search

Air14 / airhv

Simple Intel VT-x hypervisor
MIT License
254 stars 67 forks source link

can i hook a proc in R3 #6

Closed kkptm closed 2 years ago

kkptm commented 2 years ago

if winver<= win10(1809): good. winver >1909: throw error at ept.cpp->hook_function->{hooked_page_info->entry_address->execute =0;}.

kkptm commented 2 years ago

how can i fix it? can you help me?

Air14 commented 2 years ago

Does it throw an error when hooking r3 function or r0?

kkptm commented 2 years ago

yes , in R3

kkptm commented 2 years ago

Only in winver>1809

Air14 commented 2 years ago

Well, this project is not designed to hook user mode functions, I suggest you use this hyperisor https://github.com/wbenny/hvpp which has an example of how to hook um functions

kkptm commented 2 years ago

ok thanks