Velum-VMM - Hook syscall's on Mdern Windows using Intel-VT-x
Source Reddit Cybersecurity
Discussion
Velum-VMM is a research hypervisor for Windows x64 systems using Intel VT-x virtualization technology. It enables hooking of syscalls and kernel entries on modern Windows versions (Windows 10 and 11) with features such as live telemetry, scoped request policies, and access-right reduction. The project is intended for research and experimentation with kernel behavior and syscall monitoring rather than being a vulnerability or exploit. It provides interactive control over native calls and kernel activity through a console interface.
r/cybersecurity (opens in a new tab)u/quicaa0 points0 comments
I've published Velum-VMM, a Windows x64 research hypervisor written in C and assembly using Intel VT-x and EPT.
Source: https://github.com/Dovughs/velum-vmm
Technical write-up: https://github.com/Dovughs/velum-vmm/blob/main/readmes/technical-writeup/README.md
Velum virtualizes an already-running Windows kernel and provides an interactive console for observing native calls and experimenting with scoped request policies.
The implementation includes:
- Per-CPU VMCS and EPT management.
- EPT hooks on selected Nt and Ex/Mm function entries, with original-instruction replay and Monitor Trap Flag restoration.
- Live telemetry to the console or DebugView, with configurable filters.
- Request denial and access-right reduction for supported operations.
- CPUID configuration, fixed TSC offsets, and coordinated shutdown back to native execution.
Much of the work involved preserving execution state across VM exits, guest helpers and native return: CET shadow stacks, interruptibility, pending events, translation invalidation and hook lifetime.
One interesting compatibility issue appeared on Windows 10: ExFreePool and ExFreePoolWithTag resolved to the same address. Treating them as separate patch sites caused hook preparation to fail. The fix handles shared addresses while retaining both hooks when the exports are distinct.
I tested the project on Windows 10 and Windows 11. The repository includes runtime captures, policy demonstrations, build instructions and a technical write-up covering the architecture, debugging process and implementation decisions.
Source and releases:
https://github.com/Dovughs/velum-vmm
Technical write-up:
https://github.com/Dovughs/velum-vmm/blob/main/readmes/technical-writeup/README.md
I'd welcome technical feedback, particularly on VM-exit handling, EPT consistency and Windows compatibility.