tandasat/Hypervisor-101-in-Rust

Stars
935
Rank 47,144 (Top 1.0 %)
Language
Rust
License
MIT License
Created over 1 year ago
Updated about 2 months ago

tandasat/Hypervisor-101-in-Rust

tandasat

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

The materials of "Hypervisor 101 in Rust", a one-day long course, to quickly learn hardware-assisted virtualization technology and its application for high-performance fuzzing on Intel/AMD processors.

Hypervisor 101 in Rust

The materials of the "Hypervisor 101 in Rust" class held at Global Cybersecurity Camp 2023 Singapore. This repository contains a fuzzing hypervisor for UEFI on Intel/AMD processors, lecture and hands-on exercise materials, and sample corpus and target files.

Read the course at https://tandasat.github.io/Hypervisor-101-in-Rust/

Directory structure

📖course/ for the class materials
🦀hypervisor/ for source code and a detailed description of the fuzzing hypervisor
⚙️BUILDING.md for building and running the hypervisor with sample files under tests/

Course format

The class materials are designed for an interactive classroom setting and less effective for self-learning due to light explanations. We decided to publish this as it would still be useful to some, however. If you are interested in the interactive class with the author, please check out the schedule of the next public class at System Programming Lab.

Supported platforms

Host (class and development) environment
- 📎Windows + WSL
- 🍎macOS
- 🐧Ubuntu
- Apple Silicon-based macOS, ARM64-based Windows and Ubuntu are also supported. No x64 system required.
Test (target) environment
- Hardware
  - Bochs
  - VMware Fusion or Workstation Pro (if a host has Intel or AMD processors)
  - Select bare metal models
- with UEFI

Acknowledgements

Andrew Burkett (@drewkett) and Rich Seymour (@rseymour) for mentoring me about Rust
Karsten König (@gr4yf0x) and Amir Bazine for encouraging me looking into use of hypervisors for fuzzing
Brandon Falk (@gamozolabs) for his inspirational work, Falkvisor

HyperPlatform

Intel VT-x based hypervisor aiming to provide a thin VM-exit filtering platform on Windows.

DdiMon

Monitoring and controlling kernel API calls with stealth hook using EPT

MiniVisorPkg

The research UEFI hypervisor that supports booting an operating system.

SimpleSvmHook

SimpleSvmHook is a research purpose hypervisor for Windows on AMD processors.

PgResarch

PatchGuard Research

SimpleSvm

A minimalistic educational hypervisor for Windows on AMD processors.

ExploitCapcom

This is a standalone exploit for a vulnerable feature in Capcom.sys

MemoryMon

Detecting execution of kernel memory where is not backed by any image file

DotNetHooking

Sample use cases of the .NET native code hooking technique

scripts_for_RE

Python scripts for reverse engineering.

GuardMon

Hypervisor based tool for monitoring system register accesses.

UefiVarMonitor

The runtime DXE driver monitoring access to the UEFI variables by hooking the runtime service table.

SmmExploit

The report and the exploit of CVE-2021-26943, the kernel-to-SMM local privilege escalation vulnerability in ASUS UX360CA BIOS version 303.

EopMon

Elevation of privilege detector based on HyperPlatform

Sushi

a Japanese food keeps you sane

findpg

Windbg extension to find PatchGuard pages

UEFI-BIOS-Security

Security Camp 2021 & GCC 2022

hvext

The Windbg extension that implements commands helpful to study Hyper-V on Intel processors.

WinIoCtlDecoder

IDA Plugin which decodes Windows Device I/O control code into DeviceType, FunctionCode, AccessType and MethodType.

HelloSmm

This is an instruction to run your own SMM code.

DebugLogger

A software driver that lets you log kernel-mode debug output into a file on Windows.

WPBT-Builder

The simple UEFI application to create a Windows Platform Binary Table (WPBT) from the UEFI shell.

FU_Hypervisor

A hypervisor hiding user-mode memory using EPT

CVE-2023-36427

Report and exploit of CVE-2023-36427

kraft_dinner

Tool to dump UEFI runtime drivers implementing runtime services for Windows

HelloAmdHvPkg

HelloAmdHvPkg is a type-1 research hypervisor for AMD processors.

Hello-VT-rp

A simple hypervisor demonstrating the use of the Intel VT-rp (redirect protection) technology.

RemoteWriteMonitor

A tool to help malware analysts tell that the sample is injecting code into other process.

Scavenger

A minifilter driver preserves all modified and deleted files.

meow

HelloIommuPkg

The sample DXE runtime driver demonstrating how to program DMA remapping.

DumpVTable

Generates a Python script to give public interface names in an ActiveX file to an IDB file.

DrvLoader

A command line tool to load and unload a device driver.

CVE-2022-25949

A years-old exploit of a local EoP vulnerability in Kingsoft Antivirus KWatch Driver version 2009.3.17.77.

cs_driver

A sample project for using Capstone from a driver in Visual Studio 2015

CVE-2014-0816

CVE-2024-21305

Report and exploit of CVE-2024-21305.

hyperplatform_log_parser

User-mode program parsing logs created by HyperPlatform

tandasat.github.io

ProjectLoadTimeMonitor

The Visual Studio extension that measures load time of each project when a solution file is opened.

CheckSDL

A tool evaluates security configurations of a given PE based on SDL without source code

ListWorkItems

Lists work items being queued currently.

DeviceOpener

A command line tool to check if a specified device is accessible.

windbg_init

Windbg Init Script

win32_debugout

Shows debug strings on DebubView from an attached process by win32_remote.exe.

ping_vmm

A user-mode program knocking at HyperPlatform's "backdoor"

List-UEFI-Configuration-Tables

List UEFI Configuration Tables

ScopedResource

Scoped Resource - Generic RAII Wrapper for the Standard Library by Peter Sommerlad and Andrew L. Sandoval

SecRuntimeSample

A sample usege of SecRuntime.dll on Windows Phone

blog

CopyFiles

Copy files onto the IsolatedStorage so that you can download them using IsoStoreSpy.

mylight

Using LED of Samsung Galaxy Ace S5830

tandasat

shared

Manages files that are shared with multiple boxes.