├── EptHook ├── BlogVT.sln └── BlogVT │ ├── Asm.asm │ ├── Asm.h │ ├── BlogVT.vcxproj │ ├── BlogVT.vcxproj.filters │ ├── DriverEntry.cpp │ ├── EPT.cpp │ ├── EptHook.cpp │ ├── HOOK.h │ ├── InitVMCS.cpp │ ├── TinyVT.cpp │ ├── TinyVT.h │ ├── VmExitHandler.cpp │ ├── def.h │ ├── ia32.h │ ├── nmd_assembly.h │ ├── test.cpp │ └── util.cpp ├── LICENSE ├── NoEPT ├── BlogVT.sln └── BlogVT │ ├── Asm.asm │ ├── Asm.h │ ├── BlogVT.vcxproj │ ├── BlogVT.vcxproj.filters │ ├── DriverEntry.cpp │ ├── InitVMCS.cpp │ ├── TinyVT.cpp │ ├── TinyVT.h │ ├── VmExitHandler.cpp │ ├── def.h │ ├── ia32.h │ └── util.cpp ├── README.md └── UseEPT ├── BlogVT.sln └── BlogVT ├── Asm.asm ├── Asm.h ├── BlogVT.vcxproj ├── BlogVT.vcxproj.filters ├── DriverEntry.cpp ├── EPT.cpp ├── InitVMCS.cpp ├── TinyVT.cpp ├── TinyVT.h ├── VmExitHandler.cpp ├── def.h ├── ia32.h └── util.cpp /EptHook/BlogVT.sln: -------------------------------------------------------------------------------- 1 |  2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio Version 16 4 | VisualStudioVersion = 16.0.30204.135 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "BlogVT", "BlogVT\BlogVT.vcxproj", "{47D1F9E5-7C9B-451F-83F4-A92C79B82570}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|ARM = Debug|ARM 11 | Debug|ARM64 = Debug|ARM64 12 | Debug|x64 = Debug|x64 13 | Debug|x86 = Debug|x86 14 | Release|ARM = Release|ARM 15 | Release|ARM64 = Release|ARM64 16 | Release|x64 = Release|x64 17 | Release|x86 = Release|x86 18 | EndGlobalSection 19 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 20 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Debug|ARM.ActiveCfg = Debug|ARM 21 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Debug|ARM.Build.0 = Debug|ARM 22 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Debug|ARM.Deploy.0 = Debug|ARM 23 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Debug|ARM64.ActiveCfg = Debug|ARM64 24 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Debug|ARM64.Build.0 = Debug|ARM64 25 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Debug|ARM64.Deploy.0 = Debug|ARM64 26 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Debug|x64.ActiveCfg = Debug|x64 27 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Debug|x64.Build.0 = Debug|x64 28 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Debug|x64.Deploy.0 = Debug|x64 29 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Debug|x86.ActiveCfg = Debug|Win32 30 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Debug|x86.Build.0 = Debug|Win32 31 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Debug|x86.Deploy.0 = Debug|Win32 32 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Release|ARM.ActiveCfg = Release|ARM 33 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Release|ARM.Build.0 = Release|ARM 34 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Release|ARM.Deploy.0 = Release|ARM 35 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Release|ARM64.ActiveCfg = Release|ARM64 36 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Release|ARM64.Build.0 = Release|ARM64 37 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Release|ARM64.Deploy.0 = Release|ARM64 38 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Release|x64.ActiveCfg = Release|x64 39 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Release|x64.Build.0 = Release|x64 40 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Release|x64.Deploy.0 = Release|x64 41 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Release|x86.ActiveCfg = Release|Win32 42 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Release|x86.Build.0 = Release|Win32 43 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Release|x86.Deploy.0 = Release|Win32 44 | EndGlobalSection 45 | GlobalSection(SolutionProperties) = preSolution 46 | HideSolutionNode = FALSE 47 | EndGlobalSection 48 | GlobalSection(ExtensibilityGlobals) = postSolution 49 | SolutionGuid = {D5A05110-0CA8-48CD-8F3F-AC6B0E9E470F} 50 | EndGlobalSection 51 | EndGlobal 52 | -------------------------------------------------------------------------------- /EptHook/BlogVT/Asm.asm: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WWFWT/TinyVT/c0fe9b03f68859ff32aa0bdc16a25e2b0b452c80/EptHook/BlogVT/Asm.asm -------------------------------------------------------------------------------- /EptHook/BlogVT/Asm.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | #include"def.h" 3 | 4 | enum VmCall 5 | { 6 | CallExitVT, 7 | CallEptHook, 8 | CallEptUnHook, 9 | }; 10 | 11 | EXTERN_C 12 | { 13 | BOOLEAN __fastcall AsmVmxLaunch(PVOID callBack,PVOID thisPoint); 14 | void __fastcall AsmVmmEntryPoint(); 15 | void __fastcall AsmInvd(); 16 | void __fastcall AsmVmxCall(ULONG_PTR num, ULONG_PTR param); 17 | 18 | unsigned char __fastcall __fastcall AsmInvvpid( 19 | _In_ ULONG_PTR invvpid_type, 20 | _In_ ULONG_PTR* invvpid_descriptor); 21 | 22 | 23 | void _sgdt(void*); 24 | /// Writes to GDT 25 | /// @param gdtr A value to write 26 | void __fastcall AsmWriteGDT(_In_ const Gdtr* gdtr); 27 | 28 | /// Reads SLDT 29 | /// @return LDT 30 | USHORT __fastcall AsmReadLDTR(); 31 | 32 | /// Writes to TR 33 | /// @param task_register A value to write 34 | void __fastcall AsmWriteTR(_In_ USHORT task_register); 35 | 36 | /// Reads STR 37 | /// @return TR 38 | USHORT __fastcall AsmReadTR(); 39 | 40 | /// Writes to ES 41 | /// @param segment_selector A value to write 42 | void __fastcall AsmWriteES(_In_ USHORT segment_selector); 43 | 44 | /// Reads ES 45 | /// @return ES 46 | USHORT __fastcall AsmReadES(); 47 | 48 | /// Writes to CS 49 | /// @param segment_selector A value to write 50 | void __fastcall AsmWriteCS(_In_ USHORT segment_selector); 51 | 52 | /// Reads CS 53 | /// @return CS 54 | USHORT __fastcall AsmReadCS(); 55 | 56 | /// Writes to SS 57 | /// @param segment_selector A value to write 58 | void __fastcall AsmWriteSS(_In_ USHORT segment_selector); 59 | 60 | /// Reads SS 61 | /// @return SS 62 | USHORT __fastcall AsmReadSS(); 63 | 64 | /// Writes to DS 65 | /// @param segment_selector A value to write 66 | void __fastcall AsmWriteDS(_In_ USHORT segment_selector); 67 | 68 | /// Reads DS 69 | /// @return DS 70 | USHORT __fastcall AsmReadDS(); 71 | 72 | /// Writes to FS 73 | /// @param segment_selector A value to write 74 | void __fastcall AsmWriteFS(_In_ USHORT segment_selector); 75 | 76 | /// Reads FS 77 | /// @return FS 78 | USHORT __fastcall AsmReadFS(); 79 | 80 | /// Writes to GS 81 | /// @param segment_selector A value to write 82 | void __fastcall AsmWriteGS(_In_ USHORT segment_selector); 83 | 84 | /// Reads GS 85 | /// @return GS 86 | USHORT __fastcall AsmReadGS(); 87 | 88 | /// Loads access rights byte 89 | /// @param segment_selector A value to get access rights byte 90 | /// @return An access rights byte 91 | ULONG_PTR __fastcall AsmLoadAccessRightsByte(_In_ ULONG_PTR segment_selector); 92 | 93 | } 94 | -------------------------------------------------------------------------------- /EptHook/BlogVT/BlogVT.vcxproj: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | Release 10 | Win32 11 | 12 | 13 | Debug 14 | x64 15 | 16 | 17 | Release 18 | x64 19 | 20 | 21 | Debug 22 | ARM 23 | 24 | 25 | Release 26 | ARM 27 | 28 | 29 | Debug 30 | ARM64 31 | 32 | 33 | Release 34 | ARM64 35 | 36 | 37 | 38 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570} 39 | {dd38f7fc-d7bd-488b-9242-7d8754cde80d} 40 | v4.5 41 | 12.0 42 | Debug 43 | Win32 44 | BlogVT 45 | 46 | 47 | 48 | Windows10 49 | true 50 | WindowsKernelModeDriver10.0 51 | Driver 52 | WDM 53 | 54 | 55 | Windows10 56 | false 57 | WindowsKernelModeDriver10.0 58 | Driver 59 | WDM 60 | 61 | 62 | Windows10 63 | true 64 | WindowsKernelModeDriver10.0 65 | Driver 66 | WDM 67 | 68 | 69 | Windows10 70 | false 71 | WindowsKernelModeDriver10.0 72 | Driver 73 | WDM 74 | 75 | 76 | Windows10 77 | true 78 | WindowsKernelModeDriver10.0 79 | Driver 80 | WDM 81 | 82 | 83 | Windows10 84 | false 85 | WindowsKernelModeDriver10.0 86 | Driver 87 | WDM 88 | 89 | 90 | Windows10 91 | true 92 | WindowsKernelModeDriver10.0 93 | Driver 94 | WDM 95 | 96 | 97 | Windows10 98 | false 99 | WindowsKernelModeDriver10.0 100 | Driver 101 | WDM 102 | 103 | 104 | 105 | 106 | 107 | 108 | 109 | 110 | 111 | 112 | DbgengKernelDebugger 113 | 114 | 115 | DbgengKernelDebugger 116 | 117 | 118 | DbgengKernelDebugger 119 | false 120 | 121 | 122 | DbgengKernelDebugger 123 | 124 | 125 | DbgengKernelDebugger 126 | 127 | 128 | DbgengKernelDebugger 129 | 130 | 131 | DbgengKernelDebugger 132 | 133 | 134 | DbgengKernelDebugger 135 | 136 | 137 | 138 | 139 | 140 | 141 | 142 | 143 | 144 | 145 | 146 | 147 | 148 | 149 | 150 | 151 | 152 | 153 | 154 | 155 | 156 | 157 | 158 | 159 | 160 | 161 | 162 | 163 | -------------------------------------------------------------------------------- /EptHook/BlogVT/BlogVT.vcxproj.filters: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hpp;hxx;hm;inl;inc;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | {8E41214B-6785-4CFE-B992-037D68949A14} 18 | inf;inv;inx;mof;mc; 19 | 20 | 21 | 22 | 23 | Source Files 24 | 25 | 26 | Source Files 27 | 28 | 29 | Source Files 30 | 31 | 32 | Source Files 33 | 34 | 35 | Source Files 36 | 37 | 38 | Source Files 39 | 40 | 41 | Source Files 42 | 43 | 44 | Source Files 45 | 46 | 47 | 48 | 49 | Header Files 50 | 51 | 52 | Header Files 53 | 54 | 55 | Header Files 56 | 57 | 58 | Header Files 59 | 60 | 61 | Header Files 62 | 63 | 64 | Header Files 65 | 66 | 67 | 68 | 69 | Source Files 70 | 71 | 72 | -------------------------------------------------------------------------------- /EptHook/BlogVT/DriverEntry.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WWFWT/TinyVT/c0fe9b03f68859ff32aa0bdc16a25e2b0b452c80/EptHook/BlogVT/DriverEntry.cpp -------------------------------------------------------------------------------- /EptHook/BlogVT/EPT.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WWFWT/TinyVT/c0fe9b03f68859ff32aa0bdc16a25e2b0b452c80/EptHook/BlogVT/EPT.cpp -------------------------------------------------------------------------------- /EptHook/BlogVT/EptHook.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WWFWT/TinyVT/c0fe9b03f68859ff32aa0bdc16a25e2b0b452c80/EptHook/BlogVT/EptHook.cpp -------------------------------------------------------------------------------- /EptHook/BlogVT/HOOK.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WWFWT/TinyVT/c0fe9b03f68859ff32aa0bdc16a25e2b0b452c80/EptHook/BlogVT/HOOK.h -------------------------------------------------------------------------------- /EptHook/BlogVT/InitVMCS.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WWFWT/TinyVT/c0fe9b03f68859ff32aa0bdc16a25e2b0b452c80/EptHook/BlogVT/InitVMCS.cpp -------------------------------------------------------------------------------- /EptHook/BlogVT/TinyVT.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WWFWT/TinyVT/c0fe9b03f68859ff32aa0bdc16a25e2b0b452c80/EptHook/BlogVT/TinyVT.cpp -------------------------------------------------------------------------------- /EptHook/BlogVT/TinyVT.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WWFWT/TinyVT/c0fe9b03f68859ff32aa0bdc16a25e2b0b452c80/EptHook/BlogVT/TinyVT.h -------------------------------------------------------------------------------- /EptHook/BlogVT/VmExitHandler.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WWFWT/TinyVT/c0fe9b03f68859ff32aa0bdc16a25e2b0b452c80/EptHook/BlogVT/VmExitHandler.cpp -------------------------------------------------------------------------------- /EptHook/BlogVT/def.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | #include 3 | #include 4 | #include"ia32.h" 5 | 6 | #define Log(format, ...) DbgPrintEx(DPFLTR_IHVDRIVER_ID,DPFLTR_ERROR_LEVEL,"[MyVT]: " format "\n",##__VA_ARGS__) 7 | 8 | EXTERN_C 9 | NTKERNELAPI 10 | _IRQL_requires_(DISPATCH_LEVEL) 11 | _IRQL_requires_same_ 12 | VOID 13 | KeSignalCallDpcDone( 14 | _In_ PVOID SystemArgument1 15 | ); 16 | 17 | EXTERN_C 18 | NTKERNELAPI 19 | _IRQL_requires_(DISPATCH_LEVEL) 20 | _IRQL_requires_same_ 21 | LOGICAL 22 | KeSignalCallDpcSynchronize( 23 | _In_ PVOID SystemArgument2 24 | ); 25 | 26 | EXTERN_C 27 | NTKERNELAPI 28 | _IRQL_requires_max_(APC_LEVEL) 29 | _IRQL_requires_min_(PASSIVE_LEVEL) 30 | _IRQL_requires_same_ 31 | VOID 32 | KeGenericCallDpc( 33 | _In_ PKDEFERRED_ROUTINE Routine, 34 | _In_opt_ PVOID Context 35 | ); 36 | 37 | _IRQL_requires_max_(DISPATCH_LEVEL) 38 | void* __cdecl operator new(size_t size); 39 | 40 | _IRQL_requires_max_(DISPATCH_LEVEL) 41 | void __cdecl operator delete(void* p, SIZE_T size); 42 | 43 | BOOLEAN CheckVTSupport(); 44 | BOOLEAN CheckVTEnable(); 45 | PVOID kmalloc(ULONG_PTR size); 46 | void kfree(PVOID p); -------------------------------------------------------------------------------- /EptHook/BlogVT/ia32.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WWFWT/TinyVT/c0fe9b03f68859ff32aa0bdc16a25e2b0b452c80/EptHook/BlogVT/ia32.h -------------------------------------------------------------------------------- /EptHook/BlogVT/test.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WWFWT/TinyVT/c0fe9b03f68859ff32aa0bdc16a25e2b0b452c80/EptHook/BlogVT/test.cpp -------------------------------------------------------------------------------- /EptHook/BlogVT/util.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WWFWT/TinyVT/c0fe9b03f68859ff32aa0bdc16a25e2b0b452c80/EptHook/BlogVT/util.cpp -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2022 吾无法无天 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /NoEPT/BlogVT.sln: -------------------------------------------------------------------------------- 1 |  2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio Version 16 4 | VisualStudioVersion = 16.0.30204.135 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "BlogVT", "BlogVT\BlogVT.vcxproj", "{47D1F9E5-7C9B-451F-83F4-A92C79B82570}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|ARM = Debug|ARM 11 | Debug|ARM64 = Debug|ARM64 12 | Debug|x64 = Debug|x64 13 | Debug|x86 = Debug|x86 14 | Release|ARM = Release|ARM 15 | Release|ARM64 = Release|ARM64 16 | Release|x64 = Release|x64 17 | Release|x86 = Release|x86 18 | EndGlobalSection 19 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 20 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Debug|ARM.ActiveCfg = Debug|ARM 21 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Debug|ARM.Build.0 = Debug|ARM 22 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Debug|ARM.Deploy.0 = Debug|ARM 23 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Debug|ARM64.ActiveCfg = Debug|ARM64 24 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Debug|ARM64.Build.0 = Debug|ARM64 25 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Debug|ARM64.Deploy.0 = Debug|ARM64 26 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Debug|x64.ActiveCfg = Debug|x64 27 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Debug|x64.Build.0 = Debug|x64 28 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Debug|x64.Deploy.0 = Debug|x64 29 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Debug|x86.ActiveCfg = Debug|Win32 30 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Debug|x86.Build.0 = Debug|Win32 31 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Debug|x86.Deploy.0 = Debug|Win32 32 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Release|ARM.ActiveCfg = Release|ARM 33 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Release|ARM.Build.0 = Release|ARM 34 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Release|ARM.Deploy.0 = Release|ARM 35 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Release|ARM64.ActiveCfg = Release|ARM64 36 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Release|ARM64.Build.0 = Release|ARM64 37 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Release|ARM64.Deploy.0 = Release|ARM64 38 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Release|x64.ActiveCfg = Release|x64 39 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Release|x64.Build.0 = Release|x64 40 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Release|x64.Deploy.0 = Release|x64 41 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Release|x86.ActiveCfg = Release|Win32 42 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Release|x86.Build.0 = Release|Win32 43 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Release|x86.Deploy.0 = Release|Win32 44 | EndGlobalSection 45 | GlobalSection(SolutionProperties) = preSolution 46 | HideSolutionNode = FALSE 47 | EndGlobalSection 48 | GlobalSection(ExtensibilityGlobals) = postSolution 49 | SolutionGuid = {D5A05110-0CA8-48CD-8F3F-AC6B0E9E470F} 50 | EndGlobalSection 51 | EndGlobal 52 | -------------------------------------------------------------------------------- /NoEPT/BlogVT/Asm.asm: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WWFWT/TinyVT/c0fe9b03f68859ff32aa0bdc16a25e2b0b452c80/NoEPT/BlogVT/Asm.asm -------------------------------------------------------------------------------- /NoEPT/BlogVT/Asm.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | #include"def.h" 3 | 4 | enum VmCall 5 | { 6 | CallExitVT, 7 | CallEptHook, 8 | CallEptUnHook, 9 | }; 10 | 11 | EXTERN_C 12 | { 13 | BOOLEAN __fastcall AsmVmxLaunch(PVOID callBack,PVOID thisPoint); 14 | void __fastcall AsmVmmEntryPoint(); 15 | void __fastcall AsmInvd(); 16 | void __fastcall AsmVmxCall(ULONG_PTR num, ULONG_PTR param); 17 | 18 | unsigned char __fastcall __fastcall AsmInvvpid( 19 | _In_ ULONG_PTR invvpid_type, 20 | _In_ ULONG_PTR* invvpid_descriptor); 21 | 22 | 23 | void _sgdt(void*); 24 | /// Writes to GDT 25 | /// @param gdtr A value to write 26 | void __fastcall AsmWriteGDT(_In_ const Gdtr* gdtr); 27 | 28 | /// Reads SLDT 29 | /// @return LDT 30 | USHORT __fastcall AsmReadLDTR(); 31 | 32 | /// Writes to TR 33 | /// @param task_register A value to write 34 | void __fastcall AsmWriteTR(_In_ USHORT task_register); 35 | 36 | /// Reads STR 37 | /// @return TR 38 | USHORT __fastcall AsmReadTR(); 39 | 40 | /// Writes to ES 41 | /// @param segment_selector A value to write 42 | void __fastcall AsmWriteES(_In_ USHORT segment_selector); 43 | 44 | /// Reads ES 45 | /// @return ES 46 | USHORT __fastcall AsmReadES(); 47 | 48 | /// Writes to CS 49 | /// @param segment_selector A value to write 50 | void __fastcall AsmWriteCS(_In_ USHORT segment_selector); 51 | 52 | /// Reads CS 53 | /// @return CS 54 | USHORT __fastcall AsmReadCS(); 55 | 56 | /// Writes to SS 57 | /// @param segment_selector A value to write 58 | void __fastcall AsmWriteSS(_In_ USHORT segment_selector); 59 | 60 | /// Reads SS 61 | /// @return SS 62 | USHORT __fastcall AsmReadSS(); 63 | 64 | /// Writes to DS 65 | /// @param segment_selector A value to write 66 | void __fastcall AsmWriteDS(_In_ USHORT segment_selector); 67 | 68 | /// Reads DS 69 | /// @return DS 70 | USHORT __fastcall AsmReadDS(); 71 | 72 | /// Writes to FS 73 | /// @param segment_selector A value to write 74 | void __fastcall AsmWriteFS(_In_ USHORT segment_selector); 75 | 76 | /// Reads FS 77 | /// @return FS 78 | USHORT __fastcall AsmReadFS(); 79 | 80 | /// Writes to GS 81 | /// @param segment_selector A value to write 82 | void __fastcall AsmWriteGS(_In_ USHORT segment_selector); 83 | 84 | /// Reads GS 85 | /// @return GS 86 | USHORT __fastcall AsmReadGS(); 87 | 88 | /// Loads access rights byte 89 | /// @param segment_selector A value to get access rights byte 90 | /// @return An access rights byte 91 | ULONG_PTR __fastcall AsmLoadAccessRightsByte(_In_ ULONG_PTR segment_selector); 92 | 93 | } 94 | -------------------------------------------------------------------------------- /NoEPT/BlogVT/BlogVT.vcxproj: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | Release 10 | Win32 11 | 12 | 13 | Debug 14 | x64 15 | 16 | 17 | Release 18 | x64 19 | 20 | 21 | Debug 22 | ARM 23 | 24 | 25 | Release 26 | ARM 27 | 28 | 29 | Debug 30 | ARM64 31 | 32 | 33 | Release 34 | ARM64 35 | 36 | 37 | 38 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570} 39 | {dd38f7fc-d7bd-488b-9242-7d8754cde80d} 40 | v4.5 41 | 12.0 42 | Debug 43 | Win32 44 | BlogVT 45 | 46 | 47 | 48 | Windows10 49 | true 50 | WindowsKernelModeDriver10.0 51 | Driver 52 | WDM 53 | 54 | 55 | Windows10 56 | false 57 | WindowsKernelModeDriver10.0 58 | Driver 59 | WDM 60 | 61 | 62 | Windows10 63 | true 64 | WindowsKernelModeDriver10.0 65 | Driver 66 | WDM 67 | 68 | 69 | Windows10 70 | false 71 | WindowsKernelModeDriver10.0 72 | Driver 73 | WDM 74 | 75 | 76 | Windows10 77 | true 78 | WindowsKernelModeDriver10.0 79 | Driver 80 | WDM 81 | 82 | 83 | Windows10 84 | false 85 | WindowsKernelModeDriver10.0 86 | Driver 87 | WDM 88 | 89 | 90 | Windows10 91 | true 92 | WindowsKernelModeDriver10.0 93 | Driver 94 | WDM 95 | 96 | 97 | Windows10 98 | false 99 | WindowsKernelModeDriver10.0 100 | Driver 101 | WDM 102 | 103 | 104 | 105 | 106 | 107 | 108 | 109 | 110 | 111 | 112 | DbgengKernelDebugger 113 | 114 | 115 | DbgengKernelDebugger 116 | 117 | 118 | DbgengKernelDebugger 119 | false 120 | 121 | 122 | DbgengKernelDebugger 123 | 124 | 125 | DbgengKernelDebugger 126 | 127 | 128 | DbgengKernelDebugger 129 | 130 | 131 | DbgengKernelDebugger 132 | 133 | 134 | DbgengKernelDebugger 135 | 136 | 137 | 138 | 139 | 140 | 141 | 142 | 143 | 144 | 145 | 146 | 147 | 148 | 149 | 150 | 151 | 152 | 153 | 154 | 155 | 156 | 157 | 158 | 159 | -------------------------------------------------------------------------------- /NoEPT/BlogVT/BlogVT.vcxproj.filters: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hpp;hxx;hm;inl;inc;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | {8E41214B-6785-4CFE-B992-037D68949A14} 18 | inf;inv;inx;mof;mc; 19 | 20 | 21 | 22 | 23 | Source Files 24 | 25 | 26 | Source Files 27 | 28 | 29 | Source Files 30 | 31 | 32 | Source Files 33 | 34 | 35 | Source Files 36 | 37 | 38 | 39 | 40 | Header Files 41 | 42 | 43 | Header Files 44 | 45 | 46 | Header Files 47 | 48 | 49 | Header Files 50 | 51 | 52 | 53 | 54 | Source Files 55 | 56 | 57 | Source Files 58 | 59 | 60 | -------------------------------------------------------------------------------- /NoEPT/BlogVT/DriverEntry.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WWFWT/TinyVT/c0fe9b03f68859ff32aa0bdc16a25e2b0b452c80/NoEPT/BlogVT/DriverEntry.cpp -------------------------------------------------------------------------------- /NoEPT/BlogVT/InitVMCS.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WWFWT/TinyVT/c0fe9b03f68859ff32aa0bdc16a25e2b0b452c80/NoEPT/BlogVT/InitVMCS.cpp -------------------------------------------------------------------------------- /NoEPT/BlogVT/TinyVT.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WWFWT/TinyVT/c0fe9b03f68859ff32aa0bdc16a25e2b0b452c80/NoEPT/BlogVT/TinyVT.cpp -------------------------------------------------------------------------------- /NoEPT/BlogVT/TinyVT.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WWFWT/TinyVT/c0fe9b03f68859ff32aa0bdc16a25e2b0b452c80/NoEPT/BlogVT/TinyVT.h -------------------------------------------------------------------------------- /NoEPT/BlogVT/VmExitHandler.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WWFWT/TinyVT/c0fe9b03f68859ff32aa0bdc16a25e2b0b452c80/NoEPT/BlogVT/VmExitHandler.cpp -------------------------------------------------------------------------------- /NoEPT/BlogVT/def.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | #include 3 | #include 4 | #include"ia32.h" 5 | 6 | #define Log(format, ...) DbgPrintEx(DPFLTR_IHVDRIVER_ID,DPFLTR_ERROR_LEVEL,"[MyVT]: " format "\n",##__VA_ARGS__) 7 | 8 | EXTERN_C 9 | NTKERNELAPI 10 | _IRQL_requires_(DISPATCH_LEVEL) 11 | _IRQL_requires_same_ 12 | VOID 13 | KeSignalCallDpcDone( 14 | _In_ PVOID SystemArgument1 15 | ); 16 | 17 | EXTERN_C 18 | NTKERNELAPI 19 | _IRQL_requires_(DISPATCH_LEVEL) 20 | _IRQL_requires_same_ 21 | LOGICAL 22 | KeSignalCallDpcSynchronize( 23 | _In_ PVOID SystemArgument2 24 | ); 25 | 26 | EXTERN_C 27 | NTKERNELAPI 28 | _IRQL_requires_max_(APC_LEVEL) 29 | _IRQL_requires_min_(PASSIVE_LEVEL) 30 | _IRQL_requires_same_ 31 | VOID 32 | KeGenericCallDpc( 33 | _In_ PKDEFERRED_ROUTINE Routine, 34 | _In_opt_ PVOID Context 35 | ); 36 | 37 | _IRQL_requires_max_(DISPATCH_LEVEL) 38 | void* __cdecl operator new(size_t size); 39 | 40 | _IRQL_requires_max_(DISPATCH_LEVEL) 41 | void __cdecl operator delete(void* p, SIZE_T size); 42 | 43 | BOOLEAN CheckVTSupport(); 44 | BOOLEAN CheckVTEnable(); 45 | PVOID kmalloc(ULONG_PTR size); 46 | void kfree(PVOID p); -------------------------------------------------------------------------------- /NoEPT/BlogVT/ia32.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WWFWT/TinyVT/c0fe9b03f68859ff32aa0bdc16a25e2b0b452c80/NoEPT/BlogVT/ia32.h -------------------------------------------------------------------------------- /NoEPT/BlogVT/util.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WWFWT/TinyVT/c0fe9b03f68859ff32aa0bdc16a25e2b0b452c80/NoEPT/BlogVT/util.cpp -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # TinyVT 2 | 轻量级VT框架和Ept无痕HOOK，测试环境：Win11 20H2，WIN10 1903，WIN7 3 | HOOK的例子代码，注意自己更改成适合自己系统的（SSDT获取方式，NtOpenProcess函数下标） 4 | 5 | # [VT虚拟化驱动教程](https://blog.csdn.net/weixin_44286745/category_10565173.html?spm=1001.2101.3001.4235) 6 | -------------------------------------------------------------------------------- /UseEPT/BlogVT.sln: -------------------------------------------------------------------------------- 1 |  2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio Version 16 4 | VisualStudioVersion = 16.0.30204.135 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "BlogVT", "BlogVT\BlogVT.vcxproj", "{47D1F9E5-7C9B-451F-83F4-A92C79B82570}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|ARM = Debug|ARM 11 | Debug|ARM64 = Debug|ARM64 12 | Debug|x64 = Debug|x64 13 | Debug|x86 = Debug|x86 14 | Release|ARM = Release|ARM 15 | Release|ARM64 = Release|ARM64 16 | Release|x64 = Release|x64 17 | Release|x86 = Release|x86 18 | EndGlobalSection 19 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 20 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Debug|ARM.ActiveCfg = Debug|ARM 21 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Debug|ARM.Build.0 = Debug|ARM 22 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Debug|ARM.Deploy.0 = Debug|ARM 23 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Debug|ARM64.ActiveCfg = Debug|ARM64 24 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Debug|ARM64.Build.0 = Debug|ARM64 25 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Debug|ARM64.Deploy.0 = Debug|ARM64 26 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Debug|x64.ActiveCfg = Debug|x64 27 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Debug|x64.Build.0 = Debug|x64 28 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Debug|x64.Deploy.0 = Debug|x64 29 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Debug|x86.ActiveCfg = Debug|Win32 30 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Debug|x86.Build.0 = Debug|Win32 31 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Debug|x86.Deploy.0 = Debug|Win32 32 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Release|ARM.ActiveCfg = Release|ARM 33 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Release|ARM.Build.0 = Release|ARM 34 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Release|ARM.Deploy.0 = Release|ARM 35 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Release|ARM64.ActiveCfg = Release|ARM64 36 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Release|ARM64.Build.0 = Release|ARM64 37 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Release|ARM64.Deploy.0 = Release|ARM64 38 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Release|x64.ActiveCfg = Release|x64 39 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Release|x64.Build.0 = Release|x64 40 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Release|x64.Deploy.0 = Release|x64 41 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Release|x86.ActiveCfg = Release|Win32 42 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Release|x86.Build.0 = Release|Win32 43 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570}.Release|x86.Deploy.0 = Release|Win32 44 | EndGlobalSection 45 | GlobalSection(SolutionProperties) = preSolution 46 | HideSolutionNode = FALSE 47 | EndGlobalSection 48 | GlobalSection(ExtensibilityGlobals) = postSolution 49 | SolutionGuid = {D5A05110-0CA8-48CD-8F3F-AC6B0E9E470F} 50 | EndGlobalSection 51 | EndGlobal 52 | -------------------------------------------------------------------------------- /UseEPT/BlogVT/Asm.asm: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WWFWT/TinyVT/c0fe9b03f68859ff32aa0bdc16a25e2b0b452c80/UseEPT/BlogVT/Asm.asm -------------------------------------------------------------------------------- /UseEPT/BlogVT/Asm.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | #include"def.h" 3 | 4 | enum VmCall 5 | { 6 | CallExitVT, 7 | CallEptHook, 8 | CallEptUnHook, 9 | }; 10 | 11 | EXTERN_C 12 | { 13 | BOOLEAN __fastcall AsmVmxLaunch(PVOID callBack,PVOID thisPoint); 14 | void __fastcall AsmVmmEntryPoint(); 15 | void __fastcall AsmInvd(); 16 | void __fastcall AsmVmxCall(ULONG_PTR num, ULONG_PTR param); 17 | 18 | unsigned char __fastcall __fastcall AsmInvvpid( 19 | _In_ ULONG_PTR invvpid_type, 20 | _In_ ULONG_PTR* invvpid_descriptor); 21 | 22 | 23 | void _sgdt(void*); 24 | /// Writes to GDT 25 | /// @param gdtr A value to write 26 | void __fastcall AsmWriteGDT(_In_ const Gdtr* gdtr); 27 | 28 | /// Reads SLDT 29 | /// @return LDT 30 | USHORT __fastcall AsmReadLDTR(); 31 | 32 | /// Writes to TR 33 | /// @param task_register A value to write 34 | void __fastcall AsmWriteTR(_In_ USHORT task_register); 35 | 36 | /// Reads STR 37 | /// @return TR 38 | USHORT __fastcall AsmReadTR(); 39 | 40 | /// Writes to ES 41 | /// @param segment_selector A value to write 42 | void __fastcall AsmWriteES(_In_ USHORT segment_selector); 43 | 44 | /// Reads ES 45 | /// @return ES 46 | USHORT __fastcall AsmReadES(); 47 | 48 | /// Writes to CS 49 | /// @param segment_selector A value to write 50 | void __fastcall AsmWriteCS(_In_ USHORT segment_selector); 51 | 52 | /// Reads CS 53 | /// @return CS 54 | USHORT __fastcall AsmReadCS(); 55 | 56 | /// Writes to SS 57 | /// @param segment_selector A value to write 58 | void __fastcall AsmWriteSS(_In_ USHORT segment_selector); 59 | 60 | /// Reads SS 61 | /// @return SS 62 | USHORT __fastcall AsmReadSS(); 63 | 64 | /// Writes to DS 65 | /// @param segment_selector A value to write 66 | void __fastcall AsmWriteDS(_In_ USHORT segment_selector); 67 | 68 | /// Reads DS 69 | /// @return DS 70 | USHORT __fastcall AsmReadDS(); 71 | 72 | /// Writes to FS 73 | /// @param segment_selector A value to write 74 | void __fastcall AsmWriteFS(_In_ USHORT segment_selector); 75 | 76 | /// Reads FS 77 | /// @return FS 78 | USHORT __fastcall AsmReadFS(); 79 | 80 | /// Writes to GS 81 | /// @param segment_selector A value to write 82 | void __fastcall AsmWriteGS(_In_ USHORT segment_selector); 83 | 84 | /// Reads GS 85 | /// @return GS 86 | USHORT __fastcall AsmReadGS(); 87 | 88 | /// Loads access rights byte 89 | /// @param segment_selector A value to get access rights byte 90 | /// @return An access rights byte 91 | ULONG_PTR __fastcall AsmLoadAccessRightsByte(_In_ ULONG_PTR segment_selector); 92 | 93 | } 94 | -------------------------------------------------------------------------------- /UseEPT/BlogVT/BlogVT.vcxproj: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | Release 10 | Win32 11 | 12 | 13 | Debug 14 | x64 15 | 16 | 17 | Release 18 | x64 19 | 20 | 21 | Debug 22 | ARM 23 | 24 | 25 | Release 26 | ARM 27 | 28 | 29 | Debug 30 | ARM64 31 | 32 | 33 | Release 34 | ARM64 35 | 36 | 37 | 38 | {47D1F9E5-7C9B-451F-83F4-A92C79B82570} 39 | {dd38f7fc-d7bd-488b-9242-7d8754cde80d} 40 | v4.5 41 | 12.0 42 | Debug 43 | Win32 44 | BlogVT 45 | 46 | 47 | 48 | Windows10 49 | true 50 | WindowsKernelModeDriver10.0 51 | Driver 52 | WDM 53 | 54 | 55 | Windows10 56 | false 57 | WindowsKernelModeDriver10.0 58 | Driver 59 | WDM 60 | 61 | 62 | Windows10 63 | true 64 | WindowsKernelModeDriver10.0 65 | Driver 66 | WDM 67 | 68 | 69 | Windows10 70 | false 71 | WindowsKernelModeDriver10.0 72 | Driver 73 | WDM 74 | 75 | 76 | Windows10 77 | true 78 | WindowsKernelModeDriver10.0 79 | Driver 80 | WDM 81 | 82 | 83 | Windows10 84 | false 85 | WindowsKernelModeDriver10.0 86 | Driver 87 | WDM 88 | 89 | 90 | Windows10 91 | true 92 | WindowsKernelModeDriver10.0 93 | Driver 94 | WDM 95 | 96 | 97 | Windows10 98 | false 99 | WindowsKernelModeDriver10.0 100 | Driver 101 | WDM 102 | 103 | 104 | 105 | 106 | 107 | 108 | 109 | 110 | 111 | 112 | DbgengKernelDebugger 113 | 114 | 115 | DbgengKernelDebugger 116 | 117 | 118 | DbgengKernelDebugger 119 | false 120 | 121 | 122 | DbgengKernelDebugger 123 | 124 | 125 | DbgengKernelDebugger 126 | 127 | 128 | DbgengKernelDebugger 129 | 130 | 131 | DbgengKernelDebugger 132 | 133 | 134 | DbgengKernelDebugger 135 | 136 | 137 | 138 | 139 | 140 | 141 | 142 | 143 | 144 | 145 | 146 | 147 | 148 | 149 | 150 | 151 | 152 | 153 | 154 | 155 | 156 | 157 | 158 | 159 | 160 | -------------------------------------------------------------------------------- /UseEPT/BlogVT/BlogVT.vcxproj.filters: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hpp;hxx;hm;inl;inc;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | {8E41214B-6785-4CFE-B992-037D68949A14} 18 | inf;inv;inx;mof;mc; 19 | 20 | 21 | 22 | 23 | Source Files 24 | 25 | 26 | Source Files 27 | 28 | 29 | Source Files 30 | 31 | 32 | Source Files 33 | 34 | 35 | Source Files 36 | 37 | 38 | Source Files 39 | 40 | 41 | 42 | 43 | Header Files 44 | 45 | 46 | Header Files 47 | 48 | 49 | Header Files 50 | 51 | 52 | Header Files 53 | 54 | 55 | 56 | 57 | Source Files 58 | 59 | 60 | Source Files 61 | 62 | 63 | -------------------------------------------------------------------------------- /UseEPT/BlogVT/DriverEntry.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WWFWT/TinyVT/c0fe9b03f68859ff32aa0bdc16a25e2b0b452c80/UseEPT/BlogVT/DriverEntry.cpp -------------------------------------------------------------------------------- /UseEPT/BlogVT/EPT.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WWFWT/TinyVT/c0fe9b03f68859ff32aa0bdc16a25e2b0b452c80/UseEPT/BlogVT/EPT.cpp -------------------------------------------------------------------------------- /UseEPT/BlogVT/InitVMCS.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WWFWT/TinyVT/c0fe9b03f68859ff32aa0bdc16a25e2b0b452c80/UseEPT/BlogVT/InitVMCS.cpp -------------------------------------------------------------------------------- /UseEPT/BlogVT/TinyVT.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WWFWT/TinyVT/c0fe9b03f68859ff32aa0bdc16a25e2b0b452c80/UseEPT/BlogVT/TinyVT.cpp -------------------------------------------------------------------------------- /UseEPT/BlogVT/TinyVT.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WWFWT/TinyVT/c0fe9b03f68859ff32aa0bdc16a25e2b0b452c80/UseEPT/BlogVT/TinyVT.h -------------------------------------------------------------------------------- /UseEPT/BlogVT/VmExitHandler.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WWFWT/TinyVT/c0fe9b03f68859ff32aa0bdc16a25e2b0b452c80/UseEPT/BlogVT/VmExitHandler.cpp -------------------------------------------------------------------------------- /UseEPT/BlogVT/def.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | #include 3 | #include 4 | #include"ia32.h" 5 | 6 | #define Log(format, ...) DbgPrintEx(DPFLTR_IHVDRIVER_ID,DPFLTR_ERROR_LEVEL,"[MyVT]: " format "\n",##__VA_ARGS__) 7 | 8 | EXTERN_C 9 | NTKERNELAPI 10 | _IRQL_requires_(DISPATCH_LEVEL) 11 | _IRQL_requires_same_ 12 | VOID 13 | KeSignalCallDpcDone( 14 | _In_ PVOID SystemArgument1 15 | ); 16 | 17 | EXTERN_C 18 | NTKERNELAPI 19 | _IRQL_requires_(DISPATCH_LEVEL) 20 | _IRQL_requires_same_ 21 | LOGICAL 22 | KeSignalCallDpcSynchronize( 23 | _In_ PVOID SystemArgument2 24 | ); 25 | 26 | EXTERN_C 27 | NTKERNELAPI 28 | _IRQL_requires_max_(APC_LEVEL) 29 | _IRQL_requires_min_(PASSIVE_LEVEL) 30 | _IRQL_requires_same_ 31 | VOID 32 | KeGenericCallDpc( 33 | _In_ PKDEFERRED_ROUTINE Routine, 34 | _In_opt_ PVOID Context 35 | ); 36 | 37 | _IRQL_requires_max_(DISPATCH_LEVEL) 38 | void* __cdecl operator new(size_t size); 39 | 40 | _IRQL_requires_max_(DISPATCH_LEVEL) 41 | void __cdecl operator delete(void* p, SIZE_T size); 42 | 43 | BOOLEAN CheckVTSupport(); 44 | BOOLEAN CheckVTEnable(); 45 | PVOID kmalloc(ULONG_PTR size); 46 | void kfree(PVOID p); -------------------------------------------------------------------------------- /UseEPT/BlogVT/ia32.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WWFWT/TinyVT/c0fe9b03f68859ff32aa0bdc16a25e2b0b452c80/UseEPT/BlogVT/ia32.h -------------------------------------------------------------------------------- /UseEPT/BlogVT/util.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WWFWT/TinyVT/c0fe9b03f68859ff32aa0bdc16a25e2b0b452c80/UseEPT/BlogVT/util.cpp --------------------------------------------------------------------------------