March 19, 2016 at 18:53GitHub publishes source code for compact hypervisor
Well-known guru of the Windows internal device and ARM architecture Alex Ionescu published on the GitHub resource the source code for the base part of the hypervisor (virtualization tool). The hypervisor contains many wonderful features, including compact size, support for modern microprocessor architectures, minimal use of assembler in the source, as well as comments on its use. During its development, emphasis was placed on maximum compactness.
The published project is a real find for system programmers, as well as security researchers who are interested in low-level OS functions. The hypervisor is called SimpleVisor, supports only modern 64-bit systems and has been successfully tested for compatibility with systems such as Windows 8.1 on the Intel Haswell architecture microprocessor, as well as Windows 10 on the Intel Sandy Bridge architecture.
As can be seen from the annotation, the source code of SimpleVisor took only 500 lines of C code and 10 lines of 64-bit assembler. The project itself was built using Visual Studio 2015 and this environment can also be used to build it.
SimpleVisor testing was carried out on the following platforms.
Fig. SimpleVisor source structure.
Fig. Part of the asm64 code from the shvx64.asm file, which is responsible for the intricacies of working with the AMD64 microprocessor.
SimpleVisor is a 64-bit driver designed to run on 64-bit versions of Windows 8.1 and Windows 10. To run successfully on the system, the driver must be digitally signed, for example, using the so-called. test certificate. Next, on Windows, you must enable the appropriate driver download mode with this signature using the well-known bcdedit command.
Next, create a driver service for the service control manager, this can be done using the following command.
The SimpleVisor driver supports both loading and unloading on the fly. To do this, you can use the following commands.
The published project is a real find for system programmers, as well as security researchers who are interested in low-level OS functions. The hypervisor is called SimpleVisor, supports only modern 64-bit systems and has been successfully tested for compatibility with systems such as Windows 8.1 on the Intel Haswell architecture microprocessor, as well as Windows 10 on the Intel Sandy Bridge architecture.
Not counting the exhaustive comments which explain every single line of code, and specific Windows-related or Intel-related idiosyncrasies, SimpleVisor clocks in at about 500 lines of C code, and 10 lines of x64 assembly code, all while containing the ability to run on every recent version of 64-bit Windows, and supporting dynamic load / unload at runtime.
As can be seen from the annotation, the source code of SimpleVisor took only 500 lines of C code and 10 lines of 64-bit assembler. The project itself was built using Visual Studio 2015 and this environment can also be used to build it.
SimpleVisor testing was carried out on the following platforms.
- Windows 8.1 on Haswell microprocessor (desktop)
- Windows 10 Redstone 1 on Sandy Bridge Microprocessor (Samsung 930 Laptop)
- Windows 10 Threshold 2 on Skylake microprocessor (Surface Pro 4 Tablet)
- Windows 10 Threshold 2 on Skylape microprocessor (Dell Inspiron 11-3153 SGX laptop)
Fig. SimpleVisor source structure.
Fig. Part of the asm64 code from the shvx64.asm file, which is responsible for the intricacies of working with the AMD64 microprocessor.
SimpleVisor is a 64-bit driver designed to run on 64-bit versions of Windows 8.1 and Windows 10. To run successfully on the system, the driver must be digitally signed, for example, using the so-called. test certificate. Next, on Windows, you must enable the appropriate driver download mode with this signature using the well-known bcdedit command.
bcdedit / set testsigning on
Next, create a driver service for the service control manager, this can be done using the following command.
sc create simplevisor type = kernel binPath = ""
The SimpleVisor driver supports both loading and unloading on the fly. To do this, you can use the following commands.
net start simplevisor
net stop simplevisor
