Skip to content

Commit

Permalink
update
Browse files Browse the repository at this point in the history
  • Loading branch information
SinaKarvandi committed Jul 13, 2024
1 parent 63816d8 commit 8c824e2
Show file tree
Hide file tree
Showing 7 changed files with 23 additions and 5 deletions.
4 changes: 3 additions & 1 deletion _posts/2018-09-03-hypervisor-from-scratch-part-2.md
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,8 @@ author:

![](../../assets/images/hypervisor-from-scratch-2-cover.png)

**If you're looking to use a hypervisor for analysis and reverse engineering tasks, check out [HyperDbg](https://github.com/HyperDbg/HyperDbg) Debugger. It's a hypervisor-based debugger designed specifically for analyzing, fuzzing, and reversing applications.**

## **Introduction**

It's the second part of a multiple series of a tutorial called "**Hypervisor From Scratch**". First, please consider reading the [first part](https://rayanfam.com/topics/hypervisor-from-scratch-part-1/) (Basic Concepts & Configure Testing Environment) before reading this part, as it contains the essential knowledge you need to know in order to understand the rest of this tutorial. In this part, we'll talk about WDK drivers and finally start enabling VT-x.
Expand Down Expand Up @@ -491,7 +493,7 @@ In this part, we learned about the basic stuff we need to know to create a Windo

In the third part, we're getting deeper with Intel VT-x and making our driver even more advanced.

Note: Remember that hypervisors change over time because new features are added to the operating systems or using new technologies. For example, updates to Meltdown & Spectre have made a lot of changes to the hypervisors, so if you want to use Hypervisor From Scratch in your projects, research, or whatever, you have to use the driver from the latest parts of these tutorial series as this tutorial is actively updated and changes are applied to the newer parts (earlier parts keep untouched) so you might encounter errors and instability problems in the earlier parts thus make sure to use the latest parts in real-world projects.
Note: Remember that hypervisors change over time because new features are added to the operating systems or new technologies are used. For example, updates to Meltdown & Spectre have made a lot of changes to the hypervisors. So, if you want to use Hypervisor From Scratch in your projects, research, or whatever, you should use the [**HyperDbg**](https://github.com/HyperDbg/HyperDbg) drivers. **HyperDbg** is actively maintained, stable, and reliable, ensuring you avoid the errors and instability problems that can arise from using older parts of the tutorial series.

The third part is also available [here].(https://rayanfam.com/topics/hypervisor-from-scratch-part-3/).

Expand Down
4 changes: 3 additions & 1 deletion _posts/2018-09-15-hypervisor-from-scratch-part-3.md
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,8 @@ author:

![](../../assets/images/hypervisor-from-scratch-3-cover.png)

**If you're looking to use a hypervisor for analysis and reverse engineering tasks, check out [HyperDbg](https://github.com/HyperDbg/HyperDbg) Debugger. It's a hypervisor-based debugger designed specifically for analyzing, fuzzing, and reversing applications.**

## **Introduction**

This is the third part of the tutorial "**Hypervisor From Scratch**". In this part, we'll continue our journey toward learning hypervisors and how to start creating our custom VMM. In the previous part, we learned how to make WDK drivers that handle user-mode requests and enable the VMX bit in our processor. In this part, we extend our driver and add VMX functionalities to our VMM. At last, we use different VT-x instructions in the VMM.
Expand Down Expand Up @@ -852,7 +854,7 @@ In the future, we'll focus on Exteneded Page Table (EPT), VMCS, and different ac

The fourth part is also available [here].(https://rayanfam.com/topics/hypervisor-from-scratch-part-4/).

Note: Remember that hypervisors change over time because new features are added to the operating systems or using new technologies. For example, updates to Meltdown & Spectre have made a lot of changes to the hypervisors, so if you want to use Hypervisor From Scratch in your projects, research, or whatever, you have to use the driver from the latest parts of these tutorial series as this tutorial is actively updated and changes are applied to the newer parts (earlier parts keep untouched) so you might encounter errors and instability problems in the earlier parts thus make sure to use the latest parts in real-world projects.
Note: Remember that hypervisors change over time because new features are added to the operating systems or new technologies are used. For example, updates to Meltdown & Spectre have made a lot of changes to the hypervisors. So, if you want to use Hypervisor From Scratch in your projects, research, or whatever, you should use the [**HyperDbg**](https://github.com/HyperDbg/HyperDbg) drivers. **HyperDbg** is actively maintained, stable, and reliable, ensuring you avoid the errors and instability problems that can arise from using older parts of the tutorial series.

## **References**

Expand Down
4 changes: 4 additions & 0 deletions _posts/2018-10-05-hypervisor-from-scratch-part-4.md
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,8 @@ author:

![](../../assets/images/hypervisor-from-scratch-4-cover.png)

**If you're looking to use a hypervisor for analysis and reverse engineering tasks, check out [HyperDbg](https://github.com/HyperDbg/HyperDbg) Debugger. It's a hypervisor-based debugger designed specifically for analyzing, fuzzing, and reversing applications.**

## **Introduction**

Welcome to the 4th part of the "**Hypervisor From Scratch**". This part primarily involves translating guest addresses through **Extended Page Table (EPT)** and its implementation. We also see how shadow tables work and basic concepts about EPT.
Expand Down Expand Up @@ -66,6 +68,8 @@ Before starting, I should give my thanks to [Petr Beneš](https://twitter.com/Pe

**Note:** This part tends to give you basic information about EPT. The main implementation of EPT for our hypervisor is explained in [part 7](https://rayanfam.com/topics/hypervisor-from-scratch-part-7/). In part 7, we used the concept we learned here to implement EPT on an already virtualized system.

Note: Remember that hypervisors change over time because new features are added to the operating systems or new technologies are used. For example, updates to Meltdown & Spectre have made a lot of changes to the hypervisors. So, if you want to use Hypervisor From Scratch in your projects, research, or whatever, you should use the [**HyperDbg**](https://github.com/HyperDbg/HyperDbg) drivers. **HyperDbg** is actively maintained, stable, and reliable, ensuring you avoid the errors and instability problems that can arise from using older parts of the tutorial series.

## **Second Level Address Translation (SLAT)**

**Second Level Address Translation** (**SLAT**) or nested paging is an extended layer in the paging mechanism used to map hardware-based virtualization virtual addresses into the physical memory.
Expand Down
4 changes: 3 additions & 1 deletion _posts/2018-12-16-hypervisor-from-scratch-part-5.md
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,8 @@ author:

![](../../assets/images/hypervisor-from-scratch-part-5-cover.png)

**If you're looking to use a hypervisor for analysis and reverse engineering tasks, check out [HyperDbg](https://github.com/HyperDbg/HyperDbg) Debugger. It's a hypervisor-based debugger designed specifically for analyzing, fuzzing, and reversing applications.**

## **Introduction**

Hello and welcome to the fifth part of the "**Hypervisor From Scratch**" tutorial series. Today we will spend our time studying different parts of Virtual Machine Control Structure (VMCS), implementing additional VMX instructions, creating a restore point, setting different VMCS control structures, and at last, we execute **VMLAUNCH** and enter the hardware virtualization world!
Expand Down Expand Up @@ -72,7 +74,7 @@ The full source code of this tutorial is available on GitHub :

\[[https://github.com/SinaKarvandi/Hypervisor-From-Scratch](https://github.com/SinaKarvandi/Hypervisor-From-Scratch)\]

**Note**: Remember that hypervisors change over time because new features are added to the operating systems or using new technologies. For example, updates to Meltdown & Spectre have made a lot of changes to the hypervisors, so if you want to use Hypervisor From Scratch in your projects, research, or whatever, you have to use the driver from the latest parts of these tutorial series as this tutorial is actively updated and changes are applied to the newer parts (earlier parts keep untouched) so you might encounter errors and instability problems in the earlier parts thus make sure to use the latest parts in real-world projects.
Note: Remember that hypervisors change over time because new features are added to the operating systems or new technologies are used. For example, updates to Meltdown & Spectre have made a lot of changes to the hypervisors. So, if you want to use Hypervisor From Scratch in your projects, research, or whatever, you should use the [**HyperDbg**](https://github.com/HyperDbg/HyperDbg) drivers. **HyperDbg** is actively maintained, stable, and reliable, ensuring you avoid the errors and instability problems that can arise from using older parts of the tutorial series.

![](../../assets/images/anime-girl-in-city.png)

Expand Down
4 changes: 3 additions & 1 deletion _posts/2019-02-25-hypervisor-from-scratch-part-6.md
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,8 @@ author:

![](../../assets/images/hypervisor-from-scratch-6-cover.png)

**If you're looking to use a hypervisor for analysis and reverse engineering tasks, check out [HyperDbg](https://github.com/HyperDbg/HyperDbg) Debugger. It's a hypervisor-based debugger designed specifically for analyzing, fuzzing, and reversing applications.**

## Introduction

Hello and welcome to the 6th part of the tutorial **Hypervisor From Scratch**. In this part, we'll learn how to virtualize an already running system using our custom-made hypervisor. Like other parts, this part depends on the previous parts, so make sure to read them first.
Expand Down Expand Up @@ -69,7 +71,7 @@ The full source code of this tutorial is available on GitHub :

\[[https://github.com/SinaKarvandi/Hypervisor-From-Scratch](https://github.com/SinaKarvandi/Hypervisor-From-Scratch)\]

**Note:** Please keep in mind that hypervisors change during the time because new features are added to the operating systems or using new technologies. For example, updates to Meltdown & Spectre have made a lot of changes to the hypervisors, so if you want to use Hypervisor From Scratch in your projects, research, or whatever, you have to use the driver from the latest parts of these tutorial series as this tutorial is actively updated and changes are applied to the newer parts (earlier parts keep untouched) so you might encounter errors and instability problems in the earlier parts thus make sure to use the latest parts in real-world projects.
Note: Remember that hypervisors change over time because new features are added to the operating systems or new technologies are used. For example, updates to Meltdown & Spectre have made a lot of changes to the hypervisors. So, if you want to use Hypervisor From Scratch in your projects, research, or whatever, you should use the [**HyperDbg**](https://github.com/HyperDbg/HyperDbg) drivers. **HyperDbg** is actively maintained, stable, and reliable, ensuring you avoid the errors and instability problems that can arise from using older parts of the tutorial series.

Please make sure to have your own lab to test your hypervisor. I tested my hypervisor on the 7th generation of Intel processors, so if you use an older processor, it might not support some features on your processor, and without a remote kernel debugger (not the local kernel debugger), you might see your system halting or BSODs without understanding the actual error.

Expand Down
6 changes: 5 additions & 1 deletion _posts/2020-01-20-hypervisor-from-scratch-part-7.md
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,8 @@ author:

![](../../assets/images/hypervisor-from-scratch-7-cover.png)

**If you're looking to use a hypervisor for analysis and reverse engineering tasks, check out [HyperDbg](https://github.com/HyperDbg/HyperDbg) Debugger. It's a hypervisor-based debugger designed specifically for analyzing, fuzzing, and reversing applications.**

## **Introduction**

This is the 7th part of the tutorial Hypervisor From Scratch, and it's about using the **E**xtended **P**age **T**able (**EPT**) in an already running system. As you might know, paging is an essential part of managing memory on modern operating systems. Hypervisors use an additional paging table; this gives us an excellent opportunity to monitor different aspects of memory (**R**ead-**W**rite-**E**xecute) without modifying the operating systems page-tables. EPT is a hardware mechanism, so it's fast, but on the other hand, we have to deal with different caching and synchronization problems.
Expand Down Expand Up @@ -70,6 +72,8 @@ The full source code of this tutorial is available on GitHub :

\[[https://github.com/SinaKarvandi/Hypervisor-From-Scratch](https://github.com/SinaKarvandi/Hypervisor-From-Scratch)\]

Note: Remember that hypervisors change over time because new features are added to the operating systems or new technologies are used. For example, updates to Meltdown & Spectre have made a lot of changes to the hypervisors. So, if you want to use Hypervisor From Scratch in your projects, research, or whatever, you should use the [**HyperDbg**](https://github.com/HyperDbg/HyperDbg) drivers. **HyperDbg** is actively maintained, stable, and reliable, ensuring you avoid the errors and instability problems that can arise from using older parts of the tutorial series.

# **Table of Contents**

- **Introduction**
Expand Down Expand Up @@ -2133,7 +2137,7 @@ Finally, you can see the following picture which shows whether our hook successf

# **Discussion**

This part is added to answer to questions about EPT, we'll discuss different approaches and pros and cons of them, so this part will be actively updated. Thanks to Petr for answering these questions.
This part is added to answer to questions about EPT, we'll discuss different approaches and pros and cons of them. Thanks to Petr for answering these questions.

**1\. Why there are limitations on calling NT functions in VMX Root Mode?**

Expand Down
2 changes: 2 additions & 0 deletions _posts/2020-03-24-hypervisor-from-scratch-part-8.md
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,8 @@ author:

![](../../assets/images/hypervisor-from-scratch-8-cover.png)

**If you're looking to use a hypervisor for analysis and reverse engineering tasks, check out [HyperDbg](https://github.com/HyperDbg/HyperDbg) Debugger. It's a hypervisor-based debugger designed specifically for analyzing, fuzzing, and reversing applications.**

## **Introduction**

Hi guys,
Expand Down

0 comments on commit 8c824e2

Please sign in to comment.