SIMPLE IS BETTER

Linked to here:  https://01.org/intel-kgt/blogs  or  https://01.org/intel-kgt/blogs/bzhu5/2015/coreos-ikgt <END>

See the official site for details: https://01.org/intel-kgt <END>

Recently I've reviewed nearly 100 Xen Security Advisories ( http://xenbits.xen.org/xsa/ ), except some bad security coding practices for...

More recently, one of my colleagues asked me why there is a feature called " Interrupt Window exiting " in virtualization technolo...

"single-stepping on branches" is processor hardware feature of x86/Intel architecture. When it is enabled, the processor generates...

Stack Pivoting is a common technique widely used by vulnerability exploits to bypass hardware protections like NX/SMEP, or to chain ROP ( Re...

SMEP (Supervisor Mode Execution Prevention) is a mitigation that aims to prevent the CPU from running code from user-mode while in kernel-mo...

This blog announced that  the Preview for Visual Studio 2015 includes a new, work-in-progress feature, called Control Flow Guard (CFG). 

I was so excited when recently reading the paper ( ret2dir: Rethinking Kernel Isolation ) from  Vasileios P. Kemerlis . This post is basical...

This post is not talking about any new idea, just about what I'm thinking..

According to IA32/Intel Software Development Manual, when some PMU (Performance Monitor Unit) counter overflows occur, or LBR (Last Branch R...

On x86 and many other processor architectures (with MMU), page tables are critical data structures for address translations. And many hardwa...

In my previous post , I talked about how to implement a software-based SMEP ( S upervisor Mode Execution Protection ) with virtualization/hy...

Rafal Wojtczuk (from Bromium , previously Invisible Things Lab ) presented DMA attacks against DeepSafe. 

Control Flow Hijacking, like ROP, becomes a hot topic in recent years since ever DEP(W^X enforcement) and SMEP were introduced in h/w proces...

As my previous post indicated, SMEP is a powerful security feature, and easy to deploy in modern commodity OS. However this feature require...

Intel Transactional Synchronization Extensions  (TSX) was introduced since from Haswell processor with adding hardware transactional memory...

Thanks to Yushi  who shared a presentation ( ELI: Bare-Metal Performance for I/O Virtualization ) with me. In that hypervisor (ELI), it inno...

Monitor Trap Flag (MTF) is a flag specifically designed for single-stepping in x86/Intel hardware virtualization VT-x technology. When MTF i...

This post is wrote to share an idea of the paper ( BitVisor: A Thin Hypervisor for Enforcing I/O Device Security ) that I read recently. It ...

In my previous post Why smaller code size with XEN on ARM? , one of reasons I explained is that XEN on x86 must support different guest work...

Unlike a general-purpose, commercial operating system (like Windows, Ubuntu), OSv ( http://osv.io/ from cloudius-systems) is a single-purpo...

Previously I wrote a post to discuss the limitations for Multiboot boot specification , today I saw that XEN hypervisor also has the similar...

I'm planning to write a post for debugging  Bug Check 0x101 issue (CLOCK_WATCHDOG_TIMEOUT) in Windows system. but I happened to find th...

To be continued for previous post , let me review what must be changed in Linux kernel in order to prevent buffer overrun/overflow attacks f...

I'm not sure if this kernel bug that I reported in last year has been fixed in the latest Win8.1 32bit system. The bug is : any  NMI (N...

Recently, when reading this paper " HyperSafe - A Lightweight Approach to Provide Lifetime Hypervisor Control-Flow Integrity ", an...

Traditionally, arbitrary malicious code execution (e.g. caused by buffer overflow, stack or heap manipulation) is one of major threats in co...

Since VMware product (e.g. Player) now supports nested  virtualization  VT-x/VMX , recently I wanted to use this feature to debug XEN w/ EFI...

In Linux kernel, thread_info is a small CPU-specific data structure that stores some low-level task data for corresponding process, it also...

<For some reason, I cannot public it. But I'm planning to open it at some time later > This blog presents an idea to defend agai...

This white paper ( Xen ARM with Virtualization Extensions whitepaper )  indicates that " Xen on ARM is 1/6 of the code size of x86_64 X...

A typical virtualization system on both x86 and ARM includes three major parts: CPU virtualization Memory virtualization, and  I/O virtu...

In an unix-like system, before syscall/sysret and/or sysenter/sysexit instructions were introduced by x86/Intel processors, software interru...

In computer security, information leaking is one of threats to software security. For example, the memory address of kernel critical resourc...

A NULL pointer dereference occurs when a pointer with the value of 0 (NULL) is assumed to be a valid memory location, and that pointer is  t...

Recently in the latest Intel SDM,  you can find that there is a new exception type, Virtualization Exception , in Chapter 6 (Interrupt and E...

x86 and ARM processors both provide many hardware enforced security features, e.g. NX (No-eXecute) for executable space protection , to help...

This article describes an idea to monitor SYSCALL with x86 Hardware Virtualization Technology. It doesn't require visible guest code/dat...

Previously when I was working on a Hypervisor based on Intel VT-x. I always did exactly as what I'm told to do in the VT-x specification...

In embedded software development, sometimes when you're writing a PIC (position independent code) boot code, you might need to know at w...

What a contradiction! Programming with many hardcodes is not a good practice because it is hard to understand and also has maintainability...

According to Wikipedia , in computer science a memory map is a structure of data (which usually resides in memory itself) that indicates how...

A rootkit is a stealthy type of software, typically malicious, designed to hide the existence of itself or certain processes/programs from ...

Intel processor architectures provide debug facilities for use in debugging code and monitoring system behaviors. Such a debug support is ac...

Typically in a computer system, the boot sequence is like this: firmware -> bootloader -> Operating System.  The problem is that nowad...

This is a test, just a test!