HyperDeceit is the ultimate all-in-one library that emulates Hyper-V for Windows, giving you the ability to intercept and manipulate operating system tasks with ease.
- C++ 100%
| HyperV | ||
| Includes | ||
| Misc | ||
| Utils | ||
| Common.hpp | ||
| HyperDeceit.cpp | ||
| HyperDeceit.vcxproj | ||
| HyperDeceit.vcxproj.filters | ||
| HyperDeceit.vcxproj.user | ||
| LICENSE | ||
| README.md | ||
HyperDeceit
This repository contains the full source-code of the HyperDeceit project which is a library that allows you to impersonate as Hyper-V and intercept hypercalls done by the Windows kernel.
Blog post: https://reversing.info/posts/hyperdeceit/
Disclaimer
The code has not been through proper code review and hence might contain inconsistencies, please do create a new issue / pull request for any additions/fixes.
Implementations
The following features are ready to be hooked out of the box:
- TLB flushing
- Sleep / shutdown
- Address space switching
- Spinlock
Features which are not added yet and have plans to be added on later (Feel free to implement and create a new PR):
- IPI
- ???
Compatibility
- Only supports Windows versions from Windows 10 1709 to Windows 11 22H2.
Notes
- Includes/HyperDeceit.hpp is the header file which should be included in your project with the output library linked to use HyperDeceit.
- Bugcheck information
Code Reason 0xBAD00001 Unsupported Windows version. 0xBAD00002 Provided kernel base address was null. 0xBAD00003 Unhandled code. 0xBAD00004 Failed to disassemble address.
Examples
- Yumekage is a demo proof of concept for creating hidden memory regions inside a process.
Credits
- Vyacheslav Patkov for Hacker Disassembler Engine (HDE).