PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Debugging Windows Isolated User Mode (IUM) Processes

blog.quarkslab.com | research | #windows | #reverse-engineering | #hyper-v | #debugging | #ium | #trustlet
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

How to debug Windows Isolated User Mode (IUM) processes, aka Trustlets: using Hyper-V's virtual TPM as the target, with background on Virtual Secure Mode and Virtual Trust Levels.
Published
Collected

Related coverage

research · blog.quarkslab.com
Linux kernel instrumentation from Qemu and Gdb
A tutorial on instrumenting the Linux kernel from QEMU and GDB: using a hypervisor for stealthy analysis, plus GDB scripting and kernel helper tools to monitor syscalls, processes and modules.
research · blog.quarkslab.com
A virtual journey: From hardware virtualization to Hyper-V's Virtual Trust Levels
A step-by-step reverse engineering journey into Hyper-V's internals, explaining how Intel VT-x hardware virtualization enables Virtual Trust Levels (VTLs) and memory segregation in Windows.
research · blog.quarkslab.com
LLDBagility: practical macOS kernel debugging
Presents LLDBagility, which attaches LLDB to a VirtualBox macOS VM via the Fast Debugging Protocol for kernel breakpoints, watchpoints and pause — no debug kernel or SIP changes needed.
research · blog.quarkslab.com
An overview of macOS kernel debugging
First of two posts on macOS kernel debugging: kernel debugger fundamentals, how debugging is implemented for XNU, and the limitations of current tooling (debug kernel builds, no watchpoints).
research · blog.quarkslab.com
Introduction to Trusted Execution Environment: ARM's TrustZone
First of two posts on hardware TEEs: introduces Trusted Execution Environments, then ARM TrustZone — Secure and Non-Secure worlds, monitor mode, and trustlet-based trusted applications.
research · blog.quarkslab.com
Windows 8 ate my cookie
Windows 8's stack-cookie protection investigated: the default cookie is already randomised before a program's entry point, so the authors use kernel debugging to find which loader code sets it.
Back