Category: Reverse Engineering

Syscall Hooking via Extended Feature Enable Register (EFER)

Since the dawn of KVA Shadowing (KVAS), similar to Linux’s KPTI, which was developed by Microsoft to mitigate Meltdown vulnerabilities, hooking syscalls among other potentially malicious things has become increasingly difficult in Windows. Upon updating my virtualization toolset which utilizes syscall hooking strategies to assist in control flow analysis, I had trouble when trying to […]

Read More

Superseding Driver Altitude Checks on Windows

It was brought to my attention that in an article on my former research portfolio[2] I mentioned another way to manipulate an unsigned driver and perform some black magic. This black magic is done by modifying a flag in the _DRIVER_OBJECT allowing for the loaded driver to supersede altitude checks, register callbacks both with the […]

Read More

Detecting Hypervisor Presence on Windows 10

Detecting a hypervisor on Windows 10 is relatively simple, but due to the simplistic nature of the currently published detection vectors it’s likely that they are also relatively simple to spoof or remove. In this article we’ll detail a few ways of detecting a hypervisors presence on Windows 10, determining if it’s a Microsoft hypervisor, […]

Read More

Hiding Drivers on Windows 10

Disclaimer: All experiments and development were performed on Windows 10 x64 (Version 1703, Build 15063.540). Any attempt to replicate results on a different version or operating system may yield inconsistent results. —– It’s a pretty common objective in the game hacking community to load and attempt to hide their kernel modules from prying eyes. The […]

Read More

Reading MSRs from UserMode

After speaking with some pals online about Windows 10’s policy requiring drivers to be digitally signed in order to load the lot of us began digging into tools that use signed drivers – you know… to see if there was any fun to be had with drivers that don’t validate UserMode addresses that are passed […]

Read More