Thoughts and notes about platform security, reverse engineering, system programming and other low-level stuff.
This post introduces one of the virtualization features needed to keep kernel-mode shadow stack functional against kernel exploits: supervisor shadow stack restrictions / supervisor shadow-stack control.
This two-post series details the inner workings of System Management Mode (SMM) isolation on the Intel platform and interaction with Windows.
This two-post series details the inner workings of System Management Mode (SMM) isolation on the Intel platform and interaction with Windows.
This post aims to clarify security policies implemented by the Windows hypervisor for the root partition VTL 0 (NTOS), 1 (secure kernel), and a child partition (guest VM) by comparing their VMCSes on an Intel platform.
Discovery to reporting Discovery Exploitation Partial root causing Reporting Technical details and fixes Intel VT-x and its limitation Intel VT-d DMA remapping DMAR ACPI table and RMRR structure Interaction with Windows, and the bug Fixes Summary
Finding and Exploitation How it started The bug Validation Exploitation with S3/S4 Thoughts Verify your assumption Not so many eyeballs Same bug might exist elsewhere Security feature bypass matters Security research can yield vulnerabilities Footnotes
Paging-write (PW) Protecting the hypervisor-managed paging structures PW as performance optimization Demo - read-only paging structures Guest-paging verification (GPV) Demo - preventing aliasing Side discussions Code-integrity protection v.s. the remapping attack Relevant security features Conclusion Notes
EPT-based security and an attack against it Bypassing KDP with the remapping attack Demo - making ci!g_CiOptions zero under KDP Intel VT Redirect Protection (VT-rp) HLAT and the remapping attack Demo - protecting ci!g_CiOptions with HLAT Availability Conclusion Acknowledgement Notes
This post notes how to enable a debugger for winload, tcblaunch and Hyper-V on a physical device over USB EEM. This instruction may be helpful when a target device cannot be debugged with any of other debugging interfaces like traditional KDNET and USB3.
We migrated from standa-note.blogspot.com!