corpus.blog
41554 blogs · 4,450,554 posts Claim your blog
Record · corpus.blog/posts/01a08c59-4483-7052-a96d-c2f97830aa28

From firmware to VBS enclave: bootkitting Hyper-V

tulach.cc · published 8 December 2024

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at tulach.cc Wayback capture
0blogs citing
First cited
—
Most recent
—
Rank this month
not ranked
Links from this post
55
Words captured
15,079

Cited by

No blog we hold has cited this post yet.

Links from this post

Link
Host
Using VBS enclaves for anti-cheat purposes Read at the source ↗
tulach.cc
https://learn.microsoft.com/en-us/windows/win32/trusted-execution/vbs-enclaves
learn.microsoft.com
https://github.com/SamuelTulach/SecureGame
github.com
The issue of anti-cheat on Linux Read at the source ↗
tulach.cc
https://github.com/SamuelTulach/SecureHack
github.com
https://learn.microsoft.com/en-us/windows-hardware/drivers/install/the-testsigning-boot-configuration-option
learn.microsoft.com
https://en.wikipedia.org/wiki/Hyper-V
en.wikipedia.org
https://www.microsoft.com/en-us/windows
microsoft.com
https://en.wikipedia.org/wiki/UEFI
en.wikipedia.org
https://en.wikipedia.org/wiki/EFI_system_partition
en.wikipedia.org
https://tianocore-docs.github.io/edk2-ModuleWriteGuide/draft/4_uefi_applications/
tianocore-docs.github.io
https://github.com/tianocore/edk2-archive/tree/master/ShellBinPkg/UefiShell
github.com
https://uefi.org/specs/UEFI/2.9_A/07_Services_Boot_Services.html
uefi.org
https://en.wikipedia.org/wiki/NTFS
en.wikipedia.org
https://learn.microsoft.com/en-us/windows/win32/debug/pe-format
learn.microsoft.com
https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-vbs
learn.microsoft.com
https://learn.microsoft.com/en-us/virtualization/hyper-v-on-windows/tlfs/vsm
learn.microsoft.com
https://blog.back.engineering/researchers/_xeroxz/
blog.back.engineering
https://git.back.engineering/IDontCode/Voyager
git.back.engineering
https://blog.back.engineering/20/04/2021/
blog.back.engineering
https://github.com/Cr4sh
github.com
https://github.com/Cr4sh/s6_pcie_microblaze/tree/master/python/payloads/DmaBackdoorHv
github.com
https://tianocore-docs.github.io/edk2-ModuleWriteGuide/draft/5_uefi_drivers/
tianocore-docs.github.io
https://uefi.org/specs/UEFI/2.10/08_Services_Runtime_Services.html
uefi.org
https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-secure-boot
learn.microsoft.com
https://uefi.org/specs/UEFI/2.10/04_EFI_System_Table.html
uefi.org
https://en.wikipedia.org/wiki/Cyclic_redundancy_check
en.wikipedia.org
https://learn.microsoft.com/en-us/cpp/intrinsics/returnaddress?view=msvc-170
learn.microsoft.com
https://github.com/SamuelTulach/LightHook
github.com
https://en.wikipedia.org/wiki/Memory_protection
en.wikipedia.org
https://www.0x04.net/doc/amd/33047.pdf
0x04.net
https://github.com/tandasat/SimpleSvm/blob/master/SimpleSvm/SimpleSvm.cpp
github.com
https://learn.microsoft.com/en-us/cpp/build/x64-calling-convention?view=msvc-170
learn.microsoft.com
https://nskernel.gitbook.io/kernel-play-guide/kvm/amd-v-and-sev
nskernel.gitbook.io
https://en.wikipedia.org/wiki/Hyperjacking
en.wikipedia.org
https://en.wikipedia.org/wiki/Virtual_memory
en.wikipedia.org
https://en.wikipedia.org/wiki/Page_table
en.wikipedia.org
https://projectacrn.github.io/latest/developer-guides/hld/hv-memmgt.html
projectacrn.github.io
https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/
learn.microsoft.com
https://learn.microsoft.com/en-us/virtualization/hyper-v-on-windows/tlfs/hypercalls/hvcallvtlreturn
learn.microsoft.com
https://learn.microsoft.com/en-us/virtualization/hyper-v-on-windows/tlfs/hypercall-interface
learn.microsoft.com
https://github.com/MicrosoftDocs/Virtualization-Documentation/blob/main/tlfs/Hypervisor%20Top%20Level%20Functional%20Specification%20v5.0C.pdf
github.com
https://learn.microsoft.com/en-us/windows/win32/sysinfo/handles-and-objects
learn.microsoft.com
https://learn.microsoft.com/en-us/cpp/c-runtime-library/crt-library-features?view=msvc-170
learn.microsoft.com
https://learn.microsoft.com/en-us/cpp/build/reference/compiler-options?view=msvc-170
learn.microsoft.com
https://en.wikipedia.org/wiki/Advanced_Vector_Extensions
en.wikipedia.org
https://en.wikipedia.org/wiki/System_call
en.wikipedia.org
https://learn.microsoft.com/en-us/windows-hardware/drivers/gettingstarted/virtual-address-spaces
learn.microsoft.com
https://learn.microsoft.com/en-us/windows/win32/api/tlhelp32/nf-tlhelp32-createtoolhelp32snapshot
learn.microsoft.com
https://learn.microsoft.com/en-us/windows/win32/api/tlhelp32/nf-tlhelp32-module32first
learn.microsoft.com
https://systeminformer.com/
systeminformer.com
https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-ntqueryvirtualmemory
learn.microsoft.com
https://processhacker.sourceforge.io/doc/ntmmapi_8h.html
processhacker.sourceforge.io
https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/symbols
learn.microsoft.com
https://en.wikipedia.org/wiki/Category:Anti-cheat_software
en.wikipedia.org