Microsoft Virtual PC 2007 SP1 (VPC)
http://www.microsoft.com/en-us/download/details.aspx?id=24439
HDD:
http://www.microsoft.com/en-us/download/confirmation.aspx?id=11575
http://modern.ie
VPC uses driver “C:\WINDOWS\system32\drivers\VMM.sys”.
Driver has such bytes (address on your PC may differ, but you can find driver address by “lm t” command. In my case it is f7fa0000. Then search by “s f7fa0000 L34000 2E 80 38 0F”):
f7fcd12e 2e 80 38 0f 0f 85 88 01 00 00 2e 80 78 01 c7 75 …8…x…u
When I use command “ba r1 f7fcd12e” in windbg, start VPC, start guest OS, breakpoint is not triggered. But if I change driver data in windbg memory window like this:
f7fcd12e cc 80 38 0f 0f 85 88 01 00 00 2e 80 78 01 c7 75 …8…x…u
then when I start VPC, start guest OS, VPC gives me message
Virtual PC
An internal vitrual machine error (3) has occured.
The virtual machine will reset now.
If I change data like this
f7fcd12e eb fe 38 0f 0f 85 88 01 00 00 2e 80 78 01 c7 75 …8…x…u
then when I start VPC, start guest OS, VPC freezes (CPU usage is 100%). So processor steps over these opcodes. But why breakpoint is not triggered?
Also memory changes gives results in real time (e.g. after VPC start and before guest OS run you can change driver and see different behaviour each guest OS run). So it seems there is no code that copy these opcodes and execute them from some other place during driver loading.
Actually this code
0002BF2E 2E 80 38 0F 0F 85 88 01 00 00 2E 80 78 01 C7 75 .?8??..?x?u
is in “.data” section of VMM.sys. This section has not execute access. So how does driver execute code? If it read piece of code from “.data” section, why is not ba-breakpoint triggered?
000000F8 50 45 00 00>ASCII “PE” ; PE signature (PE)
000000FC 4C01 DW 014C ; Machine = IMAGE_FILE_MACHINE_I386
000000FE 0700 DW 0007 ; NumberOfSections = 7
00000100 1785B147 DD 47B18517 ; TimeDateStamp = 47B18517
00000104 00000000 DD 00000000 ; PointerToSymbolTable = 0
00000108 00000000 DD 00000000 ; NumberOfSymbols = 0
0000010C E000 DW 00E0 ; SizeOfOptionalHeader = E0 (224.)
0000010E 0201 DW 0102 ; Characteristics = EXECUTABLE_IMAGE|32BIT_MACHINE
00000110 0B01 DW 010B ; MagicNumber = PE32
00000112 08 DB 08 ; MajorLinkerVersion = 8
00000113 00 DB 00 ; MinorLinkerVersion = 0
00000114 00760200 DD 00027600 ; SizeOfCode = 27600 (161280.)
00000118 00060100 DD 00010600 ; SizeOfInitializedData = 10600 (67072.)
0000011C 00000000 DD 00000000 ; SizeOfUninitializedData = 0
00000120 00500300 DD 00035000 ; AddressOfEntryPoint = 35000
00000124 00100000 DD 00001000 ; BaseOfCode = 1000
00000128 00700200 DD 00027000 ; BaseOfData = 27000
0000012C 00000100 DD 00010000 ; ImageBase = 10000
00000130 00100000 DD 00001000 ; SectionAlignment = 1000
00000134 00020000 DD 00000200 ; FileAlignment = 200
00000138 0400 DW 0004 ; MajorOSVersion = 4
0000013A 0000 DW 0000 ; MinorOSVersion = 0
0000013C 0000 DW 0000 ; MajorImageVersion = 0
0000013E 0000 DW 0000 ; MinorImageVersion = 0
00000140 0400 DW 0004 ; MajorSubsystemVersion = 4
00000142 0000 DW 0000 ; MinorSubsystemVersion = 0
00000144 00000000 DD 00000000 ; Reserved
00000148 00B00300 DD 0003B000 ; SizeOfImage = 3B000 (241664.)
0000014C 00040000 DD 00000400 ; SizeOfHeaders = 400 (1024.)
00000150 EF940300 DD 000394EF ; CheckSum = 394EF
00000154 0100 DW 0001 ; Subsystem = IMAGE_SUBSYSTEM_NATIVE
00000156 0000 DW 0000 ; DLLCharacteristics = 0
00000158 00001000 DD 00100000 ; SizeOfStackReserve = 100000 (1048576.)
0000015C 00100000 DD 00001000 ; SizeOfStackCommit = 1000 (4096.)
00000160 00001000 DD 00100000 ; SizeOfHeapReserve = 100000 (1048576.)
00000164 00100000 DD 00001000 ; SizeOfHeapCommit = 1000 (4096.)
00000168 00000000 DD 00000000 ; LoaderFlags = 0
0000016C 10000000 DD 00000010 ; NumberOfRvaAndSizes = 10 (16.)
00000170 00000000 DD 00000000 ; Export Table address = 0
00000174 00000000 DD 00000000 ; Export Table size = 0
00000178 38500300 DD 00035038 ; Import Table address = 35038
0000017C 3C000000 DD 0000003C ; Import Table size = 3C (60.)
00000180 00600300 DD 00036000 ; Resource Table address = 36000
00000184 702E0000 DD 00002E70 ; Resource Table size = 2E70 (11888.)
00000188 00000000 DD 00000000 ; Exception Table address = 0
0000018C 00000000 DD 00000000 ; Exception Table size = 0
00000190 00680300 DD 00036800 ; Certificate File pointer = 36800
00000194 18240000 DD 00002418 ; Certificate Table size = 2418 (9240.)
00000198 00900300 DD 00039000 ; Relocation Table address = 39000
0000019C 3C140000 DD 0000143C ; Relocation Table size = 143C (5180.)
000001A0 60710200 DD 00027160 ; Debug Data address = 27160
000001A4 1C000000 DD 0000001C ; Debug Data size = 1C (28.)
000001A8 00000000 DD 00000000 ; Architecture Data address = 0
000001AC 00000000 DD 00000000 ; Architecture Data size = 0
000001B0 00000000 DD 00000000 ; Global Ptr address = 0
000001B4 00000000 DD 00000000 ; Must be 0
000001B8 00000000 DD 00000000 ; TLS Table address = 0
000001BC 00000000 DD 00000000 ; TLS Table size = 0
000001C0 B8860200 DD 000286B8 ; Load Config Table address = 286B8
000001C4 40000000 DD 00000040 ; Load Config Table size = 40 (64.)
000001C8 00000000 DD 00000000 ; Bound Import Table address = 0
000001CC 00000000 DD 00000000 ; Bound Import Table size = 0
000001D0 00700200 DD 00027000 ; Import Address Table address = 27000
000001D4 60010000 DD 00000160 ; Import Address Table size = 160 (352.)
000001D8 00000000 DD 00000000 ; Delay Import Descriptor address = 0
000001DC 00000000 DD 00000000 ; Delay Import Descriptor size = 0
000001E0 00000000 DD 00000000 ; COM+ Runtime Header address = 0
000001E4 00000000 DD 00000000 ; Import Address Table size = 0
000001E8 00000000 DD 00000000 ; Reserved
000001EC 00000000 DD 00000000 ; Reserved
000001F0 2E 74 65 78>ASCII “.text” ; SECTION
000001F8 785E0200 DD 00025E78 ; VirtualSize = 25E78 (155256.)
000001FC 00100000 DD 00001000 ; VirtualAddress = 1000
00000200 00600200 DD 00026000 ; SizeOfRawData = 26000 (155648.)
00000204 00040000 DD 00000400 ; PointerToRawData = 400
00000208 00000000 DD 00000000 ; PointerToRelocations = 0
0000020C 00000000 DD 00000000 ; PointerToLineNumbers = 0
00000210 0000 DW 0000 ; NumberOfRelocations = 0
00000212 0000 DW 0000 ; NumberOfLineNumbers = 0
00000214 20000068 DD 68000020 ; Characteristics = CODE|NOT_PAGED|EXECUTE|READ
00000218 2E 72 64 61>ASCII “.rdata” ; SECTION
00000220 8C190000 DD 0000198C ; VirtualSize = 198C (6540.)
00000224 00700200 DD 00027000 ; VirtualAddress = 27000
00000228 001A0000 DD 00001A00 ; SizeOfRawData = 1A00 (6656.)
0000022C 00640200 DD 00026400 ; PointerToRawData = 26400
00000230 00000000 DD 00000000 ; PointerToRelocations = 0
00000234 00000000 DD 00000000 ; PointerToLineNumbers = 0
00000238 0000 DW 0000 ; NumberOfRelocations = 0
0000023A 0000 DW 0000 ; NumberOfLineNumbers = 0
0000023C 40000048 DD 48000040 ; Characteristics = INITIALIZED_DATA|NOT_PAGED|READ
00000240 2E 64 61 74>ASCII “.data” ; SECTION
00000248 F0A30000 DD 0000A3F0 ; VirtualSize = A3F0 (41968.)
0000024C 00900200 DD 00029000 ; VirtualAddress = 29000
00000250 008C0000 DD 00008C00 ; SizeOfRawData = 8C00 (35840.)
00000254 007E0200 DD 00027E00 ; PointerToRawData = 27E00
00000258 00000000 DD 00000000 ; PointerToRelocations = 0
0000025C 00000000 DD 00000000 ; PointerToLineNumbers = 0
00000260 0000 DW 0000 ; NumberOfRelocations = 0
00000262 0000 DW 0000 ; NumberOfLineNumbers = 0
00000264 400000C8 DD C8000040 ; Characteristics = INITIALIZED_DATA|NOT_PAGED|READ|WRITE
00000268 50 41 47 45>ASCII “PAGE” ; SECTION
00000270 C40B0000 DD 00000BC4 ; VirtualSize = BC4 (3012.)
00000274 00400300 DD 00034000 ; VirtualAddress = 34000
00000278 000C0000 DD 00000C00 ; SizeOfRawData = C00 (3072.)
0000027C 000A0300 DD 00030A00 ; PointerToRawData = 30A00
00000280 00000000 DD 00000000 ; PointerToRelocations = 0
00000284 00000000 DD 00000000 ; PointerToLineNumbers = 0
00000288 0000 DW 0000 ; NumberOfRelocations = 0
0000028A 0000 DW 0000 ; NumberOfLineNumbers = 0
0000028C 20000060 DD 60000020 ; Characteristics = CODE|EXECUTE|READ
00000290 49 4E 49 54>ASCII “INIT” ; SECTION
00000298 CC080000 DD 000008CC ; VirtualSize = 8CC (2252.)
0000029C 00500300 DD 00035000 ; VirtualAddress = 35000
000002A0 000A0000 DD 00000A00 ; SizeOfRawData = A00 (2560.)
000002A4 00160300 DD 00031600 ; PointerToRawData = 31600
000002A8 00000000 DD 00000000 ; PointerToRelocations = 0
000002AC 00000000 DD 00000000 ; PointerToLineNumbers = 0
000002B0 0000 DW 0000 ; NumberOfRelocations = 0
000002B2 0000 DW 0000 ; NumberOfLineNumbers = 0
000002B4 200000E2 DD E2000020 ; Characteristics = CODE|DISCARDABLE|EXECUTE|READ|WRITE
000002B8 2E 72 73 72>ASCII “.rsrc” ; SECTION
000002C0 702E0000 DD 00002E70 ; VirtualSize = 2E70 (11888.)
000002C4 00600300 DD 00036000 ; VirtualAddress = 36000
000002C8 00300000 DD 00003000 ; SizeOfRawData = 3000 (12288.)
000002CC 00200300 DD 00032000 ; PointerToRawData = 32000
000002D0 00000000 DD 00000000 ; PointerToRelocations = 0
000002D4 00000000 DD 00000000 ; PointerToLineNumbers = 0
000002D8 0000 DW 0000 ; NumberOfRelocations = 0
000002DA 0000 DW 0000 ; NumberOfLineNumbers = 0
000002DC 40000042 DD 42000040 ; Characteristics = INITIALIZED_DATA|DISCARDABLE|READ
000002E0 2E 72 65 6C>ASCII “.reloc” ; SECTION
000002E8 7A160000 DD 0000167A ; VirtualSize = 167A (5754.)
000002EC 00900300 DD 00039000 ; VirtualAddress = 39000
000002F0 00180000 DD 00001800 ; SizeOfRawData = 1800 (6144.)
000002F4 00500300 DD 00035000 ; PointerToRawData = 35000
000002F8 00000000 DD 00000000 ; PointerToRelocations = 0
000002FC 00000000 DD 00000000 ; PointerToLineNumbers = 0
00000300 0000 DW 0000 ; NumberOfRelocations = 0
00000302 0000 DW 0000 ; NumberOfLineNumbers = 0
00000304 40000042 DD 42000040 ; Characteristics = INITIALIZED_DATA|DISCARDABLE|READ