{"id":15034482,"url":"https://github.com/tandasat/hyperplatform","last_synced_at":"2025-05-15T16:04:14.345Z","repository":{"id":37664490,"uuid":"52611236","full_name":"tandasat/HyperPlatform","owner":"tandasat","description":"Intel VT-x based hypervisor aiming to provide a thin VM-exit filtering platform on Windows.","archived":false,"fork":false,"pushed_at":"2023-11-24T15:18:16.000Z","size":7993,"stargazers_count":1605,"open_issues_count":16,"forks_count":421,"subscribers_count":107,"default_branch":"master","last_synced_at":"2025-04-21T11:39:21.100Z","etag":null,"topics":["driver","hypervisor","virtual-machine","windows-kernel"],"latest_commit_sha":null,"homepage":"","language":"C++","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/tandasat.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2016-02-26T14:52:35.000Z","updated_at":"2025-04-19T09:20:02.000Z","dependencies_parsed_at":"2024-01-12T03:36:27.584Z","dependency_job_id":"12625835-ac35-4280-8476-84a4b34541ed","html_url":"https://github.com/tandasat/HyperPlatform","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tandasat%2FHyperPlatform","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tandasat%2FHyperPlatform/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tandasat%2FHyperPlatform/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tandasat%2FHyperPlatform/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/tandasat","download_url":"https://codeload.github.com/tandasat/HyperPlatform/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254374404,"owners_count":22060609,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["driver","hypervisor","virtual-machine","windows-kernel"],"created_at":"2024-09-24T20:25:15.666Z","updated_at":"2025-05-15T16:04:14.322Z","avatar_url":"https://github.com/tandasat.png","language":"C++","readme":"HyperPlatform\n==============\n\nIntroduction\n-------------\nHyperPlatform is an Intel VT-x based hypervisor (a.k.a. virtual machine monitor)\naiming to provide a thin platform for research on Windows. HyperPlatform is\ncapable of monitoring a wide range of events, including but not limited to,\naccess to virtual/physical memory and system registers, occurrences of interrupts\nand execution of certain instructions.\n\nResearchers are free to selectively enable and/or disable any of those event\nmonitoring and implement their own logic on the top of HyperPlatform. Some\npotential applications are:\n- Analyzing kernel mode rootkit\n- Implementing virtual-machine-based intrusion prevention system (VIPS)\n- Reverse-engineering the Windows kernel\n\nA simplified implementation of those ideas are available:\n- MemoryMon detecting execution of kernel memory for rootkit analysis\n - https://github.com/tandasat/MemoryMon\n- EopMon spotting a successful elevation of privilege (EoP) exploit\n - https://github.com/tandasat/EopMon\n- DdiMon monitoring and controlling kernel API calls with stealth hook using EPT\n - https://github.com/tandasat/DdiMon\n- GuardMon observing some of PatchGuard activities\n - https://github.com/tandasat/GuardMon\n\n\nAdvantages\n-----------\nHyperPlatform is designed to be easy to read and extend by researchers,\nespecially those who are familiar with Windows. For instance:\n- HyperPlatform runs on Windows 7, 8.1 and 10 in both 32 and 64 bit architectures\n  without any special configuration (except for enabling Intel-VT technology).\n- HyperPlatform compiles in Visual Studio and can be debugged though Windbg\n  just like a regular software driver.\n- Source code of HyperPlatform is written and formatted in existing styles\n  (Google C++ Style Guide and clang-format), and well commented.\n- HyperPlatform has no dependencies, supports use of STL and is released under\n  a relaxed license.\n\nFor more details, see the HyperPlatform User Document and Programmer's Reference.\n- https://tandasat.github.io/HyperPlatform/userdocument/\n- https://tandasat.github.io/HyperPlatform/doxygen/\n\n\nBuild\n------\nTo build HyperPlatform for x64 Windows 10 and later, the following are required.\n- Visual Studio Community 2022\n- Windows Software Development Kit (SDK) for Windows 10 (10.0.22621 or later)\n- Windows Driver Kit (WDK) 10 (10.0.22621 or later)\n\nTo build HyperPlatform for x86 and Windows 7 and 8.1, the following are required.\n- Visual Studio Community 2019\n- Windows Software Development Kit (SDK) for Windows 10 (10.0.22000)\n- Windows Driver Kit (WDK) 10 (10.0.22000)\n\n\nInstallation and Uninstallation\n--------------------------------\nClone full source code from Github with a below command and compile it on Visual\nStudio.\n\n    $ git clone --recursive https://github.com/tandasat/HyperPlatform.git\n\nOn the x64 platform, you have to enable test signing to install the driver.\nTo do that, open the command prompt with the administrator privilege and type\nthe following command, and then restart the system to activate the change:\n\n    \u003ebcdedit /set testsigning on\n\nTo install and uninstall the driver, use the 'sc' command. For installation:\n\n    \u003esc create HyperPlatform type= kernel binPath= C:\\Users\\user\\Desktop\\HyperPlatform.sys\n    \u003esc start HyperPlatform\n\nNote that the system must support the Intel VT-x and EPT technology to\nsuccessfully install the driver. On Windows 10 RS4+ systems, this technology\ncan automatically be disabled by the Windows kernel which results in the\nfollowing error.\n\n    \u003esc start HyperPlatform\n    [SC] StartService FAILED 3224698910:\n\n    A hypervisor feature is not available to the user.\n\nThis is due to Windows Defender Credential Guard being enabled by default.\nTo disable Windows Defender Credential Guard and enable the virtualization\ntechnology for HyperPlatform, follow this instruction.\n- https://docs.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-manage\n\nFor uninstallation:\n\n    \u003esc stop HyperPlatform\n    \u003esc delete HyperPlatform\n    \u003ebcdedit /deletevalue testsigning\n\nTo install the driver on a virtual machine on VMware Workstation, see an \"Using\nVMware Workstation\" section in the HyperPlatform User Document.\n- https://tandasat.github.io/HyperPlatform/userdocument/\n\n\nOutput\n-------\nAll logs are printed out to DbgView and saved in C:\\Windows\\HyperPlatform.log.\n\n\nSupported Platforms\n--------------------\n- x86 and x64 Windows 7, 8.1 and 10\n- The system must support the Intel VT-x and EPT technology\n\n\nRelated Project(s)\n--------------------\n- SimpleVisor\n - http://ionescu007.github.io/SimpleVisor/\n\nSimpleVisor is a very (very) simple and readable Windows-specific hypervisor. I\nrecommend taking a look at the project to learn VT-x if you are new to hypervisor\ndevelopment. It should give you a clearer view of how a hypervisor is initialized\nand executed.\n\n- hvpp\n - https://github.com/wbenny/hvpp\nhvpp is a lightweight Intel x64/VT-x hypervisor written in C++. This is about the\nsame size as HyperPlatform in LOC yet written in a more polished matter with focus\non x64, making the entire code base more readable. This project also addresses\nsome issues remain unresolved in HyperPlatform and comes with educational comments\nand demonstration code to learn VT-x in more depth. Unless you are allergic to C++\nor looking for x86 support, I strongly encourage you to study this project too.\n\n- ksm\n - https://github.com/asamy/ksm\n\nksm is lightweight-ish x64 hypervisor written in C for Windows for Intel\nprocessors. It demonstrates some advanced VT-x features like #VE and VMFUNC where\nHyperPlatform does not include.\n\n- Bareflank Hypervisor\n - http://bareflank.github.io/hypervisor/\n\nBareflank Hypervisor is an actively developed open source hypervisor. It comes\nwith rich documents, tests, and comments, supports multiple platforms. The size\nof code is larger than that of HyperPlatform, but you will find it interesting if\nyou are looking for more comprehensive yet still lightweight-ish hypervisors.\n\n\nLicense\n--------\nThis software is released under the MIT License, see LICENSE.\n","funding_links":[],"categories":["\u003ca id=\"b478e9a9a324c963da11437d18f04998\"\u003e\u003c/a\u003e工具"],"sub_categories":["\u003ca id=\"19cfd3ea4bd01d440efb9d4dd97a64d0\"\u003e\u003c/a\u003eVT\u0026\u0026虚拟化\u0026\u0026Hypbervisor"],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftandasat%2Fhyperplatform","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftandasat%2Fhyperplatform","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftandasat%2Fhyperplatform/lists"}