Home
Rayanfam Blog
Cancel

HyperDbg’s One Thousand and One Nights

This post is a different one, in that, it is more of an overview, rather than a technical post. Here, we provide a high-level summary of HyperDbg Debugger, its principles, and perspective. Intro...

Hypervisor From Scratch – Part 8: How To Do Magic With Hypervisor!

Introduction Hi guys, Welcome to the 8th part of the Hypervisor From Scratch. If you reach here, then you probably finished reading the 7th part, and personally, I believe the 7th part was the ...

Hypervisor From Scratch – Part 7: Using EPT & Page-Level Monitoring Features

Introduction This is the 7th part of the tutorial Hypervisor From Scratch, and it’s about using the Extended Page Table (EPT) in an already running system. As you might know, paging is an essent...

Reversing Windows Internals (Part 1) - Digging Into Handles, Callbacks & ObjectTypes

Introduction Welcome to the first part of a series of posts about Exploring & Reversing Windows Concepts and Internals. If you reach here then you’re probably a security researcher or a prog...

Why you should not always trust MSDN: Finding Real Access Rights Needed By Handles

Introduction Hi guys, The title of this topic is somehow weird, if you think everything in MSDN is 100% match with what Microsoft implemented in Windows (like what I used to think), you’re defi...

Hypervisor From Scratch – Part 6: Virtualizing An Already Running System

Introduction Hello and welcome to the 6th part of the tutorial Hypervisor From Scratch. In this part, I try to explain how to virtualize an already running system using the hypervisor. Like othe...

PacketScript overview: A Lua scripting engine for in-kernel packet processing

As I was surfing the net, trying to find a way to prototype network protocols or features in Linux. I stumbled upon PacketScript. PacketScript is the an implementation of the Lua VM inside Linux...

Call Gates' Ring Transitioning in IA-32 Mode

Have you ever thought how transitions between different rings performed? Well, SYSENTER & SYSCALL used in modern OSs for transitioning between ring 3 to ring 0 but if there are other rings, ...

Hypervisor From Scratch – Part 5: Setting up VMCS & Running Guest Code

Introduction Hello and welcome to the fifth part of the “Hypervisor From Scratch” tutorial series. Today we will spend our time studying different parts of Virtual Machine Control Structure (VMC...

VmcsAuditor - A Bochs-Based Hypervisor Layout Checker

Introduction If you’ve ever had experience with developing your own hypervisor from scratch then you definitely faced with the problems of layout checking. What makes it hard to develop a hyperv...