Add files via upload

xmaple555 · Jun 7, 2022 · cbb84c6 · cbb84c6
1 parent 099a419
commit cbb84c6
Show file tree

Hide file tree

Showing 59 changed files with 10,182 additions and 0 deletions.
diff --git a/airhv/airhv-main/LICENSE b/airhv/airhv-main/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2021 Air14
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/airhv/airhv-main/README.md b/airhv/airhv-main/README.md
@@ -0,0 +1,31 @@
+# airhv
+
+airhv is a simple hypervisor based on Intel VT-x mainly focused on ept hooking
+## Features
+* Ept support with mapping of 2MB pages (splitted dynamicly to 4KB pages if needed)
+* Ability to run in VMWare which is using few IO ports for communication between vmtools and VMWare hypervisor
+* Ability to handle various VM-exit cases: `CPUID` `RDTSC` `RDTSCP` `RDRAND` `RDSEED` `WBINVD/INVD` `IN/OUT` `XSETBV` `RDMSR` `WRMSR` `INVPCID` `MOV DR` `CR ACCESS` `EXCEPTIONS/NMI` `VMCALL` `INVLPG`  `GDTR/IDTR ACCESS` `LDTR/TR ACCESS`
+* Ability to perform inline hooking via ept
+* Included simple driver (airhvctrl) which is communicating with hypervisor via `VMCALL` to hook syscall (via ept).
+It hooks NtCreateFile and every time user when tries to create a file named test.txt it prevents user from doing that.
+
+## Future possible features
+* Ability to run under AMD-SVM
+* Ability to handle more VM-exit cases
+* Ability to make hypervisor not detectable via counters (rdtsc,rdtscp)
+* Ability to run nested VMs
+* MSR_LSTAR hooking
+
+## Compilation
+
+Compile with Visual Studio 2019 (Requires [WDK](https://docs.microsoft.com/en-us/windows-hardware/drivers/download-the-wdk))
+
+## Supported hardware
+Intel processors with VT-x and EPT support
+
+## Supported platforms
+Windows 7 - Windows 10, x64 only
+
+## License
+airhv is under MIT license.  
+Dependencies are licensed by their own licenses.
diff --git a/airhv/airhv-main/airhv.sln b/airhv/airhv-main/airhv.sln
@@ -0,0 +1,49 @@
+
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio Version 16
+VisualStudioVersion = 16.0.30907.101
+MinimumVisualStudioVersion = 10.0.40219.1
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "airhv", "airhv\airhv.vcxproj", "{CC497BEE-6B9E-4732-8B60-35DFE6526C28}"
+EndProject
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "airhvctrl", "airhvctrl\airhvctrl.vcxproj", "{98E8F109-6A08-4461-A245-42B7CE32A703}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug_Minimal|x64 = Debug_Minimal|x64
+		Debug|x64 = Debug|x64
+		Release_Minimal|x64 = Release_Minimal|x64
+		Release|x64 = Release|x64
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{CC497BEE-6B9E-4732-8B60-35DFE6526C28}.Debug_Minimal|x64.ActiveCfg = Debug_Minimal|x64
+		{CC497BEE-6B9E-4732-8B60-35DFE6526C28}.Debug_Minimal|x64.Build.0 = Debug_Minimal|x64
+		{CC497BEE-6B9E-4732-8B60-35DFE6526C28}.Debug_Minimal|x64.Deploy.0 = Debug_Minimal|x64
+		{CC497BEE-6B9E-4732-8B60-35DFE6526C28}.Debug|x64.ActiveCfg = Debug|x64
+		{CC497BEE-6B9E-4732-8B60-35DFE6526C28}.Debug|x64.Build.0 = Debug|x64
+		{CC497BEE-6B9E-4732-8B60-35DFE6526C28}.Debug|x64.Deploy.0 = Debug|x64
+		{CC497BEE-6B9E-4732-8B60-35DFE6526C28}.Release_Minimal|x64.ActiveCfg = Release_Minimal|x64
+		{CC497BEE-6B9E-4732-8B60-35DFE6526C28}.Release_Minimal|x64.Build.0 = Release_Minimal|x64
+		{CC497BEE-6B9E-4732-8B60-35DFE6526C28}.Release_Minimal|x64.Deploy.0 = Release_Minimal|x64
+		{CC497BEE-6B9E-4732-8B60-35DFE6526C28}.Release|x64.ActiveCfg = Release|x64
+		{CC497BEE-6B9E-4732-8B60-35DFE6526C28}.Release|x64.Build.0 = Release|x64
+		{CC497BEE-6B9E-4732-8B60-35DFE6526C28}.Release|x64.Deploy.0 = Release|x64
+		{98E8F109-6A08-4461-A245-42B7CE32A703}.Debug_Minimal|x64.ActiveCfg = Debug|x64
+		{98E8F109-6A08-4461-A245-42B7CE32A703}.Debug_Minimal|x64.Build.0 = Debug|x64
+		{98E8F109-6A08-4461-A245-42B7CE32A703}.Debug_Minimal|x64.Deploy.0 = Debug|x64
+		{98E8F109-6A08-4461-A245-42B7CE32A703}.Debug|x64.ActiveCfg = Debug|x64
+		{98E8F109-6A08-4461-A245-42B7CE32A703}.Debug|x64.Build.0 = Debug|x64
+		{98E8F109-6A08-4461-A245-42B7CE32A703}.Debug|x64.Deploy.0 = Debug|x64
+		{98E8F109-6A08-4461-A245-42B7CE32A703}.Release_Minimal|x64.ActiveCfg = Release_Minimal|x64
+		{98E8F109-6A08-4461-A245-42B7CE32A703}.Release_Minimal|x64.Build.0 = Release_Minimal|x64
+		{98E8F109-6A08-4461-A245-42B7CE32A703}.Release_Minimal|x64.Deploy.0 = Release_Minimal|x64
+		{98E8F109-6A08-4461-A245-42B7CE32A703}.Release|x64.ActiveCfg = Release|x64
+		{98E8F109-6A08-4461-A245-42B7CE32A703}.Release|x64.Build.0 = Release|x64
+		{98E8F109-6A08-4461-A245-42B7CE32A703}.Release|x64.Deploy.0 = Release|x64
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+	GlobalSection(ExtensibilityGlobals) = postSolution
+		SolutionGuid = {A387B9A7-546D-4699-8524-1E3CC92C3650}
+	EndGlobalSection
+EndGlobal
diff --git a/airhv/airhv-main/airhv/airhv.vcxproj b/airhv/airhv-main/airhv/airhv.vcxproj
@@ -0,0 +1,190 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug_Minimal|x64">
+      <Configuration>Debug_Minimal</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|x64">
+      <Configuration>Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release_Minimal|x64">
+      <Configuration>Release_Minimal</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|x64">
+      <Configuration>Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <ProjectGuid>{CC497BEE-6B9E-4732-8B60-35DFE6526C28}</ProjectGuid>
+    <TemplateGuid>{1bc93793-694f-48fe-9372-81e2b05556fd}</TemplateGuid>
+    <TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
+    <MinimumVisualStudioVersion>12.0</MinimumVisualStudioVersion>
+    <Configuration>Debug</Configuration>
+    <Platform Condition="'$(Platform)' == ''">Win32</Platform>
+    <RootNamespace>airhv</RootNamespace>
+    <WindowsTargetPlatformVersion>$(LatestTargetPlatformVersion)</WindowsTargetPlatformVersion>
+    <ProjectName>airhv</ProjectName>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
+    <TargetVersion>Windows7</TargetVersion>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
+    <ConfigurationType>Driver</ConfigurationType>
+    <DriverType>KMDF</DriverType>
+    <DriverTargetPlatform>Desktop</DriverTargetPlatform>
+    <Driver_SpectreMitigation>Spectre</Driver_SpectreMitigation>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug_Minimal|x64'" Label="Configuration">
+    <TargetVersion>Windows7</TargetVersion>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
+    <ConfigurationType>Driver</ConfigurationType>
+    <DriverType>KMDF</DriverType>
+    <DriverTargetPlatform>Desktop</DriverTargetPlatform>
+    <Driver_SpectreMitigation>Spectre</Driver_SpectreMitigation>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
+    <TargetVersion>Windows7</TargetVersion>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
+    <ConfigurationType>Driver</ConfigurationType>
+    <DriverType>KMDF</DriverType>
+    <DriverTargetPlatform>Desktop</DriverTargetPlatform>
+    <Driver_SpectreMitigation>Spectre</Driver_SpectreMitigation>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release_Minimal|x64'" Label="Configuration">
+    <TargetVersion>Windows7</TargetVersion>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
+    <ConfigurationType>Driver</ConfigurationType>
+    <DriverType>KMDF</DriverType>
+    <DriverTargetPlatform>Desktop</DriverTargetPlatform>
+    <Driver_SpectreMitigation>Spectre</Driver_SpectreMitigation>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+    <Import Project="$(VCTargetsPath)\BuildCustomizations\masm.props" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <PropertyGroup />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug_Minimal|x64'">
+    <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release_Minimal|x64'">
+    <DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
+  </PropertyGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <ClCompile>
+      <LanguageStandard>stdcpp17</LanguageStandard>
+      <TreatWarningAsError>false</TreatWarningAsError>
+      <WarningLevel>TurnOffAllWarnings</WarningLevel>
+      <ShowIncludes>true</ShowIncludes>
+      <Optimization>MaxSpeed</Optimization>
+      <FavorSizeOrSpeed>Speed</FavorSizeOrSpeed>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <BufferSecurityCheck>false</BufferSecurityCheck>
+      <PreprocessorDefinitions>_WIN64;_AMD64_;AMD64;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+    </ClCompile>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release_Minimal|x64'">
+    <ClCompile>
+      <LanguageStandard>stdcpp17</LanguageStandard>
+      <TreatWarningAsError>false</TreatWarningAsError>
+      <WarningLevel>TurnOffAllWarnings</WarningLevel>
+      <ShowIncludes>true</ShowIncludes>
+      <Optimization>MaxSpeed</Optimization>
+      <FavorSizeOrSpeed>Speed</FavorSizeOrSpeed>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <BufferSecurityCheck>false</BufferSecurityCheck>
+      <PreprocessorDefinitions>_MINIMAL;_WIN64;_AMD64_;AMD64;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+    </ClCompile>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <ClCompile>
+      <ShowIncludes>true</ShowIncludes>
+      <BufferSecurityCheck>false</BufferSecurityCheck>
+      <PreprocessorDefinitions>_WIN64;_AMD64_;AMD64;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+    </ClCompile>
+    <Link>
+      <AdditionalDependencies>%(AdditionalDependencies);$(KernelBufferOverflowLib);$(DDK_LIB_PATH)ntoskrnl.lib;$(DDK_LIB_PATH)hal.lib;$(DDK_LIB_PATH)wmilib.lib;$(KMDF_LIB_PATH)$(KMDF_VER_PATH)\WdfLdr.lib;$(KMDF_LIB_PATH)$(KMDF_VER_PATH)\WdfDriverEntry.lib</AdditionalDependencies>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug_Minimal|x64'">
+    <ClCompile>
+      <ShowIncludes>true</ShowIncludes>
+      <BufferSecurityCheck>false</BufferSecurityCheck>
+      <PreprocessorDefinitions>_MINIMAL;_WIN64;_AMD64_;AMD64;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+    </ClCompile>
+    <Link>
+      <AdditionalDependencies>%(AdditionalDependencies);$(KernelBufferOverflowLib);$(DDK_LIB_PATH)ntoskrnl.lib;$(DDK_LIB_PATH)hal.lib;$(DDK_LIB_PATH)wmilib.lib;$(KMDF_LIB_PATH)$(KMDF_VER_PATH)\WdfLdr.lib;$(KMDF_LIB_PATH)$(KMDF_VER_PATH)\WdfDriverEntry.lib</AdditionalDependencies>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+    <FilesToPackage Include="$(TargetPath)" />
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="ept.cpp" />
+    <ClCompile Include="hypervisor_gateway.cpp" />
+    <ClCompile Include="hypervisor_routines.cpp" />
+    <ClCompile Include="invalidators.cpp" />
+    <ClCompile Include="log.cpp" />
+    <ClCompile Include="main.cpp" />
+    <ClCompile Include="poolmanager.cpp" />
+    <ClCompile Include="spinlock.cpp" />
+    <ClCompile Include="vmcs.cpp" />
+    <ClCompile Include="vmcall_handler.cpp" />
+    <ClCompile Include="vmexit_handler.cpp" />
+    <ClCompile Include="vmm.cpp" />
+  </ItemGroup>
+  <ItemGroup>
+    <ClInclude Include="allocators.h" />
+    <ClInclude Include="asm\vm_context.h" />
+    <ClInclude Include="asm\vm_intrin.h" />
+    <ClInclude Include="common.h" />
+    <ClInclude Include="hypervisor_gateway.h" />
+    <ClInclude Include="ia32\cpuid.h" />
+    <ClInclude Include="ia32\cr.h" />
+    <ClInclude Include="ia32\dr.h" />
+    <ClInclude Include="ia32\ept.h" />
+    <ClInclude Include="ia32\msr.h" />
+    <ClInclude Include="ia32\mtrr.h" />
+    <ClInclude Include="ia32\rflags.h" />
+    <ClInclude Include="ia32\segment.h" />
+    <ClInclude Include="ia32\vmcs.h" />
+    <ClInclude Include="ia32\vmcs_encodings.h" />
+    <ClInclude Include="hypervisor_routines.h" />
+    <ClInclude Include="interrupt.h" />
+    <ClInclude Include="invalidators.h" />
+    <ClInclude Include="log.h" />
+    <ClInclude Include="ntapi.h" />
+    <ClInclude Include="poolmanager.h" />
+    <ClInclude Include="vmcall_reason.h" />
+    <ClInclude Include="vmcall_handler.h" />
+    <ClInclude Include="vmexit_handler.h" />
+    <ClInclude Include="vmm.h" />
+    <ClInclude Include="xsave.h" />
+  </ItemGroup>
+  <ItemGroup>
+    <MASM Include="asm\vm_context.asm" />
+    <MASM Include="asm\vm_intrin.asm" />
+    <MASM Include="lde\lde64.asm" />
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+    <Import Project="$(VCTargetsPath)\BuildCustomizations\masm.targets" />
+  </ImportGroup>
+</Project>