Comments (9)
@marcussacana, the only way to change CPUID is use hypervisor (hypervisor and virtual machine is the same thing). If you want to do it, you should write a hypervisor using AMD-V/RVI or VT-x/EPT depending on your processor. And then you can catch #VMEXIT on CPUID call and change all registers you want:
https://wasm.in/attachments/05-01-2019-22-52-48-png.4425
from kernel-bridge.
@avalon1337 Yes, you can implement a kernel debugger using a hypervisor and your own int3-handler (handler of breakpoint). You should overwrite an existing handler in IDT and hide this modification from PatchGuard by hypervisor. It is the most simple way to debug instructions one-by-one.
from kernel-bridge.
@HoShiMin I don't wanted create an issue just to do a question, this issue make me think, is possible run a proccess with an fake cpuid without use Virtual machines?, maybe run a program with hypervisor...?
In the true I have no need to fake my cpuid, but this make me think, how hard is to fake the cpuid? since we have many programs that use this instruction to fingerprint the computer...
from kernel-bridge.
Interesting, I always thought of hyper-v as a hardware-level sandbox... but in the end it is equivalent to a VM...
from kernel-bridge.
@marcussacana, exactly. Hyper-V/ESXi/Citrix are Type-1 hypervisors (running directly on the system hardware - your 'host' Windows with enabled Hyper-V works under hypervisor), VMware/VirtualBox/KVM/etc. - are Type-2 hypervisors (running on a host OS). For your task is more convinient to develop a Type-2 hypervisor (just a Windows driver) and virtualize an already running OS.
from kernel-bridge.
I see, thanks for taking my doubts, well, even if I wanted to do it I would have to study a lot more about programming of a more 'low level', which I am not so well versed with;
One last doubt, when you say that a VM is necessary for this, in the end it is possible to isolate just a single program running on OS Host with the Hyper-V?, I mean, without having to virtualize an entire guest operating system like vmware/vbox...
from kernel-bridge.
@marcussacana, hypervisor is the processor-wide technology, not the process-wide. You can't virtualize only the app, because the processor knows nothing about processes and even about OS. Anyway, you virtualize all entire system (or rather CPU logical core(s) that executes code of all processes in the system). If you want per-process filtering, you can implement it in your VMM (e.g., you can filter processes by CR3 register as it shows you per-process address space, or you can read the PID from the PEB directly - there are much ways to do what you want).
from kernel-bridge.
I see, that clarifies my doubts, you even looked like an encyclopedia now :) thanks for your patience.
from kernel-bridge.
@marcussacana, you're welcome ^_^
from kernel-bridge.
Related Issues (20)
- How can i load unsigned driver with this signed driver ?
- Windows on ARM, Support? HOT 1
- C++ exception handling is not supported with /kernel HOT 4
- Fastest way to read process memory HOT 10
- N HOT 1
- CppSupport BSOD
- signed binaries can not be loaded HOT 8
- add APIs HOT 1
- Does KbCreateUserThread support windows7 HOT 2
- KbWriteProcessMemory HOT 5
- Compiler crash in 'VMX.h'
- How to use the hypervisor to change the CPUID values? HOT 2
- how to find the process name or id which causes the VM EXIT in hypervisor mode HOT 2
- how to intercept KUSER_SHARED_DATA using Hypervisor?
- Error install HOT 4
- Memory leak at StringAPI operator +
- What are SVM & MSR_VM_CR ? HOT 1
- vlang support
- invalid
- Try using the serialization library based on your CppSupport HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from kernel-bridge.