Untitled
unknown
plain_text
9 months ago
773 B
91
Indexable
void EnableHyperVHook()
{
__writemsr(IA32_FEATURE_CONTROL_MSR, __readmsr(IA32_FEATURE_CONTROL_MSR) | (1 << 2));
ULONG64 cr4 = __readcr4();
cr4 |= (1 << 13);
__writecr4(cr4);
*(ULONG64*)VMXON_REGION = __readmsr(0x480);
if (__vmx_on(&VMXON_REGION) != 0) {
return;
}
OriginalMSRLSTAR = __readmsr(IA32_LSTAR_MSR);
__writemsr(IA32_LSTAR_MSR, (ULONG64)CustomSyscallHandler);
while (TRUE) {
__vmx_vmresume();
ULONG ExitReason = __vmread(VM_EXIT_REASON);
if (ExitReason == 0x1E) { // MSR Access
ULONG MSR = (ULONG)__vmread(0x4406);
if (MSR == IA32_LSTAR_MSR) {
// msr blocked
continue;
}
}
}
}Editor is loading...
Leave a Comment