SimpleSvmHook | research purpose hypervisor for Windows on AMD processors | Infrastructure Automation library

SimpleSvmHook is a C++ library typically used in Devops, Infrastructure Automation applications. SimpleSvmHook has no bugs, it has no vulnerabilities, it has a Permissive License and it has low support. You can download it from GitHub.

A stealth hook is a type of hook that is not visible from the outside of the monitor or inspector component. In the context of VMI, stealth hook is installed and managed by a hypervisor into guest code to redirect execution of specified addresses while being not easily detectable by the guest. One of common ways to implement stealth hook within a hypervisor is to split “view” of memory for read/write and execute access from the guest using Second Level Address Translation (SLAT), namely, Extended Page Table (EPT) on Intel and Nested Page Tables (NPT) for AMD processors. SLAT introduces one more address translation step, that is, translation from the guest physical address (GPA) to the system physical address (SPA). This essentially allows a hypervisor to set up a mapping of a virtual address in the guest and a backing physical memory address. The below diagram illustrates how SLAT can be configured and address translation will result in. SLAT can also configure permission of the GPA against the guest; for instance, GPA:0x2000 can be configured as readable/writable but not executable. When the guest attempts to access a GPA in a way not permitted by SLAT, the processor triggers VM-exit so that a hypervisor can take necessary actions, such as updating the permission or inject #GP into the guest. Stealth hook is often implemented by leveraging those capabilities. Take DdiMon as an example, when the hypervisor installs stealth hook, it creates a copy of the target page, sets 0xCC into the address to hook, then sets up EPT to make the page execute-only (0xb000 in the below example). When the guest attempts to execute the address, the hypervisor: 1. traps #BP 2. changes the instruction pointer of the guest to our handler function 3. lets the guest run. and when the guest attempts to read from or write to the address, the hypervisor: 1. traps VM-exit caused due to access violation 2. updates EPT to associate the address with the copied page, which does not contain 0xCC, with the readable/writable permission. Those operations allow the hypervisor to redirect execution of the guest while keeping the hook invisible from the guest. Also, notice that EPT configurations are reverted to the original state, and the next execute or read/write access can be handled in the same way. However, this cannot be implemented directly on AMD processors.