Press "Enter" to skip to content

Posts published by “Sinaei”

Sven, are you still so blue under that armor?

Why you should not always trust MSDN: Finding Real Access Rights Needed By Handles

Sinaei 0

Introduction Hi guys, The title of this topic is somehow weird, if you think everything in MSDN is 100% match with what Microsoft implemented in Windows (like what I used to think), you’re definitely wrong, this post shows some proofs and in the last part, I’ll give you a solution to ACCESS_RIGHTS problem. Before starting let’s talk about some backgrounds about “ACCESS_MASK“. Most of the explanations derived from here. Backgrounds The ACCESS_MASK data type is a DWORD value that defines standard, specific, and generic…

Hypervisor From Scratch – Part 6: Virtualizing An Already Running System

Sinaei 10

Introduction Hello and welcome to the 6th part of the tutorial Hypervisor From Scratch. In this part, I try to give you an idea of how to virtualize an already running system using Hypervisor. Like other parts, this part is really dependent to the previous parts so make sure to read them first. Overview In the 6th part, we’ll see how we can virtualize our currently running system by configuring VMCS, then we use monitoring features to detect execution of…

Call Gates’ Ring Transitioning in IA-32 Mode

Sinaei 0

Have you ever thought how transitions between different rings performed? Well, SYSENTER & SYSCALL used in modern OSs for transitioning between ring 3 to ring 0 but if there are other rings, then what’s Intel solution for entering them? The answer is call gates. The rest of this topic described how to use call gates in modern processors. 80386 and its successors have 4 levels protections which isolate and protect user programs from each other and the operating system. It…

Hypervisor From Scratch – Part 5: Setting up VMCS & Running Guest Code

Sinaei 9

Introduction Hello and welcome back to the fifth part of the “Hypervisor From Scratch” tutorial series. Today we will be configuring our previously allocated Virtual Machine Control Structure (VMCS) and in the last, we execute VMLAUNCH and enter to our hardware-virtualized world! Before reading the rest of this part, you have to read the previous parts as they are really dependent. The full source code of this tutorial is available on GitHub : [] Most of this topic derived from…

VmcsAuditor – A Bochs-Based Hypervisor Layout Checker

Sinaei 0

  Introduction  If you’ve ever had experience with developing your own hypervisor from scratch then you definitely faced with the problems of layout checking. What makes it hard to develop a hypervisor is the fact that Intel has a small number of errors for a huge checklist described in [CHAPTER 26] VM ENTRIES from Intel’s 64 and IA-32 Architectures Software Developer’s Manual including: 26.2 CHECKS ON VMX CONTROLS AND HOST-STATE AREA 26.3 CHECKING AND LOADING GUEST STATE  26.4 LOADING MSRS 26.5 EVENT…