This post is a different one, in that, it is more of an overview, rather than a technical post. Here, we provide a high-level summary of HyperDbg Debugger, its principles, and perspective. Intro...
Hypervisor From Scratch – Part 8: How To Do Magic With Hypervisor!
Introduction Hi guys, Welcome to the 8th part of the Hypervisor From Scratch. If you reach here, then you probably finished reading the 7th part, and personally, I believe the 7th part was the ...
Hypervisor From Scratch – Part 7: Using EPT & Page-Level Monitoring Features
Introduction This is the 7th part of the tutorial Hypervisor From Scratch, and it’s about using the Extended Page Table (EPT) in an already running system. As you might know, paging is an essent...
Reversing Windows Internals (Part 1) - Digging Into Handles, Callbacks & ObjectTypes
Introduction Welcome to the first part of a series of posts about Exploring & Reversing Windows Concepts and Internals. If you reach here then you’re probably a security researcher or a prog...
Why you should not always trust MSDN: Finding Real Access Rights Needed By Handles
Introduction Hi guys, The title of this topic is somehow weird, if you think everything in MSDN is 100% match with what Microsoft implemented in Windows (like what I used to think), you’re defi...
Hypervisor From Scratch – Part 6: Virtualizing An Already Running System
Introduction Hello and welcome to the 6th part of the tutorial Hypervisor From Scratch. In this part, I try to give you an idea of how to virtualize an already running system using Hypervisor. L...
PacketScript overview: A Lua scripting engine for in-kernel packet processing
As I was surfing the net, trying to find a way to prototype network protocols or features in Linux. I stumbled upon PacketScript. PacketScript is the an implementation of the Lua VM inside Linux...
Call Gates' Ring Transitioning in IA-32 Mode
Have you ever thought how transitions between different rings performed? Well, SYSENTER & SYSCALL used in modern OSs for transitioning between ring 3 to ring 0 but if there are other rings, ...
Hypervisor From Scratch – Part 5: Setting up VMCS & Running Guest Code
Introduction Hello and welcome back to the fifth part of the “Hypervisor From Scratch” tutorial series. Today we will be configuring our previously allocated Virtual Machine Control Structure (V...
VmcsAuditor - A Bochs-Based Hypervisor Layout Checker
Introduction If you’ve ever had experience with developing your own hypervisor from scratch then you definitely faced with the problems of layout checking. What makes it hard to develop a hyperv...