tandasat

Intel VT-x based hypervisor aiming to provide a thin VM-exit filtering platform on Windows.

Monitoring and controlling kernel API calls with stealth hook using EPT

The materials of "Hypervisor 101 in Rust", a one-day long course, to quickly learn hardware-assisted virtualization technology and its application for high-performance fuzzing on Intel/AMD...

The research UEFI hypervisor that supports booting an operating system.

A minimalistic educational hypervisor for Windows on AMD processors.

SimpleSvmHook is a research purpose hypervisor for Windows on AMD processors.

A bare minimum hypervisor on AMD and Intel processors for learners.

This is a standalone exploit for a vulnerable feature in Capcom.sys

PatchGuard Research

Detecting execution of kernel memory where is not backed by any image file

Sample use cases of the .NET native code hooking technique

Python scripts for reverse engineering.

The Windbg extensions to study Hyper-V on Intel and AMD processors.

Hypervisor based tool for monitoring system register accesses.

The report and the exploit of CVE-2021-26943, the kernel-to-SMM local privilege escalation vulnerability in ASUS UX360CA BIOS version 303.

The runtime DXE driver monitoring access to the UEFI variables by hooking the runtime service table.

The simple UEFI application to create a Windows Platform Binary Table (WPBT) from the UEFI shell.

Elevation of privilege detector based on HyperPlatform

Windbg extension to find PatchGuard pages

IDA Plugin which decodes Windows Device I/O control code into DeviceType, FunctionCode, AccessType and MethodType.

a Japanese food keeps you sane

HelloAmdHvPkg is a type-1 research hypervisor for AMD processors.

A simple hypervisor demonstrating the use of the Intel VT-rp (redirect protection) technology.

Tool to dump UEFI runtime drivers implementing runtime services for Windows

This is an instruction to run your own SMM code.

Security Camp 2021 & GCC 2022

A hypervisor hiding user-mode memory using EPT

A software driver that lets you log kernel-mode debug output into a file on Windows.

Report and exploit of CVE-2023-36427

A minifilter driver preserves all modified and deleted files.

A tool to help malware analysts tell that the sample is injecting code into other process.

The sample DXE runtime driver demonstrating how to program DMA remapping.

nyā

The materials of the "Hypervisors for Hackers: Security from the Hardware Up" class held at Global Cybersecurity Camp 2026 Vietnam.

Generates a Python script to give public interface names in an ActiveX file to an IDB file.