WeBreakVM

FilterCallback.c

// We Break VM (ring3)
NTSTATUS FilterMachineCallbacks( )
{
	PTP_CALLBACK_INSTANCE CallInst;
	PULONG_PTR PageNum, Pages;
	DisassociateCurrentThreadFromCallback( CallInst );
	if ( AllocateUserPhysicalPages( GetCurrentProcess( ), PageNum, Pages ) )
	{
		if ( Pages[ 8771 ] == NVMeDataTypeLogPage ) // Always NVMe data type on real NVMe drivers and not VM drives. All systems.
		{
			return STATUS_SUCCESS;
		}

		for ( int i = 0; i <= 0x1337; i++ ) // Timing attack on mapped physical pages. VirtualBox & VMWare remaps after too many user pages are mapped at once
		{
			if ( IsValidCodePage( Pages[ i ] ) )
			{
				MapUserPhysicalPages( PVOID( Pages[ i ] ), ULONG_PTR( PageNum ), Pages );
			}
		}

		Sleep( 200 );

		if ( IsValidCodePage( Pages[ 1 ] ) )
			return STATUS_SUCCESS;
	}

	return TRUE; // != STATUS_SUCCESS(0x0)
}