From 19cae96f59c789db3e8819a45a9adfee535c77ad Mon Sep 17 00:00:00 2001
From: Dorian Eikenberg <dorian.eikenberg@gdata.de>
Date: Wed, 19 Jul 2023 09:31:28 +0200
Subject: [PATCH] Add access to gs_base register

---
 vmicore/src/include/vmicore/vmi/events/IRegisterReadable.h  | 2 ++
 vmicore/src/lib/vmi/Event.cpp                               | 5 +++++
 vmicore/src/lib/vmi/Event.h                                 | 2 ++
 vmicore/test/include/vmicore_test/vmi/mock_InterruptEvent.h | 2 ++
 4 files changed, 11 insertions(+)

diff --git a/vmicore/src/include/vmicore/vmi/events/IRegisterReadable.h b/vmicore/src/include/vmicore/vmi/events/IRegisterReadable.h
index 9b1b57eb..5e689454 100644
--- a/vmicore/src/include/vmicore/vmi/events/IRegisterReadable.h
+++ b/vmicore/src/include/vmicore/vmi/events/IRegisterReadable.h
@@ -30,6 +30,8 @@ namespace VmiCore
 
         [[nodiscard]] virtual uint64_t getCr3() const = 0;
 
+        [[nodiscard]] virtual uint64_t getGs() const = 0;
+
       protected:
         IRegisterReadable() = default;
     };
diff --git a/vmicore/src/lib/vmi/Event.cpp b/vmicore/src/lib/vmi/Event.cpp
index f0772c22..e6768a89 100644
--- a/vmicore/src/lib/vmi/Event.cpp
+++ b/vmicore/src/lib/vmi/Event.cpp
@@ -56,6 +56,11 @@ namespace VmiCore
         return libvmiEvent->x86_regs->cr3;
     }
 
+    uint64_t Event::getGs() const
+    {
+        return libvmiEvent->x86_regs->gs_base;
+    }
+
     addr_t Event::getGla() const
     {
         switch (libvmiEvent->type)
diff --git a/vmicore/src/lib/vmi/Event.h b/vmicore/src/lib/vmi/Event.h
index 6589c9ba..dac5c04c 100644
--- a/vmicore/src/lib/vmi/Event.h
+++ b/vmicore/src/lib/vmi/Event.h
@@ -34,6 +34,8 @@ namespace VmiCore
 
         [[nodiscard]] uint64_t getCr3() const override;
 
+        [[nodiscard]] uint64_t getGs() const override;
+
         [[nodiscard]] addr_t getGla() const override;
 
         [[nodiscard]] addr_t getGfn() const override;
diff --git a/vmicore/test/include/vmicore_test/vmi/mock_InterruptEvent.h b/vmicore/test/include/vmicore_test/vmi/mock_InterruptEvent.h
index 3bac6d4c..03b06bee 100644
--- a/vmicore/test/include/vmicore_test/vmi/mock_InterruptEvent.h
+++ b/vmicore/test/include/vmicore_test/vmi/mock_InterruptEvent.h
@@ -29,6 +29,8 @@ namespace VmiCore
 
         MOCK_METHOD(uint64_t, getCr3, (), (const override));
 
+        MOCK_METHOD(uint64_t, getGs, (), (const override));
+
         MOCK_METHOD(addr_t, getGla, (), (const override));
 
         MOCK_METHOD(addr_t, getGfn, (), (const override));