Posts in category: Hypervisor

Aidan Khoury’s Part 2 of the revers.engineering PatchGuard series — two LSTAR-focused checks. KiErrata420Present briefly overwrites LSTAR with a one-byte RET stub and trips naive hypervisors that block WRMSR(LSTAR); the fix is a transparent MSR shadow. KiErrata1337Present is Khoury’s own derived detection that zeros IA32_KERNEL_GS_BASE, forces a #PF inside the syscall handler, hooks #PF through a temporary IDT, and uses one XCHG against the trap frame to read out the real syscall handler address. Full PoC at ajkhoury/Errata1337.