#
#
#

from pykd import *
import sys


def vmcsGetQword( vmcs, offset ):

    a = 0

    for i in range( 0, 8 ):	
        a = a * 0x100 + vmcs[ offset + 7 - i ]

    return a				


def vmcsGetDword( vmcs, offset ):

    a = 0

    for i in range( 0, 4 ):	
        a = a * 0x100 + vmcs[ offset + 3 - i ]

    return a				


def vmcsGetWord( vmcs, offset ):

    return vmcs[ offset + 1] * 0x100 + vmcs[ offset ]



def vmcsGetExitReason( reason ):

    vmexits = { \
        0 : "Exception or non-maskable interrupt", 
        1 : "External interrupt",
        2 : "Triple fault",
        3 : "INIT signal",
        4 : "Start-up IPI (SIPI)",
        5 : "I/O system-management interrupt (SMI)",
        6 : "Other SMI",
        7 : "Interrupt window",
        8 : "NMI window",
        9 : "Task switch",
       10 : "CPUID",
       11 : "GETSEC", 
       12 : "HLT",
       13 : "INVD", 
       14 : "INVLPG",
       15 : "RDPMC",
       16 : "RDTSC",
       17 : "RSM",
       18 : "VMCALL",
       19 : "VMCLEAR",
       20 : "VMLAUNCH",
       21 : "VMPTRLD",
       22 : "VMPTRST",
       23 : "VMREAD",
       24 : "VMRESUME",
       25 : "VMWRITE",
       26 : "VMXOFF",
       27 : "VMXON",
       28 : "Control-register accesses",
       29 : "MOV DR",
       30 : "I/O instruction",
       31 : "RDMSR",
       32 : "WRMSR",
       33 : "VM-entry failure due to invalid guest state",
       34 : "VM-entry failure due to MSR loading",
       36 : "MWAIT",
       37 : "Monitor trap flag",
       39 : "MONITOR",
       40 : "PAUSE",
       41 : "VM-entry failure due to machine check",
       43 : "TPR below threshold"
    }

    if reason in vmexits:
        return vmexits[ reason & 0x7FFFFFFF ]
    else:
        return "unknown vmexit reason"
    
                                                                                 

def vmcsPrint( addr ):

    dprintln("======================")	

    dprintln( "VMCS  Start: %#x" % addr )

    vmcs = loadBytes( addr, 0x1000, True )

    revid = vmcsGetQword( vmcs, 0 )

    dprintln( "RevId: %x" % revid )

    dprintln("======================")
    dprintln( "<u>GUEST STATE</u>", True )

    dprintln( "VMCS link pointer: %x" % vmcsGetQword( vmcs, 0x20 ) )

    dprintln( "RIP: %x" % vmcsGetQword( vmcs, 0x338 ) )
    dprintln( "RSP: %x" % vmcsGetQword( vmcs, 0x330 ) )
    dprintln( "RFLAGS: %x" % vmcsGetQword( vmcs, 0x340 ) )


    dprintln( "CR0: %x" % vmcsGetQword( vmcs, 0x300 ) )
    dprintln( "CR3: %x" % vmcsGetQword( vmcs, 0x308 ) )
    dprintln( "CR4: %x" % vmcsGetQword( vmcs, 0x310 ) )
    dprintln( "DR7: %x" % vmcsGetQword( vmcs, 0x328 ) )

    dprintln( "ES selector: %x  base: %x  limit: %x  access: %x" % ( vmcsGetWord( vmcs, 0x100 ), vmcsGetQword( vmcs, 0x108 ), vmcsGetDword( vmcs, 0x110 ), vmcsGetDword( vmcs, 0x114 ) ) )
    dprintln( "CS selector: %x  base: %x  limit: %x  access: %x" % ( vmcsGetWord( vmcs, 0x118 ), vmcsGetQword( vmcs, 0x120 ), vmcsGetDword( vmcs, 0x128 ), vmcsGetDword( vmcs, 0x12c ) ) )
    dprintln( "SS selector: %x  base: %x  limit: %x  access: %x" % ( vmcsGetWord( vmcs, 0x130 ), vmcsGetQword( vmcs, 0x138 ), vmcsGetDword( vmcs, 0x140 ), vmcsGetDword( vmcs, 0x144 ) ) )
    dprintln( "DS selector: %x  base: %x  limit: %x  access: %x" % ( vmcsGetWord( vmcs, 0x148 ), vmcsGetQword( vmcs, 0x150 ), vmcsGetDword( vmcs, 0x158 ), vmcsGetDword( vmcs, 0x15c ) ) )
    dprintln( "FS selector: %x  base: %x  limit: %x  access: %x" % ( vmcsGetWord( vmcs, 0x160 ), vmcsGetQword( vmcs, 0x168 ), vmcsGetDword( vmcs, 0x170 ), vmcsGetDword( vmcs, 0x174 ) ) )
    dprintln( "GS selector: %x  base: %x  limit: %x  access: %x" % ( vmcsGetWord( vmcs, 0x178 ), vmcsGetQword( vmcs, 0x180 ), vmcsGetDword( vmcs, 0x188 ), vmcsGetDword( vmcs, 0x18c ) ) )
    dprintln( "LDTR selector: %x  base: %x  limit: %x  access: %x" % ( vmcsGetWord( vmcs, 0x190 ), vmcsGetQword( vmcs, 0x198 ), vmcsGetDword( vmcs, 0x1a0 ), vmcsGetDword( vmcs, 0x1a4 ) ) )    
    dprintln( "TR selector: %x  base: %x  limit: %x  access: %x" % ( vmcsGetWord( vmcs, 0x1a8 ), vmcsGetQword( vmcs, 0x1b0 ), vmcsGetDword( vmcs, 0x1b8 ), vmcsGetDword( vmcs, 0x1bc ) ) )

    dprintln( "GDTR base: %x  limit: %x" % ( vmcsGetQword( vmcs, 0x318 ), vmcsGetWord( vmcs, 0x240 ) ) )
    dprintln( "IDTR base: %x  limit: %x" % ( vmcsGetQword( vmcs, 0x320 ), vmcsGetWord( vmcs, 0x248 ) ) )

    dprintln("======================")
    dprintln( "<u>READ ONLY</u>", True )

    dprintln( "VM-instruction error: %x" % vmcsGetQword( vmcs, 0x200 ) )
    dprintln( "VM-exit reason: %d ( " % vmcsGetQword( vmcs, 0x208 )  + vmcsGetExitReason( vmcsGetQword( vmcs, 0x208 ) ) + " )" )
    dprintln( "VM-exit interruption information: %x" % vmcsGetQword( vmcs, 0x210 ) )
    dprintln( "VM-exit interruption error code: %x" % vmcsGetQword( vmcs, 0x218 ) )
    dprintln( "IDT-vectoring information field: %x" % vmcsGetQword( vmcs, 0x220 ) )
    dprintln( "IDT-vectoring error code: %x" % vmcsGetQword( vmcs, 0x228 ) )
    dprintln( "VM-exit instruction length: %x" % vmcsGetQword( vmcs, 0x230 ) )
    dprintln( "VM-exit instruction information: %x" % vmcsGetQword( vmcs, 0x238 ) )


    dprintln("======================")
    dprintln( "<u>HOST STATE</u>", True )
    dprintln( "RIP: %x" % vmcsGetQword( vmcs, 0x3D8 ) )
    dprintln( "RIP: %x" % vmcsGetQword( vmcs, 0x3D0 ) )

    dprintln( "CR0: %x" % vmcsGetQword( vmcs, 0x380 ) )
    dprintln( "CR3: %x" % vmcsGetQword( vmcs, 0x388 ) )
    dprintln( "CR4: %x" % vmcsGetQword( vmcs, 0x390 ) )

    dprintln( "ES selector: %x" % vmcsGetWord( vmcs, 0x1c0 ) )
    dprintln( "CS selector: %x" % vmcsGetWord( vmcs, 0x1c8 ) )
    dprintln( "DS selector: %x" % vmcsGetWord( vmcs, 0x1d0 ) )
    dprintln( "DS selector: %x" % vmcsGetWord( vmcs, 0x1d8 ) )
    dprintln( "FS selector: %x  base: %x" % ( vmcsGetWord( vmcs, 0x1e0 ), vmcsGetQword( vmcs, 0x398 ) ) )
    dprintln( "GS selector: %x  base: %x" % ( vmcsGetWord( vmcs, 0x1e8 ), vmcsGetQword( vmcs, 0x3a0 ) ) )
    dprintln( "TR selector: %x  base: %x" % ( vmcsGetWord( vmcs, 0x1f0 ), vmcsGetQword( vmcs, 0x3a8 ) ) )

    dprintln( "GDTR base: %x" %  vmcsGetQword( vmcs, 0x3b0 ) )
    dprintln( "IDTR base: %x" %  vmcsGetQword( vmcs, 0x3b8 ) )



    dprintln("======================")
    dprintln( "<u>CONTROL STATE</u>", True )
    dprintln( "Pin-based VM-execution controls: %x" % vmcsGetDword( vmcs, 0x40 ) )
    dprintln( "Primary processor-based VM-execution controls: %#x" % vmcsGetDword( vmcs, 0x48 ) )
    dprintln( "Exception bitmap: %x" % vmcsGetDword( vmcs, 0x50 ) )
    dprintln( "Page-fault error-code mask: %x" % vmcsGetDword( vmcs, 0x58 ) )
    dprintln( "Page-fault error-code match: %x" % vmcsGetDword( vmcs, 0x60 ) )
    dprintln( "VM-exit controls: %x" % vmcsGetDword( vmcs, 0x70 ) )
    dprintln( "VM-entry controls: %x" % vmcsGetDword( vmcs, 0x88 ) )

    dprintln( "CR0 guest/host mask: %x" % vmcsGetQword( vmcs, 0x278 ) )
    dprintln( "CR4 guest/host mask: %x" % vmcsGetQword( vmcs, 0x280 ) )
    dprintln( "CR0 read shadow: %x" % vmcsGetQword( vmcs, 0x288 ) )
    dprintln( "CR4 read shadow: %x" % vmcsGetQword( vmcs, 0x290 ) )



    dprintln("======================")

    	


if __name__ == "__main__":

   if not isWindbgExt():
       dprintln( "script is launch out of windbg" )
       quit( 0 )

   if len( sys.argv ) <= 1:
       dprintln( "usage: !py vmcs <addr>" )
   else:
       vmcsPrint( int( sys.argv[1], 16 ) )