Press "Enter" to skip to content

Posts published in “CPU”

Hypervisor From Scratch – Part 8: How To Do Magic With Hypervisor!

Sina Karvandi 0

Introduction Hi guys, Welcome to the 8th part of the Hypervisor From Scratch. If you reach here, then you probably finished reading the 7th part, and personally, I believe the 7th part was the most challenging part to understand so hats off, you did a great job. The 8th part would be an exciting part as we’ll see lots of real-world and practical examples of solving reverse-engineering related problems with hypervisors. For example, we’ll see how hidden hooks work in…

Hypervisor From Scratch – Part 7: Using EPT & Page-Level Monitoring Features

Sina Karvandi 2

Introduction This is the 7th part of the tutorial Hypervisor From Scratch, and it’s about using the Extended Page Table (EPT) in an already running system. As you might know, paging is an essential part of managing memory on modern operating systems. Hypervisors use an additional paging table; this gives us an excellent opportunity to monitor different aspects of memory (Read-Write-Execute) without modifying the operating systems page-tables. EPT is a hardware mechanism, so it’s fast, but on the other hand,…

Hypervisor From Scratch – Part 6: Virtualizing An Already Running System

Sina Karvandi 17

Introduction Hello and welcome to the 6th part of the tutorial Hypervisor From Scratch. In this part, I try to give you an idea of how to virtualize an already running system using Hypervisor. Like other parts, this part is really dependent to the previous parts so make sure to read them first. Overview In the 6th part, we’ll see how we can virtualize our currently running system by configuring VMCS, then we use monitoring features to detect execution of…

Call Gates’ Ring Transitioning in IA-32 Mode

Sina Karvandi 0

Have you ever thought how transitions between different rings performed? Well, SYSENTER & SYSCALL used in modern OSs for transitioning between ring 3 to ring 0 but if there are other rings, then what’s Intel solution for entering them? The answer is call gates. The rest of this topic described how to use call gates in modern processors. 80386 and its successors have 4 levels protections which isolate and protect user programs from each other and the operating system. It…

Hypervisor From Scratch – Part 5: Setting up VMCS & Running Guest Code

Sina Karvandi 12

Introduction Hello and welcome back to the fifth part of the “Hypervisor From Scratch” tutorial series. Today we will be configuring our previously allocated Virtual Machine Control Structure (VMCS) and in the last, we execute VMLAUNCH and enter to our hardware-virtualized world! Before reading the rest of this part, you have to read the previous parts as they are really dependent. The full source code of this tutorial is available on GitHub : [https://github.com/SinaKarvandi/Hypervisor-From-Scratch] Note: Please keep in mind that…