Untitled

 avatar
unknown
plain_text
2 months ago
773 B
90
Indexable
void EnableHyperVHook()
{
    __writemsr(IA32_FEATURE_CONTROL_MSR, __readmsr(IA32_FEATURE_CONTROL_MSR) | (1 << 2));

    ULONG64 cr4 = __readcr4();
    cr4 |= (1 << 13);
    __writecr4(cr4);

    *(ULONG64*)VMXON_REGION = __readmsr(0x480);
    if (__vmx_on(&VMXON_REGION) != 0) {
        return;
    }

    OriginalMSRLSTAR = __readmsr(IA32_LSTAR_MSR);
    __writemsr(IA32_LSTAR_MSR, (ULONG64)CustomSyscallHandler);

    
    while (TRUE) {
        __vmx_vmresume();
        ULONG ExitReason = __vmread(VM_EXIT_REASON);
        if (ExitReason == 0x1E) { // MSR Access
            ULONG MSR = (ULONG)__vmread(0x4406);
            if (MSR == IA32_LSTAR_MSR) {
               // msr blocked
                continue;
            }
        }
    }
}
Editor is loading...
Leave a Comment