failing to allocate vcpus

[eboyfriends]

0xc0350071

[hv] Attempting to allocate 14827520 bytes for 20 VCPUs

in create:

 DbgPrint("[hv] Attempting to allocate %zu bytes for %u VCPUs\n", arr_size, ghv.vcpu_count);
 ghv.vcpus = static_cast<vcpu*>(ExAllocatePool2(NonPagedPoolNx, arr_size, 'G0D')); // ExAllocatePoolWithTag deprecated

 if (!ghv.vcpus) {
   DbgPrint("[hv] Failed to allocate VCPUs.\n");
   return false;
 }```

[eboyfriends]

using sc create vtx binpath="D:\USER\Projects\Rbx\hv.sys" type=kernel results [SC] StartService FAILED 3224698993:

[eboyfriends]

managed to load driver successfully, failing to get_phsical_address

[eboyfriends]

after everything finally have a working "demo",

#include <windows.h>

#include "hv.h"

__declspec(noinline) int original_function(int a, int b) {
    printf("[ORIGINAL] Called with %d, %d\n", a, b);
    return a + b;
}

__declspec(noinline) int hook_function(int a, int b) {
    printf("[HOOKED] Intercepted call with %d, %d - adding 1000!\n", a, b);
    return a + b + 1000;
}

typedef int (*test_func_ptr)(int, int);

void create_hook_page(void* original_page, void* shadow_page, void* hook_func, size_t original_func_offset) {
    memcpy(shadow_page, original_page, 0x1000);
    uint8_t* shadow_func = (uint8_t*)shadow_page + original_func_offset;

    uint8_t jump_code[] = {
        0x48, 0xB8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // mov rax, address
        0xFF, 0xE0,                                                 // jmp rax
        0x90, 0x90                                                  // nop padding
    };

    *(uint64_t*)(jump_code + 2) = (uint64_t)hook_func;
    memcpy(shadow_func, jump_code, sizeof(jump_code));

    printf("Hook installed at shadow page offset 0x%zx\n", original_func_offset);
}

int main() {
    if (!hv::is_hv_running()) {
        printf("HV not running.\n");
        return 0;
    }

    hv::ping();
    printf("Hypervisor is running!\n");

    int result1 = original_function(5, 10);
    printf("Result: %d\n", result1);

    uint64_t CurrentCR3 = hv::query_process_cr3(GetCurrentProcessId());
    void* target_function = (void*)original_function;
    uintptr_t page_base = (uintptr_t)target_function & ~0xFFF;
    size_t func_offset = (uintptr_t)target_function - page_base;

    printf("Target function: 0x%p\n", target_function);
    printf("Page base: 0x%p\n", (void*)page_base);
    printf("Function offset in page: 0x%zx\n", func_offset);

    MEMORY_BASIC_INFORMATION mbi;
    SIZE_T result = VirtualQuery((void*)page_base, &mbi, sizeof(mbi));
    if (result) {
        printf("Page info - Base: 0x%p, Size: 0x%zx, State: 0x%x, Protect: 0x%x\n", mbi.BaseAddress, mbi.RegionSize, mbi.State, mbi.Protect);
    }

    DWORD oldProtect;
    if (!VirtualProtect((void*)page_base, 0x1000, PAGE_EXECUTE_READ, &oldProtect)) {
        printf("Warning: Could not set page protection (error: %d)\n", GetLastError());
    }
    else {
        printf("Page protection set successfully (old: 0x%x, new: PAGE_EXECUTE_READ)\n", oldProtect);
    }

    printf("Touching page to ensure it's in memory...\n");
    volatile uint8_t dummy = *(uint8_t*)page_base;
    (void)dummy;

    auto target_phys = hv::get_physical_address(CurrentCR3, (void*)page_base);
    if (!target_phys) {
        printf("Failed to get physical address of target page\n");
        return 0;
    }
    printf("Target physical address: 0x%llx\n", target_phys);

    auto shadow_page = VirtualAlloc(nullptr, 0x1000, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
    if (!shadow_page) {
        printf("Failed to allocate shadow page\n");
        return 0;
    }

    create_hook_page((void*)page_base, shadow_page, (void*)hook_function, func_offset);

    auto shadow_phys = hv::get_physical_address(CurrentCR3, shadow_page);
    if (!shadow_phys) {
        printf("Failed to get shadow physical address\n");
        VirtualFree(shadow_page, 0, MEM_RELEASE);
        return 0;
    }
    printf("Shadow physical address: 0x%llx\n", shadow_phys);

    bool success = true;
    hv::for_each_cpu([&](uint32_t cpu_id) {
        bool cpu_success = hv::install_ept_hook(target_phys >> 12, shadow_phys >> 12);
        if (!cpu_success) {
            printf("Failed to install EPT hook on CPU %u\n", cpu_id);
            success = false;
        }
        else {
            printf("EPT hook installed on CPU %u\n", cpu_id);
        }
        });

    if (!success) {
        printf("Failed to install EPT hooks\n");
        VirtualFree(shadow_page, 0, MEM_RELEASE);
        return 0;
    }

    int result2 = original_function(3, 7);
    printf("Result: %d (should be 1010 if hook worked)\n", result2);

    int result3 = original_function(1, 2);
    printf("Result: %d (should be 1003 if hook worked)\n", result3);

    test_func_ptr func_ptr = original_function;
    int result4 = func_ptr(10, 20);
    printf("Result: %d (should be 1030 if hook worked)\n", result4);

    printf("\nMonitoring logs (Press Enter to stop)\n");
    FILE* file = nullptr;
    fopen_s(&file, "ept_hook_log.txt", "w");
    while (!GetAsyncKeyState(VK_RETURN)) {
        uint32_t count = 512;
        hv::logger_msg msgs[512];
        hv::flush_logs(count, msgs);

        for (uint32_t i = 0; i < count; ++i) {
            printf("[%llu][CPU=%u] %s\n", msgs[i].id, msgs[i].aux, msgs[i].data);
            if (file) {
                fprintf(file, "[%llu][CPU=%u] %s\n", msgs[i].id, msgs[i].aux, msgs[i].data);
            }
        }

        if (file) fflush(file);
        Sleep(10);
    }

    hv::for_each_cpu([&](uint32_t cpu_id) {
        hv::remove_ept_hook(target_phys >> 12);
        printf("Removed EPT hook from CPU %u\n", cpu_id);
    });

    int result5 = original_function(5, 10);
    printf("Result: %d (should be 15, back to original)\n", result5);

    if (file) fclose(file);
    VirtualFree(shadow_page, 0, MEM_RELEASE);

    return 0;
}```