https://github.com/tandasat/guardmon

Hypervisor based tool for monitoring system register accesses.
https://github.com/tandasat/guardmon

Last synced: 7 months ago
JSON representation

Hypervisor based tool for monitoring system register accesses.

• Host: GitHub
• URL: https://github.com/tandasat/guardmon
• Owner: tandasat
• License: mit
• Created: 2016-02-26T15:01:26.000Z (over 9 years ago)
• Default Branch: master
• Last Pushed: 2018-09-13T03:40:31.000Z (over 6 years ago)
• Last Synced: 2024-07-14T19:37:10.637Z (11 months ago)
• Language: C++
• Homepage:
• Size: 109 KB
• Stars: 141
• Watchers: 19
• Forks: 71
• Open Issues: 2
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

README

        
GuardMon

=========

Introduction

-------------

GuardMon is a hypervisor based tool for monitoring system register accesses.

GuardMon is capable of logging read and write activities on CR0, CR4, debug

registers, GDT, IDT and MSRs from kernel memory not backed by any images.

This tool is particularly useful for analyzing the Windows built-in kernel patch

protection, a.k.a. PatchGuard as it runs on non-image regions most of time. A

demo movie can be found in Youtube:

- https://www.youtube.com/watch?v=PUcBtd0fZeA

GuardMon is implemented on the top of HyperPlatform and primarily designed for a

demo purpose. See a project page for more details of HyperPlatform:

- https://github.com/tandasat/HyperPlatform

Installation and Uninstallation

--------------------------------

Clone full source code from Github with a below command and compile it on Visual

Studio.

    $ git clone --recursive https://github.com/tandasat/GuardMon.git

On the x64 platform, you have to enable test signing to install the driver.

To do that, open the command prompt with the administrator privilege and type

the following command, and then restart the system to activate the change:

    >bcdedit /set testsigning on

To install and uninstall the driver, use the 'sc' command. For installation:

    >sc create GuardMon type= kernel binPath= C:\Users\user\Desktop\GuardMon.sys

    >sc start GuardMon

For uninstallation:

    >sc stop GuardMon

    >sc delete GuardMon

    >bcdedit /deletevalue testsigning

Note that the system must support the Intel VT-x and EPT technology to

successfully install the driver.

To install the driver on a virtual machine on VMware Workstation, see an "Using

VMware Workstation" section in the HyperPlatform User Document.

- https://tandasat.github.io/HyperPlatform/userdocument/

Output

-------

All logs are printed out to DbgView and saved in C:\Windows\GuardMon.log.

Supported Platforms

----------------------

- x64 Windows 7, 8.1 and 10

- The system must support the Intel VT-x and EPT technology

License

--------

This software is released under the MIT License, see LICENSE.