A really simple and lightweight x64 hypervisor written in C for Intel processors.
- IDT Shadowing
- EPT violation #VE (if not available natively, it will keep using VM-Exit instead)
- EPTP switching VMFUNC (if not available natively, it will be emulated using a VMCALL)
- APIC virtualization
- VMX Nesting
You may have already guessed from the Features
part, if not, here are some reasons:
- Do not implement the new processor features KSM implements (VMFUNC, #VE, etc.)
- Are not simple enough to work with or understand
- Simply, just have messy code base or try too hard to implement endless C++ features that just make code ugly.
- Too big code base and do not have the same purpose (e.g. research or similar)
Such features for such purpose is really crucial, for my purpose, I wanted a quicker physical memory virtualization technique that I can relay on.
- An Intel processor (with VT-x and EPT support)
- A working C compiler (GCC or CLang or Microsoft compiler (CL)). You can use VS 2015.
- UEFI
- Intel TXT
Since #VE and VMFUNC are now optional and will not be enabled unless the CPU support it, you can now test under VMs with emulation for VMFUNC.
if you're live debugging then you may want to disable `SECONDARY_EXEC_DESC_TABLE_EXITING` in vcpu.c in secondary controls,
otherwise it makes WinDBG go *maniac*. I have not investigated the root cause, but it keeps loading GDT and LDT all the time,
which is _insane_.
All x64 NT kernels starting from the Windows 7 NT kernel. It was mostly tested under Windows 7/8/8.1/10.
- Port
mm.h
functions (mm_alloc_pool, mm_free_pool, __mm_free_pool
). You'll need__get_free_page
instead ofExAllocatePool
. - Port
acpi.c
(not really needed) for re-virtualization on S1-3 or S4 state (commenting it out is OK). - Port
main.c
for some internal windows stuff, e.g.DriverEntry
, etc. Perhaps even rename to something like main_windows.c or similar. - Port
page.c
for the hooking example (not required, but it's essential to demonstrate usage).
Hopefully didn't miss something important, but these are definitely the mains.
Contributions are really appreciated and can be submitted by one of the following:
- Patches (e-mail)
- Github pull requests
- git request-pull
It'd be appreciated if you use a separate branch for your submissions (other than master, that is).
- APIC virtualization (Partially implemented)
- UEFI support
- Intel TXT support
- Nesting support (Partially implemented)
- More documentation
Simply make C=1
(if cross compiling under Linux) or mingw32-make
(under native).
The solution under ksm/
directory is a VS 2015 solution, you can use it to build, you'll
also need the Windows Driver Development Kit.
In commandline as administrator:
sc create ksm type= kernel binPath= C:\path\to\your\ksm.sys
sc start ksm
Unloading:
sc stop ksm
You can also use kload
Note: If the processor does not support VMFUNC or #VE, they will be disabled and instead, emulated via VM-exit.
- By enabling the descriptor table exiting bit in processor secondary control, we can easily establish this
- On initial startup, we allocate a completely new IDT base and copy the current one in use to it (also save the old one)
- When a VM-exit occurs with an
EXIT_REASON_GDT_IDT_ACCESS
, we simply just give them the cached one (on sidt) or (on lidt), we copy the new one's contents, discarding the hooked entries we know about, thus not letting them know about our stuff.
We use 3 EPT pointers, one for executable pages, one for readwrite pages, and last one for normal usage. (see next section)
-
vcpu.c
: insetup_vmcs()
where we initially setup the VMCS fields, we then set the relevant fields (VE_INFO_ADDRESS
,EPTP_LIST_ADDRESS
,VM_FUNCTION_CTL
) and enable relevant bits VE and VMFUNC in secondary processor control. -
x64.asm
(orx64.S
for GCC): which contains the#VE
handler (__ept_violation
) then does the usual interrupt handling and then calls__ept_handle_violation
(vcpu.c
) where it actually does what it needs to do. -
vcpu.c
: in__ept_handle_violation
(#VE
handler notVM-exit
), usually the processor will do the#VE
handler instead of the VM-exit route, but sometimes it won't do so if it's delivering another exception. This is very rare. -
vcpu.c
: while handling the violation via#VE
, we callvmfunc
only when we detect that the faulting address is one of our interest (e.g. a hooked page), then we determine whichEPTP
we want and executeVMFUNC
with that EPTP index.
(... to avoid a lot of violations, we just mark the page as execute only and replace the _final_ page frame
number so that it just goes straight ahead to our trampoline)
Since we use 3 EPT pointers, and since the page needs to be read and written to sometimes (e.g. patchguard
verification),
we also need to catch RW access to the page and then switch the EPTP appropriately according to
the access. In that case we switch over to EPTP_RWHOOK
to allow RW access only!
The third pointer is used for when we need to call the original function. The third pointer
has execute only access rights to the page with the sane page frame number.
You can define one or more of the following:
EPAGE_HOOK
- Enables executable page shadow hookENABLE_PML
- Enables Page Modification Log if supported.EMULATE_VMFUNC
- Forces emulation of VMFUNC even if CPU supports it.EPT_SUPPRESS_VE
- Force suppress VE bit in EPT.ENABLE_ACPI
- Enable S1-3-S4 power state monitoring for re-virtualizationNESTED_VMX
- Enable experimental VT-x nestingENABLE_FILEPRINT
- Available only whenDBG
is defined. Enables loggin to diskENABLE_DBGPRINT
- Available only whenDBG
is defined. EnablesDbgPrint
log.
You can report bugs by using Github issues, please provide the following:
- System information (version including build number, CPU information perhaps codename too)
- The git tree hash
- Anything else you feel is relevant
If it's a crash, please provide the following:
- A minidump (C:\windows\minidump) or a memory dump (C:\windows\memory.dmp). Former prefered.
- The compiled .sys and the .pdb/.dbg file
- The Kernel executable if possible, e.g. ntoskrnl.exe from C:\Windows\System32
- Linux kernel (KVM)
- HyperPlatform
GPL v2 firm, see LICENSE file.