Detecting Hypervisor Presence on Windows 10
Detecting a hypervisor on Windows 10 is relatively simple, but due to the simplistic nature of the currently published detection vectors it’s likely that they are also relatively simple to spoof or remove. In this article we’ll detail a few ways of detecting a hypervisors presence on Windows 10, determining if it’s a Microsoft hypervisor, […]
Hiding Drivers on Windows 10
Disclaimer: All experiments and development were performed on Windows 10 x64 (Version 1703, Build 15063.540). Any attempt to replicate results on a different version or operating system may yield inconsistent results. —– It’s a pretty common objective in the game hacking community to load and attempt to hide their kernel modules from prying eyes. The […]
Superseding Driver Altitude Checks on Windows
It was brought to my attention that in an article on my former research portfolio[2] I mentioned another way to manipulate an unsigned driver and perform some black magic. This black magic is done by modifying a flag in the _DRIVER_OBJECT allowing for the loaded driver to supersede altitude checks, register callbacks both with the […]
Converting Virtual Linear Addresses to Physical Addresses
The processes of converting virtual address to physical addresses varies from architecture to architecture. This article lays out the process of converting a standard 64bit linear address on a processor operating in IA32e mode. It’s important to note this distinction because some constructs that exist for IA32e do not for IA32 mode (such as the […]
Custom GetProcAddress and GetModuleHandle Implementation (x64)
Reverse engineers know that the easiest way to break an application down to understand it’s internal operations involves using the import table and, of course, understanding assembly to some degree. In an effort to add a layer of indirection and in pursuit of understanding how the internal Windows routines operated I rewrote the famous, or […]