Home

Awesome

HyperPlatform

Introduction

HyperPlatform is an Intel VT-x based hypervisor (a.k.a. virtual machine monitor) aiming to provide a thin platform for research on Windows. HyperPlatform is capable of monitoring a wide range of events, including but not limited to, access to virtual/physical memory and system registers, occurrences of interrupts and execution of certain instructions.

Researchers are free to selectively enable and/or disable any of those event monitoring and implement their own logic on the top of HyperPlatform. Some potential applications are:

A simplified implementation of those ideas are available:

Advantages

HyperPlatform is designed to be easy to read and extend by researchers, especially those who are familiar with Windows. For instance:

For more details, see the HyperPlatform User Document and Programmer's Reference.

Build

To build HyperPlatform for x64 Windows 10 and later, the following are required.

To build HyperPlatform for x86 and Windows 7 and 8.1, the following are required.

Installation and Uninstallation

Clone full source code from Github with a below command and compile it on Visual Studio.

$ git clone --recursive https://github.com/tandasat/HyperPlatform.git

On the x64 platform, you have to enable test signing to install the driver. To do that, open the command prompt with the administrator privilege and type the following command, and then restart the system to activate the change:

>bcdedit /set testsigning on

To install and uninstall the driver, use the 'sc' command. For installation:

>sc create HyperPlatform type= kernel binPath= C:\Users\user\Desktop\HyperPlatform.sys
>sc start HyperPlatform

Note that the system must support the Intel VT-x and EPT technology to successfully install the driver. On Windows 10 RS4+ systems, this technology can automatically be disabled by the Windows kernel which results in the following error.

>sc start HyperPlatform
[SC] StartService FAILED 3224698910:

A hypervisor feature is not available to the user.

This is due to Windows Defender Credential Guard being enabled by default. To disable Windows Defender Credential Guard and enable the virtualization technology for HyperPlatform, follow this instruction.

For uninstallation:

>sc stop HyperPlatform
>sc delete HyperPlatform
>bcdedit /deletevalue testsigning

To install the driver on a virtual machine on VMware Workstation, see an "Using VMware Workstation" section in the HyperPlatform User Document.

Output

All logs are printed out to DbgView and saved in C:\Windows\HyperPlatform.log.

Supported Platforms

Related Project(s)

SimpleVisor is a very (very) simple and readable Windows-specific hypervisor. I recommend taking a look at the project to learn VT-x if you are new to hypervisor development. It should give you a clearer view of how a hypervisor is initialized and executed.

ksm is lightweight-ish x64 hypervisor written in C for Windows for Intel processors. It demonstrates some advanced VT-x features like #VE and VMFUNC where HyperPlatform does not include.

Bareflank Hypervisor is an actively developed open source hypervisor. It comes with rich documents, tests, and comments, supports multiple platforms. The size of code is larger than that of HyperPlatform, but you will find it interesting if you are looking for more comprehensive yet still lightweight-ish hypervisors.

License

This software is released under the MIT License, see LICENSE.