Untitled
unknown
plain_text
2 months ago
773 B
90
Indexable
void EnableHyperVHook() { __writemsr(IA32_FEATURE_CONTROL_MSR, __readmsr(IA32_FEATURE_CONTROL_MSR) | (1 << 2)); ULONG64 cr4 = __readcr4(); cr4 |= (1 << 13); __writecr4(cr4); *(ULONG64*)VMXON_REGION = __readmsr(0x480); if (__vmx_on(&VMXON_REGION) != 0) { return; } OriginalMSRLSTAR = __readmsr(IA32_LSTAR_MSR); __writemsr(IA32_LSTAR_MSR, (ULONG64)CustomSyscallHandler); while (TRUE) { __vmx_vmresume(); ULONG ExitReason = __vmread(VM_EXIT_REASON); if (ExitReason == 0x1E) { // MSR Access ULONG MSR = (ULONG)__vmread(0x4406); if (MSR == IA32_LSTAR_MSR) { // msr blocked continue; } } } }
Editor is loading...
Leave a Comment