hv is an x86-64 Intel VT-x
hypervisor that aims to be simple and lightweight, while still following the Intel SDM as closely as possible.
This allows it to evade detections that take advantage of common hypervisor bugs, such as improper
vm-exit handling. Other detections, such as timing checks, are mostly mitigated, although staying
fully undetected is nearly impossible.
To clone the repo:
git clone --recursive https://github.com/jonomango/hv.githv is a Windows driver built with MSVC. It requires
Visual Studio and the
WDK for compilation.
Once compiled, simply load hv.sys anyway you'd like (either by using the Windows Service Control Manager
or a manual mapper) and it will immediately virtualize the system. To check if hv is
currently running, try to execute the ping hypercall and see if it responds appropriately. Unloading
the driver will result in hv::stop() being called, which will devirtualize the system.
hv has a full hypercall interface that can be used from both ring-0 and ring-3. It relies on the VMCALL
instruction and has a particular calling convention that must be followed. Check out
um/hv.asm for how this can be implemented.
Additionally, hypercalls will not function correctly unless provided with the correct hypercall_key. This can be easily modified in the source code and is used to ensure that malicious guests cannot execute any hypercalls.
Example of executing the ping hypercall:
// setup the hypercall input
hv::hypercall_input input;
input.code = hv::hypercall_ping;
input.key = hv::hypercall_key;
// execute the hypercall
auto const value = hv::vmx_vmcall(input);
if (value == hv::hypervisor_signature)
printf("pong!\n");Extending the hypercall interface is pretty simple. Add your new hypercall handler to hv/hypercalls.h and hv/hypercalls.cpp, then modify emulate_vmcall() to call your added function.
Below is a list of important functions that can be safely called from root-mode,
which can be used by including introspection.h. It is important to note that
any code that lies outside of the hypervisor (i.e. kernel code) cannot be called
from root-mode, and the following functions should be used instead.
// get the KPCR of the current guest (this pointer should stay constant per-vcpu)
PKPCR current_guest_kpcr();
// get the ETHREAD of the current guest
PETHREAD current_guest_ethread();
// get the EPROCESS of the current guest
PEPROCESS current_guest_eprocess();
// get the PID of the current guest
uint64_t current_guest_pid();
// get the kernel CR3 of the current guest
cr3 current_guest_cr3();
// get the image file name (up to 15 chars) of the current guest process
bool current_guest_image_file_name(char (&name)[16]);
// get the CPL (current privilege level) of the current guest
uint16_t current_guest_cpl();
// attempt to read the memory at the specified guest virtual address from root-mode
size_t read_guest_virtual_memory(cr3 guest_cr3, void* gva, void* buffer, size_t size);
// attempt to read the memory at the specified guest virtual address from root-mode
size_t read_guest_virtual_memory(void* gva, void* buffer, size_t size);
// attempt to read the memory at the specified guest physical address from root-mode
bool read_guest_physical_memory(uint64_t gpa, void* buffer, size_t size);hv has a simple printf-style logger that can be used from both root-mode or
guest-mode. It can be found in logger.h and the logs can be retrieved through
the flush_logs hypercall. Different log types can be omitted by simply modifying
the defines in logger.h.
// 3 different log types are supported:
HV_LOG_INFO("Hello world!");
HV_LOG_ERROR("Error on line %i.", 69);
HV_LOG_VERBOSE("Junk... %s", "More junk...");The logger supports a small subset of printf-style formatting:
%s c-style strings
%i or %d 32-bit signed integer
%u 32-bit unsigned integer
%x 32-bit unsigned integer (printed in hex, lowercase)
%X 32-bit unsigned integer (printed in hex, uppercase)
%p 64-bit unsigned integer (printed in hex)
Below is an example of reading the logs, which can be done from ring-0 or ring-3.
// read the logs into a buffer
uint32_t count = 512;
hv::logger_msg msgs[512];
hv::flush_logs(count, msgs);
// print every log message
for (uint32_t i = 0; i < count; ++i)
printf("%s\n", msgs[i].data);