A small Intel VT-x hypervisor for Windows x64.
I made this project to better understand how VMX works: entering VMX operation, setting up the VMCS, handling VM exits, and returning control to Windows without leaving the processor in a broken state.
This is a learning project and is not intended for production use.
The driver enables VMX on every active logical processor and creates a separate VMXON region, VMCS, MSR bitmap, and host stack for each CPU.
Implemented VM-exit handlers:
CPUIDMOV CRMOV DRRDMSRandWRMSRRDTSCandRDTSCPXSETBV- Port I/O
HLTVMCALL
The hypervisor can also inject #UD and #GP exceptions back into the guest.
A private VMCALL is used during driver unload to leave VMX operation and restore the original processor state.
- Windows 10 or Windows 11 x64
- Intel processor with VT-x support
- VT-x enabled in BIOS/UEFI
- Visual Studio 2022
- Windows Driver Kit
Hyper-V, VBS, or Memory Integrity may prevent the driver from using VT-x.
AMD processors are not supported.
Open simple-intel-hv.sln, select the x64 platform, and build either the Debug or Release configuration.
The compiled driver will be placed in:
simple-intel-hv/x64/Debug/simple-intel-hv.sys
or:
simple-intel-hv/x64/Release/simple-intel-hv.sys
The driver must be signed, or Windows must be running in test-signing mode.
Register and start the driver:
sc.exe create simple-intel-hv type= kernel start= demand binPath= "C:\Path\To\simple-intel-hv.sys"
sc.exe start simple-intel-hvStop and remove it:
sc.exe stop simple-intel-hv
sc.exe delete simple-intel-hvsource/
├── driver.cpp
├── platform/
│ └── kernel.hpp
└── hv/
├── arch/ # VM-exit and segment assembly code
├── util/ # VMX memory allocation
├── vmcs/ # VMCS setup and VM-exit handling
├── vmx/ # VMX initialization and shutdown
└── state.hpp # Per-processor state
third_party/
└── ia32/ # Intel architecture definitions
Internal failures call KeBugCheckEx with a short ASCII signature in the first argument. This makes it easier to find the failing code while analyzing a crash dump.
| Signature | Meaning |
|---|---|
HVRIP |
Failed to advance guest RIP |
HVINJ |
Failed to inject an exception |
HVXCR |
Failed to read state for XSETBV |
HVCR0 |
Failed to update guest CR0 |
HVCR3 |
Failed to update guest CR3 |
HVCR4 |
Failed to update guest CR4 |
HVCRG |
Invalid register during CR access |
HVDRG |
Invalid register during DR access |
HVMSR |
Failure during MSR handling |
HVIOW |
Invalid I/O width |
HVREAD |
Failed to read VMCS state |
HVRD |
Failed to read guest state during shutdown |
This hypervisor does not implement:
- Extended Page Tables
- Nested virtualization
- Virtual APIC
- Complete interrupt virtualization
- Guest memory isolation
- Support for AMD-V
Unsupported VM exits currently result in a bugcheck. Silently continuing with an invalid guest state would make failures much harder to diagnose.
Use a virtual machine with nested virtualization enabled or a separate test system. Experimental VMX code can freeze or crash the entire machine.
