Skip to content
This repository has been archived by the owner on Jul 11, 2024. It is now read-only.
/ matrix-rs Public archive

Rusty Hypervisor - Windows Kernel Blue Pill Type-2 Hypervisor in Rust (Codename: Matrix)

License

Notifications You must be signed in to change notification settings

memN0ps/matrix-rs

Repository files navigation

Windows Kernel Blue Pill Type-2 Hypervisor in Rust (Codename: Matrix)

License Issues Forks Stars

A lightweight, memory-safe, and blazingly fast Rust-based type-2 research hypervisor with hooks for Intel VT-x, focused on studying the core concepts of virtualization.

Note: The Illusion hypervisor (Windows UEFI Blue Pill Type-1 Hypervisor in Rust) is more stable, supports more features, and is overall better designed. The Matrix hypervisor (Windows Kernel Blue Pill Type-2 Hypervisor in Rust) is an older, experimental version and is not intended for production use. Both projects serve as templates to help people get started with hypervisor development in Rust.

Features

  • Extended Page Tables (EPT): Support for Memory Type Range Registers (MTRR).
  • VM Exit Handling: Handling of ExceptionOrNmi (#GP, #PF, #BP, #UD), Cpuid, Getsec, Vmcall, Vmclear, Vmlaunch, Vmptrld, Vmptrst, Vmresume, Vmxon, Vmxoff Rdmsr, Wrmsr, Invd, Rdtsc, EptViolation, EptMisconfiguration, Invept, Invvpid, Xsetbv.
  • Hidden Kernel Inline Hooks: PatchGuard-compatible breakpoint (int3) hooks.
  • Hidden System Call (Syscall) Hooks: PatchGuard-compatible hooks for System Service Descriptor Table (SSDT) function entries.
  • Isolation and Security: Custom implementations of the Global Descriptor Table (GDT), Interrupt Descriptor Table (IDT), and Page Tables to improve the security and isolation of the hypervisor. Credits to @namazso for raising awareness.

Supported Hardware

  • ✅ Intel processors with VT-x and Extended Page Tables (EPT) support.
  • ❌ AMD processors with AMD-V (SVM) and Nested Page Tables (NPT) support.

Supported Platforms

  • ✅ Windows 10 - Windows 11, x64 only.

Installation

  1. Install Rust from here.
  2. Switch to Rust Nightly: rustup toolchain install nightly and rustup default nightly.
  3. Install LLVM: winget install LLVM.LLVM.
  4. Install Tools: cargo install cargo-make cargo-expand cargo-edit cargo-workspaces.
  5. Install WDK/SDK/EWDK: Steps here.
  6. Set the WDKContentRoot environment variable to point to your WDK installation path, If it hasn't been set automatically during the WDK installation:
[System.Environment]::SetEnvironmentVariable("WDKContentRoot", "C:\Program Files (x86)\Windows Kits\10", [System.EnvironmentVariableTarget]::User)

Building the Project

  • Development: cargo make --profile development.
  • Production: cargo make --profile release.

Debugging

Enabling Debug Modes

  • Test Mode: Activate test signing with bcdedit.exe /set testsigning on.
  • Windows Debugging: Follow the steps in this Microsoft guide.
bcdedit.exe /bootdebug {bootmgr} on
bcdedit.exe /bootdebug on
bcdedit.exe /debug on

Network Debugging with Windbg

Setup: bcdedit.exe /dbgsettings net hostip:w.x.y.z port:n.

Debug Print Filter

  1. Open regedit.exe.
  2. Go to HKLM\SYSTEM\CurrentControlSet\Control\Session Manager.
  3. Create Debug Print Filter with DEFAULT DWORD = 8.

VMware Serial Port Debugging

  1. Add Serial Port in VMware: 'Use output file'.
  2. Configure in Windows VM: $serialPort = New-Object System.IO.Ports.SerialPort COM2,9600,None,8,One; $serialPort.Open().

Service Management

Use Service Controller (sc.exe) to create and manage the hypervisor service:

sc.exe create matrix type= kernel binPath= C:\Windows\System32\drivers\matrix.sys
sc.exe query matrix
sc.exe start matrix

Usage

  1. Setup for VMware Workstation

    Build the Project: Follow the build instructions provided in the previous sections to compile the project.

  2. Set Up VMware Workstation

    Configure the VMware serial port for debugging.

VMware Serial Port Settings Figure 1: VMware Serial Port Settings

Ensure that "Virtualize Intel VT-x/EPT or AMD-V/RVI" is enabled and "Virtualize IOMMU (IO memory management unit)" is enabled.

VMware Processors Settings Figure 2: VMware Processors Settings

  1. Copy the Driver

    Copy the matrix.sys driver to the C:\Windows\System32\drivers directory.

  2. VMware Serial Port Debugging

    Execute the PowerShell script in the Serial Port Debugging section to open the serial port.

  3. Load the Hypervisor

    Use the load.ps1 PowerShell script shown in the Service Management section to create and start the hypervisor service.

Load Hypervisor Figure 3: Load Hypervisor

PoC

Hypervisor PoC Setup Figure 4: Logs and Windbg PoC Setup

Hypervisor PoC Execute Figure 5: Logs and Windbg PoC Execute

Acknowledgments, References, and Motivation

Big thanks to the amazing people and resources that have shaped this project. A special shout-out to everyone listed below. While I didn't use all these resources in my work, they've been goldmines of information, super helpful for anyone diving into hypervisor development, including me.

Community and Technical Resources

Helpers and Collaborators

Special thanks to:

License

This project is licensed under the MIT License. For more information, see the MIT License details.