Skip to content

Instantly share code, notes, and snippets.

@vits71
vits71 / DmaHvBackdoor.c
Created August 28, 2017 10:30
Hyper-V backdoor for UEFI
/*
*********************************************************************
Part of UEFI DXE driver code that injects Hyper-V VM exit handler
backdoor into the Device Guard enabled Windows 10 Enterprise.
Execution starts from new_ExitBootServices() -- a hook handler
for EFI_BOOT_SERVICES.ExitBootServices() which being called by
winload!OslFwpKernelSetupPhase1(). After DXE phase exit winload.efi
transfers exeution to previously loaded Hyper-V kernel (hvix64.sys)
### Keybase proof
I hereby claim:
* I am vits71 on github.
* I am vits71 (https://keybase.io/vits71) on keybase.
* I have a public key ASBKxza4PmmRrKh-OXZdhiTBtrI4VGdJfB4LP5nxIslCTwo
To claim this, I am signing this object: