Skip to content
This repository has been archived by the owner on Sep 1, 2024. It is now read-only.

Add CPUID Password Protection and User-Mode Hook Management #26

Merged
merged 24 commits into from
May 19, 2024

Conversation

memN0ps
Copy link
Owner

@memN0ps memN0ps commented May 19, 2024

  • Client-Hypervisor Communication: Implemented CPUID password protection for secure client communication with the hypervisor.
  • User-Mode Hooks: Enabled hooking and unhooking from user-mode via function hash.
  • Testing Requirements: Need to test at least 5-10 hooks, including multiple hooks on the same page.
  • KernelHook Struct Update: Major updates to the KernelHook struct to track all ntoskrnl.exe function VAs and syscalls.
  • Kernel Inline Hooks: Replacing all function names starting with "Zw" with "Nt" in the export map and sorting keys by their values to extract SSNs.
  • Kernel EPT Hook Function: Unified hook enabling and disabling into a single kernel_ept_hook function.
  • Commands Module Update: commands.rs now handles 2 commands, passing them to KernelHooks which interacts with HookManager.
  • Testing Flexibility: New functionalities can be tested at boot time or from user-mode.

Mostly helps solves: #20 and #21

@memN0ps memN0ps merged commit abe01ca into main May 19, 2024
1 check passed
@memN0ps memN0ps deleted the development branch May 20, 2024 01:35
@memN0ps
Copy link
Owner Author

memN0ps commented May 21, 2024

SSDT is still needed for syscall hooks, accidentally removed it and currently performing NTOS hooks instead. Both would be nice to have…

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant