Thank you, Bruce, for your post. But one thing that you didn't mention is where do you search for this pattern (“4c 89 79 78“)?
Motivated by a question from a friend and his coworker, I wrote a blog about HyperV and exit dispatching. See https://gracefulbits.com/2019/03/25/some-notes-on-identifying-exit-and-hypercall-handlers-in-hyperv/ … cc @AmarSaar @gerhart_x @d_olex
Also, @standa_t and I are offering a course on hypervisor development! Seehttps://gracefulbits.regfox.com/designing-and-implementing-a-hypervisor-for-security-analysis …
-
-
-
He actually did:) It's taken from
@d_olex's great work ( s6_pcie_microblaze, in the file DmaBackdoorHv.c )pic.twitter.com/tI5eGV6mAs
- Još 2 druga odgovora
Novi razgovor -
-
-
Thanks for reference ) You can find script for dynamic reading of VMCS fields on https://github.com/gerhart01/Hyper-V-scripts/blob/master/display-vmcs.py …. ISR routines must be found before execute ithttps://github.com/gerhart01/Hyper-V-scripts/blob/master/ParseIDT.py …
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
-
-
Old topic but it can be useful. For finding exit_handler we can use IDA script to detect this function by looking for a function that contains all of these 3 VMCSs
VMCS_EXIT_REASON
VMCS_EXIT_INSTR_LENGTH
VMCS_GUEST_RIP
sub_FFFFF80000217290 -> hvax64.exe 10.0.17763.737pic.twitter.com/hLRCwN67Fl
-
Sorry my bad, it's wrong (`sub_FFFFF80000217290` or `sub_FFFFF800002EA2B8` can be our target but not certainly) I didn't consider wrapped VMCS operations, there is lots of functions that implemented read/write to/from these VMCSs.
- Još 2 druga odgovora
Novi razgovor -
-
-
Great post! Thanks for the shoutout :)
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
Čini se da učitavanje traje već neko vrijeme.
Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.