Alex Ionescu’s Blog🔒 SSL Verified

Table of Contents

• ↓ Posts
• ↓ Introduction
• ↓ Hypercall Basics
• ↓ Memory Descriptor Lists
• ↓ Issuing the Hypercall
• ↓ Sample Code — Bridging User and Kernel
• ↓ Top Alternatives to alex-ionescu.com

6-Month Traffic Trend Estimate

Official Contact & Profiles

Visual representation extracted from alex-ionescu.com

Content Snippets from alex-ionescu.com

"Windows Internals, Thoughts on Security, and Reverse Engineering"

"Previously, in Part 1, we were able to see how the Windows Driver Foundation (WDF) can significantly simplify the development of drivers, including even “research-type” non-PnP drivers. In this part, we will now enter the guts of Hyper-V and talk about how hypercalls work (a portmanteau of syscall (system call) as applied when talking about an OS->Hypervisor transition instead of an App->OS transition)."

"First, it’s important to learn that there are two kinds of hypercalls that Hyper-V supports, which are described in the Top Level Functional Specification (TLFS). The first, called regular or slow hypercalls, use physical addresses of RAM in order to send and receive input and output parameters, which are aligned to natural boundaries. We’ll have to learn about the Windows concept of Memory Descriptor Lists (MDLs) to explain how we can pass such data to Hyper-V, and this will be the topic of this part."

"The second kind of hypercall is called an extended fast hypercall and uses registers, including XMM non-integer registers in order to pass in up to 112 bytes of data, aligned on and padded to 8 byte boundaries. This is much faster as memory allocations and mappings are not involved, but requires some more complex understanding of memory alignments, and we’ll leave this for the next part."

Key Topics & Focus Areas for alex-ionescu.com:

Posts

Introduction

Hypercall Basics

Memory Descriptor Lists

Issuing the Hypercall

Sample Code — Bridging User and Kernel