• Stars
    star
    981
  • Rank 46,671 (Top 1.0 %)
  • Language
    Rust
  • License
    MIT License
  • Created almost 2 years ago
  • Updated 2 months ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

The materials of "Hypervisor 101 in Rust", a one-day long course, to quickly learn hardware-assisted virtualization technology and its application for high-performance fuzzing on Intel/AMD processors.

Hypervisor 101 in Rust

The materials of the "Hypervisor 101 in Rust" class held at Global Cybersecurity Camp 2023 Singapore. This repository contains a fuzzing hypervisor for UEFI on Intel/AMD processors, lecture and hands-on exercise materials, and sample corpus and target files.

Read the course at https://tandasat.github.io/Hypervisor-101-in-Rust/

Directory structure

  • ๐Ÿ“–course/ for the class materials
  • ๐Ÿฆ€hypervisor/ for source code and a detailed description of the fuzzing hypervisor
  • โš™๏ธBUILDING.md for building and running the hypervisor with sample files under tests/

Course format

The class materials are designed for an interactive classroom setting and less effective for self-learning due to light explanations. We decided to publish this as it would still be useful to some, however. If you are interested in the interactive class with the author, please check out the schedule of the next public class at System Programming Lab.

Supported platforms

  • Host (class and development) environment
    • ๐Ÿ“ŽWindows + WSL
    • ๐ŸŽmacOS
    • ๐ŸงUbuntu
    • Apple Silicon-based macOS, ARM64-based Windows and Ubuntu are also supported. No x64 system required.
  • Test (target) environment
    • Hardware
      • Bochs
      • VMware Fusion or Workstation Pro (if a host has Intel or AMD processors)
      • Select bare metal models
    • with UEFI

Acknowledgements

  • Andrew Burkett (@drewkett) and Rich Seymour (@rseymour) for mentoring me about Rust
  • Karsten Kรถnig (@gr4yf0x) and Amir Bazine for encouraging me looking into use of hypervisors for fuzzing
  • Brandon Falk (@gamozolabs) for his inspirational work, Falkvisor

More Repositories

1

HyperPlatform

Intel VT-x based hypervisor aiming to provide a thin VM-exit filtering platform on Windows.
C++
1,519
star
2

DdiMon

Monitoring and controlling kernel API calls with stealth hook using EPT
C++
1,146
star
3

MiniVisorPkg

The research UEFI hypervisor that supports booting an operating system.
C
546
star
4

SimpleSvmHook

SimpleSvmHook is a research purpose hypervisor for Windows on AMD processors.
C++
351
star
5

SimpleSvm

A minimalistic educational hypervisor for Windows on AMD processors.
C++
317
star
6

PgResarch

PatchGuard Research
C++
288
star
7

ExploitCapcom

This is a standalone exploit for a vulnerable feature in Capcom.sys
C++
280
star
8

MemoryMon

Detecting execution of kernel memory where is not backed by any image file
C++
252
star
9

DotNetHooking

Sample use cases of the .NET native code hooking technique
C#
201
star
10

barevisor

A bare minimum hypervisor on AMD and Intel processors for learners.
Rust
189
star
11

scripts_for_RE

Python scripts for reverse engineering.
Python
178
star
12

GuardMon

Hypervisor based tool for monitoring system register accesses.
C++
140
star
13

UefiVarMonitor

The runtime DXE driver monitoring access to the UEFI variables by hooking the runtime service table.
C
136
star
14

SmmExploit

The report and the exploit of CVE-2021-26943, the kernel-to-SMM local privilege escalation vulnerability in ASUS UX360CA BIOS version 303.
133
star
15

hvext

The Windbg extension that implements commands helpful to study Hyper-V on Intel processors.
JavaScript
126
star
16

EopMon

Elevation of privilege detector based on HyperPlatform
C++
117
star
17

Sushi

a Japanese food keeps you sane
C++
117
star
18

findpg

Windbg extension to find PatchGuard pages
C++
116
star
19

UEFI-BIOS-Security

Security Camp 2021 & GCC 2022
111
star
20

WinIoCtlDecoder

IDA Plugin which decodes Windows Device I/O control code into DeviceType, FunctionCode, AccessType and MethodType.
Python
106
star
21

FU_Hypervisor

A hypervisor hiding user-mode memory using EPT
C
104
star
22

WPBT-Builder

The simple UEFI application to create a Windows Platform Binary Table (WPBT) from the UEFI shell.
C
100
star
23

HelloSmm

This is an instruction to run your own SMM code.
C
100
star
24

DebugLogger

A software driver that lets you log kernel-mode debug output into a file on Windows.
C++
97
star
25

Hello-VT-rp

A simple hypervisor demonstrating the use of the Intel VT-rp (redirect protection) technology.
Rust
91
star
26

kraft_dinner

Tool to dump UEFI runtime drivers implementing runtime services for Windows
C
90
star
27

HelloAmdHvPkg

HelloAmdHvPkg is a type-1 research hypervisor for AMD processors.
C
86
star
28

CVE-2023-36427

Report and exploit of CVE-2023-36427
C++
86
star
29

Scavenger

A minifilter driver preserves all modified and deleted files.
C
77
star
30

RemoteWriteMonitor

A tool to help malware analysts tell that the sample is injecting code into other process.
C++
74
star
31

meow

nyฤ
C++
70
star
32

HelloIommuPkg

The sample DXE runtime driver demonstrating how to program DMA remapping.
C
57
star
33

DumpVTable

Generates a Python script to give public interface names in an ActiveX file to an IDB file.
C++
47
star
34

DrvLoader

A command line tool to load and unload a device driver.
C++
42
star
35

CVE-2022-25949

A years-old exploit of a local EoP vulnerability in Kingsoft Antivirus KWatch Driver version 2009.3.17.77.
C++
35
star
36

cs_driver

A sample project for using Capstone from a driver in Visual Studio 2015
C
34
star
37

CVE-2024-21305

Report and exploit of CVE-2024-21305.
C++
30
star
38

CVE-2014-0816

CVE-2014-0816
C++
24
star
39

tandasat.github.io

HTML
17
star
40

hyperplatform_log_parser

User-mode program parsing logs created by HyperPlatform
C++
17
star
41

ProjectLoadTimeMonitor

The Visual Studio extension that measures load time of each project when a solution file is opened.
C#
16
star
42

recon2024_demo

Provides commands to read from and write to arbitrary kernel-mode memory for users with the Administrator privilege. HVCI compatible. No test signing mode is required.
C++
14
star
43

CheckSDL

A tool evaluates security configurations of a given PE based on SDL without source code
C++
12
star
44

ListWorkItems

Lists work items being queued currently.
C++
12
star
45

DeviceOpener

A command line tool to check if a specified device is accessible.
C++
10
star
46

List-UEFI-Configuration-Tables

List UEFI Configuration Tables
Rust
10
star
47

windbg_init

Windbg Init Script
9
star
48

ScopedResource

Scoped Resource - Generic RAII Wrapper for the Standard Library by Peter Sommerlad and Andrew L. Sandoval
C++
8
star
49

win32_debugout

Shows debug strings on DebubView from an attached process by win32_remote.exe.
C++
8
star
50

ping_vmm

A user-mode program knocking at HyperPlatform's "backdoor"
C++
7
star
51

SecRuntimeSample

A sample usege of SecRuntime.dll on Windows Phone
C++
4
star
52

blog

Ruby
4
star
53

CopyFiles

Copy files onto the IsolatedStorage so that you can download them using IsoStoreSpy.
C#
3
star
54

mylight

Using LED of Samsung Galaxy Ace S5830
Java
2
star
55

tandasat

2
star
56

shared

Manages files that are shared with multiple boxes.
Vim Script
1
star