From 40bfc1f78d5959bee41c00ceccf8142d57673648 Mon Sep 17 00:00:00 2001 From: xerox Date: Sat, 3 Oct 2020 09:16:18 +0000 Subject: [PATCH] Update README.md --- README.md | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/README.md b/README.md index 6762e1d..d3edb13 100644 --- a/README.md +++ b/README.md @@ -20,6 +20,27 @@ and interception can commence. The payload solution contains a small CPUID interception example. I plan on expanding my examples to include EPT hooking and module injection/module shadowing. I also need to locate the self referencing pml4e in hyper-v's pml4 :|.... +```cpp +svm::pgs_base_struct vmexit_handler(void* unknown, svm::pguest_context context) +{ + const auto vmcb = *reinterpret_cast( + *reinterpret_cast( + *reinterpret_cast( + __readgsqword(0) + offset_vmcb_base) + + offset_vmcb_link) + offset_vmcb); + + if (vmcb->exitcode == VMEXIT_CPUID && context->rcx == VMEXIT_KEY) + { + vmcb->rax = 0xC0FFEE; + vmcb->rip = vmcb->nrip; + return reinterpret_cast(__readgsqword(0)); + } + + return reinterpret_cast( + reinterpret_cast(&vmexit_handler) - + svm::voyager_context.vcpu_run_rva)(unknown, context); +} +``` # Voyager 2 - AMD