange(
        Partition->partition, reinterpret_cast<PVOID>(HostVa),
        static_cast<WHV_GUEST_PHYSICAL_ADDRESS>(suggestedGpa), size, Flags);    
    *GuestVa = startingGva;
    return hresult;
}
HRESULT WhSiInsertPageTableEntry(whpx_state *Partition,
                                 uintptr_t VirtualAddress,
                                 uintptr_t PhysicalAddress)
{
    // "Explode" the VA into translation indexes
    uint16_t pml4Idx;
    uint16_t pdpIdx;
    uint16_t pdIdx;
    uint16_t ptIdx;
    uint16_t phyOffset;
    auto hresult = WhSiDecomposeVirtualAddress(
        VirtualAddress, &pml4Idx, &pdpIdx, &pdIdx, &ptIdx, &phyOffset);
    // Search entry in PML4
    auto pml4e = reinterpret_cast<PMMPTE_HARDWARE>(
        Partition->MemoryLayout.Pml4HostVa)[pml4Idx];
    if (pml4e.Valid == FALSE) {
        // Shouldn't happen as we initialized all PLM4 entries upfront
          return HRESULT_FROM_WIN32(ERROR_INTERNAL_ERROR);
    }
    // Search entry in Page Directory Pointers
    uintptr_t pdpHva = 0;
    hresult = WhSpLookupHVAFromPFN(Partition, pml4e.PageFrameNumber, &pdpHva);
    auto pdp = reinterpret_cast<PMMPTE_HARDWARE>(pdpHva);
    auto pdpe = pdp[pdpIdx];
    if (pdpe.Valid == FALSE) {
        // Allocate a Page Directory page
        //
        hresult = WhSpInsertPageTableEntry(Partition, pdp, pdpIdx);
        pdpe = pdp[pdpIdx];
    }
    // Search entry in Page Directories
    uintptr_t pdHva = 0;
    hresult = WhSpLookupHVAFromPFN(Partition, pdpe.PageFrameNumber, &pdHva);
    if (FAILED(hresult))
        return hresult;
    auto pd = reinterpret_cast<PMMPTE_HARDWARE>(pdHva);
    auto pde = pd[pdIdx];
    if (pde.Valid == FALSE) {
        // Allocate a Page Table page
         hresult = WhSpInsertPageTableEntry(Partition, pd, pdIdx);
        pde = pd[pdIdx];
    }
    // Add entry in Page Tables
    uintptr_t ptHva = 0;
    hresult = WhSpLookupHVAFromPFN(Partition, pde.PageFrameNumber, &ptHva);
    if (FAILED(hresult))
        return hresult;
    auto pt = reinterpret_cast<PMMPTE_HARDWARE>(ptHva);
    auto ppte = &pt[ptIdx];
    if (ppte->Valid == FALSE) {
        /*PWHSE_ALLOCATION_NODE found = nullptr;
        hresult = WhSeFindAllocationNodeByGpa( Partition, PhysicalAddress,
        &found ); if ( hresult != HRESULT_FROM_WIN32( ERROR_NOT_FOUND ) &&
        FAILED( hresult ) ) return hresult;
        // Create a valid PTE 
        MMPTE_HARDWARE pte{};
        pte.AsUlonglong = 0; // Ensure zeroed
        pte.Valid = 1;       // Intel's Present bit
        pte.Write = 1;       // Intel's Read/Write bit
        pte.Owner = 1; // Intel's User/Supervisor bit, let's say it is a user
                       // accessible frame
        pte.PageFrameNumber =
            (PhysicalAddress / PAGE_SIZE); // Physical address of PDP page
        *ppte = pte;
        WHSE_ALLOCATION_NODE node{.BlockType =
                                      MEMORY_BLOCK_TYPE::MemoryBlockPte,
                                  .HostVirtualAddress = 0,
                                  .GuestPhysicalAddress = PhysicalAddress,
                                  .GuestVirtualAddress = 0,
                                  .Size = PAGE_SIZE};
        hresult = WhSeInsertAllocationTrackingNode(Partition, node);
      }
    return S_OK;
}

先设置cr4的这些位
#define CR4_OSXSAVE_MASK (1U << 18)
#define CR4_OSFXSR_SHIFT 9
#define CR4_OSFXSR_MASK (1U << CR4_OSFXSR_SHIFT)
#define CR4_OSXMMEXCPT_MASK (1U << 10)
 RegisterName = WHvX64RegisterCr4;
    uint64_t cr4val = 0;
    whpx_get_reg(RegisterName, &cr4val);
    cr4val = (cr4val | (1ULL << 5)) & ~(1 << 24);
    cr4val |= CR4_OSXSAVE_MASK;
    cr4val |= CR4_OSFXSR_MASK;
    cr4val |= CR4_OSXMMEXCPT_MASK;
    whpx_set_reg(RegisterName, cr4val);
    //再设置WHvX64RegisterXCr0的这些位
    #define XSTATE_FP_BIT                   0
#define XSTATE_SSE_BIT                  1
#define XSTATE_FP_MASK                  (1ULL << XSTATE_FP_BIT)
#define XSTATE_SSE_MASK                 (1ULL << XSTATE_SSE_BIT)
WHV_REGISTER_VALUE xcr0;
    WHV_REGISTER_NAME xcr0_name = WHvX64RegisterXCr0;
    if (!whpx_has_xsave()) {
        return;
    }
    env->xcr0 |= XSTATE_FP_MASK;
    env->xcr0 |= XSTATE_SSE_MASK;
    /* Only xcr0 is supported by the hypervisor currently */
    xcr0.Reg64 = env->xcr0;
    hr = WHvSetVirtualProcessorRegisters(whpx->partition, whpx->cpu_index,
                                         &xcr0_name, 1, &xcr0);

#define RT_BIT_64(bit) (UINT64_C(1) << (bit))
#define RT_BIT_64_FIND(val, bit) (val & (UINT64_C(1) << (bit)))
#define RT_BIT_64_SLOT(bit) (UINT64_C(1) << (bit << 1))
#define RT_BIT_64_FIND_SLOT(val, bit) (val & (UINT64_C(1) << (bit << 1)))
static void
whpx_apply_hardware_breakpoint(struct whpx_breakpoint_collection *breakpoints,
                               CPUState *cpu, uintptr_t addrskip)
{
  uint8_t hwbpslot = 0;
   uint64_t dr7val=0;
    uint64_t dr7valrw = 0;
  for (int i = 0; i < breakpoints->used; i++) {
        struct whpx_breakpoint *breakpoint = &breakpoints->data[i];
        WhpxBreakpointState state = breakpoint->state;
        if (breakpoint->bptype & 0xff0000) {
            if (state == WHPX_BP_SET_PENDING) {                
                for (uint8_t j = 0; j < 4; j++) {
                    //如果有使用槽置位详见源码
                    if (!RT_BIT_64_FIND_SLOT(dr7val, j)) {                      
                        breakpoint->original_instruction = j;
                        hwbpslot |= RT_BIT_64(breakpoint->original_instruction);                          
                        whpx_set_reg(WHvX64RegisterDr0+j, breakpoint->address);
                                           }
                }
                if (breakpoint->bptype == UC_HOOK_HARDWARE_READ) {
                    dr7valrw |=
                        RT_BIT_64(breakpoint->original_instruction << 2);
                    dr7valrw |=
                        RT_BIT_64((breakpoint->original_instruction << 2) + 1);
                }
                if (breakpoint->bptype == UC_HOOK_HARDWARE_WRITE) {
                    dr7valrw |=
                        RT_BIT_64(breakpoint->original_instruction << 2);
                }
                breakpoint->state = WHPX_BP_SET;
                           }
        }
    }
     dr7val = 0;
    if (hwbpslot) {
        for (uint8_t j = 0; j < 4; j++) {
            if (hwbpslot & RT_BIT_64(j)) {
                dr7val |= (RT_BIT_64_SLOT(j));
            }
        }
        dr7val |= dr7valrw << 16;
        //启用大标志
        dr7val |= RT_BIT_64(8);
    }
    whpx_set_reg(WHvX64RegisterDr7, dr7val);
    }

 
uc_err err = uc_open(UC_ARCH_X86_WHPX, UC_MODE_64, &uc);

# 往期推荐

1、2023 SDC 议题回顾 | 芯片安全和无线电安全底层渗透技术

2、SWPUCTF 2021 新生赛-老鼠走迷宫

3、OWASP 实战分析 level 1

4、【远控木马】银狐组织最新木马样本-分析

5、自研Unidbg trace工具实战ollvm反混淆

6、2023 SDC 议题回顾 | 深入 Android 可信应用漏洞挖掘