Re: Writing to arbritary cannonical addresses

[Andrew Cooper <andrew.cooper3@xxxxxxxxxx>]

On 20/04/2021 17:13, Charles Gonçalves wrote:
> Hello Guys,
>
> I'm trying to reproduce old exploit behaviors in a simplistic way: 
> create an hypercall to write a buffer to a specific MFN. 
>
> At first, I thought that updating an l1 page in a valid VA in guest
> kernel space would do the trick. 
> But for addresses outside the  Guest-defined use (0x0000000000000000 -
> 0x00007fffffffffff ) is a no go! 
> I get a page fault with  'reserved bit in page table' warning message.
>
> Now I'm trying to write to the address inside the hypervisor code, but
> not sure how to do it.  
>
> Any comments or tips on this?

So you're looking to add a hypercall to make arbitrary unaudited changes
to arbitrary memory, to simulate past security issues?

If you're seeing "Reserved bit in page table" then you've managed to
corrupt a pagetable entry somehow.  Xen doesn't write any reserved bits
(which it doesn't know how to interpret).

I'm afraid that if you want any further help with this specific failure,
you're going to have to post your changes to Xen somewhere.  pastebin,
or a pointer to a git branch, or whatever, but my divination skills
aren't great...

~Andrew