Crashes on VirtualBox when running VMAware

[Justine38100]

Source info

• This is from the latest commit in the main branch
• This is from the latest release
• Other

Issue type

• False positive
• Compilation warning/error
• Suggestion
• Runtime error/crash
• Other

Environment

• Windows
• Linux
• MacOS
• Other

Description

Description

During virtual machine detection tests with VMaware inside a Windows virtual machine (VirtualBox), I encountered a reproducible virtual machine crash when running the program.

The crash occurs within the hypervisor and results in a "Guru Meditation" error from VirtualBox.

This suggests that a low-level instruction executed by VMaware may trigger a state that VirtualBox's instruction emulator cannot handle correctly.

Environment

Host: Windows with VirtualBox installed on the host
Guest : Windows virtual machine
Program: C++ program using VMaware

Problem

Error observed in the VM logs:
VCPU1: Guru Meditation -5394 (VERR_IEM_IPE_4)
NEM: Destroying partition...
GIM: Using provider 'HyperV'

Copy/paste from the log file:
00:04:36.717183 GUI: UIMediumEnumerator: Medium-enumeration finished!
00:11:08.028134 AHCI#0: Port 0 reset
00:11:08.029357 VD#0: Cancelling all active requests
00:11:37.600302 Changing the VM state from 'RUNNING' to 'GURU_MEDITATION'
00:11:37.600329 Console: Machine state changed to 'Stuck'
00:11:37.600497 !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
00:11:37.600498 !!
00:11:37.600498 !! VCPU2: Guru Meditation -5394 (VERR_IEM_IPE_4)
00:11:37.600505 !!
00:11:37.600508 !!
00:11:37.600508 !! {mappings, }
00:11:37.600510 !!
00:11:37.600519 !!
00:11:37.600519 !! {hma, }
00:11:37.600519 !!
00:11:37.600520 !!
00:11:37.600520 !! {cpumguest, verbose}
00:11:37.600520 !!
00:11:37.600541 Guest CPUM (VCPU 0) state:
00:11:37.600551 rax=0000000000000000 rbx=0000000000000000 rcx=fffff79200010728 rdx=0000000000000000
00:11:37.600552 rsi=ffffdb0d55756050 rdi=fffff80051158180 r8 =0000000000000000 r9 =00000000ffffffff
00:11:37.600553 r10=fffff80051158180 r11=fffff80056fd8a50 r12=ffffdb0d59459e60 r13=ffffdb0d55756458
...
00:11:46.499733 E1000#0: TX frames up to 32768: 115
00:11:46.499733 E1000#0: Larger TX frames : 7
00:11:46.499734 E1000#0: Max TX Delay : 0
00:11:46.501705 GIM: HyperV: Resetting MMIO2 regions and MSRs
00:11:46.501736 NEM: Destroying partition 000001d551eb7d10 with its 4 VCpus...
00:11:46.712420 vmmR3LogFlusher: Terminating (VERR_OBJECT_DESTROYED)
00:11:46.712493 Changing the VM state from 'DESTROYING' to 'TERMINATED'
00:11:46.712500 Console: Machine state changed to 'PoweredOff'
00:11:46.754373 GUI: Request for async QApp quit.
00:11:46.756469 GUI: Cannot notify guest about VM window out-of-focus event
00:11:46.776353 GUI: UICommon: Handling aboutToQuit request..
00:11:48.224260 GUI: UICommon: aboutToQuit request handled!

Comments

The crash seems specific to the following configuration:
VirtualBox + Windows guest + VMaware

Three scenarios were tested:

• Running the program on a physical Windows machine
  Result: OK (no crash)
• Running the program inside a Linux VirtualBox VM on a Windows host
  Result: OK (no crash)
• Running the program inside a Windows VirtualBox VM on a Windows host
  Result: Virtual machine crash with Guru Meditation (VERR_IEM_IPE_4)

Attempted fix

I tried disabling the following flags:
flags.reset(VM::MSR);
flags.reset(VM::SYSTEM_REGISTERS);
flags.reset(VM::FIRMWARE);
flags.reset(VM::BLOCKSTEP);
flags.reset(VM::DBVM_HYPERCALL);

However, the crash still occurs.

So I disabled all the flags and then added this:
flags.reset();
flags.set(VM::DISK_SERIAL);
flags.set(VM::DRIVERS);
flags.set(VM::VIRTUAL_REGISTRY);
flags.set(VM::DEVICES);
flags.set(VM::VMWARE_STR);
flags.set(VM::MAC);

And now, my tests run without VirtualBox crashing.

Assumptions :

The VirtualBox log indicates that the virtual machine runs using the Hyper-V backend (NEM mode): GIM: Using provider 'HyperV'.
In this configuration, some low-level instructions executed in the guest may be emulated differently by VirtualBox.
It is possible that one of these instructions triggers an unsupported state in VirtualBox's Instruction Emulator (IEM), resulting in: VERR_IEM_IPE_4 (Internal Processing Error)

Question :

Is this a known issue when using VMaware inside a Windows guest running on VirtualBox?

If needed, I can try to produce a minimal reproduction example.

Note

Thank you for your time.
I hope this report is clear enough and I remain available if additional information is needed.

CLI output (if possible)

[NotRequiem]

It's a known issue, and it's not our fault.

It's already been reported and fixed in the SVN release.

VirtualBox/virtualbox#616

[NotRequiem]

We will probably add a note stating that the new release affects VirtualBox, we also know what specific code triggers the crash and we're currently discussing whether we should apply a temporary fix in our end while they don't fix their bug.

[NotRequiem]

Update: We will create a new branch and compile a new build today for people wanting a binary that doesn't crash VirtualBox, adding them to the current 2.7.0 release while VirtualBox doesnt release the bug fixes.

Of course, this new binary will have some new checks disabled.

This will allow users to decide whether they want a source code/binary with our full detection capabilities (in the case of people/corporations wanting the most effective defense against VM reverse engineering and related), or a source code/binary that assures their system won't crash in machines running VirtualBox (for more strict organizations that priorize stability).

[NotRequiem]

Issue fixed. Developers can compile the new fix/virtualbox-compatibility branch in the same way as the main branch.

A new compiled binary from this branch will be included in the 2.7.0 release, along with a note explaining the issue.

Renamed this issue to make it more accessible for newcomers who want to understand or locate it.

[Justine38100]

Thank you for your quick replies.

I had searched the issues but hadn't found a similar bug.

I'll use the fix!
Thanks again for your responsiveness, your library is great :-)