From 40bfc1f78d5959bee41c00ceccf8142d57673648 Mon Sep 17 00:00:00 2001
From: xerox <xerox@back.engineering>
Date: Sat, 3 Oct 2020 09:16:18 +0000
Subject: [PATCH] Update README.md

---
 README.md | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/README.md b/README.md
index 6762e1d..d3edb13 100644
--- a/README.md
+++ b/README.md
@@ -20,6 +20,27 @@ and interception can commence.
 The payload solution contains a small CPUID interception example. I plan on expanding my examples to include EPT hooking and module injection/module shadowing. I also
 need to locate the self referencing pml4e in hyper-v's pml4 :|....
 
+```cpp
+svm::pgs_base_struct vmexit_handler(void* unknown, svm::pguest_context context)
+{
+	const auto vmcb = *reinterpret_cast<svm::pvmcb*>(
+		*reinterpret_cast<u64*>(
+			*reinterpret_cast<u64*>(
+				__readgsqword(0) + offset_vmcb_base) 
+					+ offset_vmcb_link) + offset_vmcb);
+
+	if (vmcb->exitcode == VMEXIT_CPUID && context->rcx == VMEXIT_KEY)
+	{
+		vmcb->rax = 0xC0FFEE;
+		vmcb->rip = vmcb->nrip;
+		return reinterpret_cast<svm::pgs_base_struct>(__readgsqword(0));
+	}
+
+	return reinterpret_cast<svm::vcpu_run_t>(
+		reinterpret_cast<u64>(&vmexit_handler) -
+			svm::voyager_context.vcpu_run_rva)(unknown, context);
+}
+```
 
 # Voyager 2 - AMD