Category: Research

5 Days to Virtualization: A Series on Hypervisor Development

Overview Next week, (10/29) I’ll be starting to publish a series that is written to aid new and interested readers with building, testing, and understanding type-2 hypervisor development. This hypervisor will be written for use on Intel processors with virtualization support. If you’re operating on an AMD chip, you may find some parts helpful, but […]

Read More

Superseding Driver Altitude Checks on Windows

It was brought to my attention that in an article on my former research portfolio[2] I mentioned another way to manipulate an unsigned driver and perform some black magic. This black magic is done by modifying a flag in the _DRIVER_OBJECT allowing for the loaded driver to supersede altitude checks, register callbacks both with the […]

Read More

Detecting Hypervisor Presence on Windows 10

Detecting a hypervisor on Windows 10 is relatively simple, but due to the simplistic nature of the currently published detection vectors it’s likely that they are also relatively simple to spoof or remove. In this article we’ll detail a few ways of detecting a hypervisors presence on Windows 10, determining if it’s a Microsoft hypervisor, […]

Read More

Hiding Drivers on Windows 10

Disclaimer: All experiments and development were performed on Windows 10 x64 (Version 1703, Build 15063.540). Any attempt to replicate results on a different version or operating system may yield inconsistent results. —– It’s a pretty common objective in the game hacking community to load and attempt to hide their kernel modules from prying eyes. The […]

Read More

Converting Virtual Linear Addresses to Physical Addresses

The processes of converting virtual address to physical addresses varies from architecture to architecture. This article lays out the process of converting a standard 64bit linear address on a processor operating in IA32e mode. It’s important to note this distinction because some constructs that exist for IA32e do not for IA32 mode (such as the […]

Read More

Custom GetProcAddress and GetModuleHandle Implementation (x64)

Reverse engineers know that the easiest way to break an application down to understand it’s internal operations involves using the import table and, of course, understanding assembly to some degree. In an effort to add a layer of indirection and in pursuit of understanding how the internal Windows routines operated I rewrote the famous, or […]

Read More

TEB Structure for Windows 10 Pro x64

A lot of structures that are extremely useful happen to be partially documented by MSFT. I decided to rebuild the TEB structure to it’s fullest extent with the proper members and the associated structures as well. Skim through this post for the structures and their full definitions. If you believe something is missing please do […]

Read More