This repository contains the full source-code of the HyperDeceit project which is a library that allows you to impersonate as Hyper-V and intercept hypercalls done by the Windows kernel.
Blog post: https://reversing.info/posts/hyperdeceit/
The code has not been through proper code review and hence might contain inconsistencies, please do create a new issue / pull request for any additions/fixes.
- TLB flushing
- Sleep / shutdown
- Address space switching
- Spinlock
Features which are not added yet and have plans to be added on later (Feel free to implement and create a new PR):
- IPI
- ???
- Only supports Windows versions from Windows 10 1709 to Windows 11 22H2.
- Includes/HyperDeceit.hpp is the header file which should be included in your project with the output library linked to use HyperDeceit.
- Bugcheck information
Code Reason 0xBAD00001 Unsupported Windows version. 0xBAD00002 Provided kernel base address was null. 0xBAD00003 Unhandled code. 0xBAD00004 Failed to disassemble address.
- Yumekage is a demo proof of concept for creating hidden memory regions inside a process.
- Vyacheslav Patkov for Hacker Disassembler Engine (HDE).