xerox
18002353df
|
4 years ago | |
|---|---|---|
| Efi Bundler | 4 years ago | |
| Usermode Example | 4 years ago | |
| Voyager-1 | 4 years ago | |
| Voyager-2 | 4 years ago | |
| img | 4 years ago | |
| README.md | 4 years ago | |
| launch.bat | 4 years ago | |
README.md
Credit
- cr4sh - cr4sh has done something like this a few years back. A link to it can be found here.
- btbd - used utils.c/.h, also helped debug/fix issues, provided suggestions.
- edk2 - uefi library...
Voyager - A Hyper-V Hacking Framework For Windows 10 x64 (AMD & Intel)
Voyager is a project designed to offer module injection and vmexit hooking for both AMD & Intel versions of Hyper-V. This project works on all versions of Windows 10-x64 (2004-1511). The project is currently split into two individual projects, one for Intel and another for AMD.
Voyager 1 - Intel
Voyager 1 contains all the code associated with the Intel part of this project. Since intel has vmread/vmwrite instructions all that is needed is a simple hook on the vmexit handler and interception can commence.
The payload solution contains a small CPUID interception example. I plan on expanding my examples to include EPT hooking and module injection/module shadowing. I also need to locate the self referencing pml4e in hyper-v's pml4 :|....
Voyager 2 - AMD
Voyager 2 contains all the code associated with the AMD part of this project. Since AMD has no vmread/vmwrite operation, only vmsave/vmload I had to locate the linear virtual address of the VMCB for every version of windows. GS register contains a pointer to a structure defined by MS, this structure contains alot of stuff. Deep in this structure is a linear virtual address to the current cores VMCB.
Versions & Support
⭕ -> unknown/not tested. ✔️ -> tested & working. ❌ -> tested & not working.
| Winver | AMD | Intel | VM | Bare Metal |
|---|---|---|---|---|
| 2004 | ✔️ | ✔️ | ✔️ | ✔️ |
| 1909 | ✔️ | ✔️ | ✔️ | ✔️ |
| 1903 | ✔️ | ✔️ | ✔️ | ⭕ |
| 1809 | ✔️ | ✔️ | ✔️ | ⭕ |
| 1807 | ✔️ | ✔️ | ✔️ | ⭕ |
| 1803 | ✔️ | ✔️ | ✔️ | ⭕ |
| 1709 | ✔️ | ✔️ | ✔️ | ⭕ |
| 1703 | ✔️ | ✔️ | ✔️ | ⭕ |
| 1607 | ✔️ | ✔️ | ✔️ | ⭕ |
| 1511 | ✔️ | ✔️ | ✔️ | ⭕ |
Usage
Currently the project is configured in such a way where you replace bootmgfw.efi on your EFI partition with Voyager. This requires secure boot to be disabled. If by any chance Voyager crashes/something goes wrong simply reboot your computer since bootmgfw.efi is restored instantly. If there are any issues please let me know!