A complete report on HVCI bypass would typically include:
HVCI operates by creating a virtualization-based security environment. Here’s a simplified overview of its operation:
HVCI also remaps kernel memory. Code sections become read-only at the hypervisor level, and data sections become non-executable. Even if an attacker corrupts a page table entry (PTE), the hypervisor’s shadow page tables will override the request, causing a #GP (General Protection Fault) or a VBS violation.
In short, under HVCI, "self-modifying kernel code" becomes impossible.
Traditional Code Integrity (CI) (e.g., Kernel Mode Code Signing – KMCS) checks that any code loaded into the kernel is signed by a trusted authority. However, once loaded, that code can still be modified at runtime. A classic exploit would:
HVCI kills this workflow entirely.
Windows 11 on certain hardware (Intel Control-flow Enforcement Technology – CET) introduces shadow stacks and indirect branch tracking, making call table hijacking (data-only attacks) much harder because the return addresses are validated by the hypervisor. Hvci Bypass
If you are a security researcher looking to test HVCI bypass as a feature in your tool, I recommend focusing on:
Would you like a technical explanation of how HVCI works internally, or a safe, documented test method (e.g., using a signed test driver in a lab environment)?
Hypervisor-Protected Code Integrity (HVCI), or Memory Integrity, is a hardware-enforced security boundary that prevents unauthorized code from running in the Windows kernel. Bypassing it is a complex task that targets the "Secure World" created by Virtualization-Based Security (VBS). The Architecture: Why HVCI is Hard to Kill
In traditional Windows, the kernel (VTL0) is the highest authority. If you compromise it, you can disable security features like Driver Signature Enforcement (DSE). HVCI changes this by moving the "policing" logic to a Secure Kernel (VTL1) and a hypervisor (Hyper-V).
No-Execute (NX) Enforcement: The hypervisor uses Second Level Address Translation (SLAT) and Extended Page Tables (EPT) to mark kernel memory pages as Read-Execute (R-X) or Read-Write (R-W).
The "W^X" Rule: A page can never be Writable and Executable at the same time. This prevents an attacker from writing shellcode into a page and then running it. A complete report on HVCI bypass would typically
The Hypervisor Gatekeeper: Even if an attacker has kernel-level write access in VTL0, they cannot change these EPT permissions because they don't have access to the hypervisor's memory map. Primary Bypass Vectors 1. Data-Only Attacks (Living Off The Land)
Since you cannot execute your own code, you must manipulate the system's existing state.
SSDT Hijacking: Attackers target the System Service Descriptor Table (SSDT). While HVCI protects the code of system calls, the pointers in the SSDT are data. By using a "data-only" write primitive, an attacker can redirect system calls to existing, legitimate kernel functions that perform malicious actions when called out of sequence.
Control Flow Hijacking: Using Return-Oriented Programming (ROP) or Jump-Oriented Programming (JOP) to stitch together existing "gadgets" (snippets of valid code) to perform a task without ever injecting a single byte of new executable code. 2. Exploiting Hardware/Firmware Misconfigurations
The security of HVCI depends on the BIOS correctly reporting memory regions to the OS.
The UEFI "Hole" (CVE-2024-21305): Some systems had a vulnerability where certain physical memory regions (RMRRs) were incorrectly marked as Read-Write-Execute (RWX) by the BIOS. Traditional Code Integrity (CI) (e
Impact: Because the Secure Kernel wasn't aware these regions were RWX, it failed to "harden" them. An attacker with a kernel write primitive could place shellcode in these constant physical addresses and execute it, bypassing the entire HVCI architecture.
3. Vulnerable Driver Attacks (Bring Your Own Vulnerable Driver - BYOVD)
PatchGuard Peekaboo: Hiding Processes on Systems with ... - Outflank
HVCI relies on the hypervisor to synchronize shadow page tables with the guest’s PTEs. If an attacker can modify a PTE after the hypervisor has validated it but before the CPU uses it, they can slip in a forbidden permission.
This is a Time-of-Check to Time-of-Use (TOCTOU) attack.
Steps:
If the race is won, the CPU executes code from a page the hypervisor believed was data. This is highly timing-dependent and notoriously unreliable, but on single-core VMs or systems with weak hypervisor scheduling, it is plausible.
Mitigated by: Intel’s Transaction Synchronization Extensions (TSX) and hypervisor-assisted locks make this nearly impossible on modern hardware.