search

hfiref0x / KDU

Kernel Driver Utility
MIT License
1.93k stars 423 forks source link

what happened to HVCI support? #75

Closed dumbasPL closed 1 year ago

dumbasPL commented 1 year ago

There are a lot of references to HVCI in the codebase but none of the providers have the KDUPROV_FLAGS_SUPPORT_HVCI flag. Was HVCI supported at one point and then got removed or what's the story behind it? It seems weird that there is a lot of code to handle it but none of the providers support it. The git commit history doesn't tell me much either.

I'm not asking for HVCI support (though it would be nice) but just wondering what happened to it.

hfiref0x commented 1 year ago

The HVCI support mean the driver is able to load with HVCI and has features "compatible" with HVCI, e.g. such driver is specially designed wormhole. Example of such driver is Microsoft Process Explorer (before 17.x version). However it features are not exactly what KDU needs in current design and thats why it doesn't have this flag.