PowerVM

Disclaimer

Note

This project contains security research code developed for educational and defensive anti-cheat evaluation purposes. I AM NOT RESPONSIBLE FOR ANY DAMAGES CAUSED BY THIS SOFTWARE.

Overview

PowerVM is a stealth Type-1 hypervisor built on AMD-SVM (Secure Virtual Machine) and NPT (Nested Page Tables) hardware virtualization technology. It was designed specifically to debug processes protected by modern anti-cheat systems (such as VMProtect and Tencent ACE) without triggering detection mechanisms.

Architecture

+-----------------------------------------------------+
|                 User Mode (Ring 3)                  |
|          PowerVM Launcher / PowerVM Engine          |
+--------------------------+--------------------------+
                           | IOCTL
+--------------------------v--------------------------+
|                Kernel Mode (Ring 0)                 |
|   PowerVM_KernelBridge -- Bridge -- PowerVM.sys     |
+--------------------------+--------------------------+
                           | VMEXIT / Hypercall
+--------------------------v--------------------------+
|                Hypervisor (Ring -1)                 |
|         AMD-SVM + NPT Hook VMEXIT Handler           |
+-----------------------------------------------------+

---

Module Overview

Module	File(s)	Description
SVM Core	SVM.cpp, SVM.h	AMD-SVM VMCB initialization, per-CPU vCPU context structures, VMEXIT dispatcher (svm_vmexit_handler), and state restoration.
Nested Page Tables	NPT.cpp, NPT.h	4-level NPT paging hierarchy construction (PML4, PDPT, PD, PT), 2MB large page splitting, and PTE access permission control.
Hook Engine	Hook.cpp, Hook.h	NPT-based Execute/Read page separation (FakePage and TrampolinePage generation), HDE64 instruction decoding, and kernel API redirection.
Process Protection	Hide.cpp, Hide.h	Protected PID and HWND state tracking, handle access control list (ACL) modification, and window list filtering.
Deep Kernel Hooks	DeepHook.cpp, DeepHook.h	Pattern-scanning engine for locating unexported NT kernel functions (PspInsertThread, KiInsertQueueApc, PspCallThreadNotifyRoutines).
Shadow Debugger	DebugApi.cpp, DebugApi.h	Custom Ring -1 debug object pool (Hvm_DebugObject), shadow debug port implementation, hardware breakpoint registers (DR0-DR3), and stealth software breakpoints.
ETW Suppression	EtwSpoof.cpp, EtwSpoof.h	Interception of EtwEventEnabled to selectively drop sensitive Event Tracing for Windows (ETW) events without corrupting provider statistics.
Hypervisor Memory	HvMemory.cpp, HvMemory.h	High-speed memory transport supporting R3-to-R0-to-VMM physical memory read and write operations via CPUID hypercalls.
HV Mapping Slots	HvMapSlot.cpp, HvMapSlot.h	Per-CPU 8-slot physical memory mapping cache for lock-free page table access across up to 32 logical processors.
Driver Entry	DrvMain.cpp	Driver entry point (DriverEntry), IOCTL dispatch logic, and multi-core hypervisor initialization.

---

Key Features

Process Protection

• Intercepts over 40 kernel system calls via NPT hardware memory redirection without altering kernel memory bytes (SSDT remains unpatched).
• Blocks handle opening and query operations for protected PIDs (NtOpenProcess, NtQueryInformationProcess, NtDuplicateObject).
• Hides window handles from win32k enumeration APIs (NtUserFindWindowEx, NtUserBuildHwndList, ValidateHwnd).
• Strips granted access rights assigned via kernel object callbacks (ObReferenceObjectByHandle).

Shadow Debugger

• Shadow Debug Port: Maintains an internal process debug list inside the hypervisor, ensuring EPROCESS.DebugPort remains NULL when inspected by anti-cheat tools.
• Custom Debug Objects: Allocates non-standard debug objects isolated from the Windows kernel object directory.
• Hardware Breakpoints: DR0-DR3 debug registers are set and queried strictly via CPUID hypercalls at Ring -1, remaining invisible to NtGetContextThread.
• Software Breakpoints: INT3 (0xCC) instructions are hidden by mapping read operations to an unpatched page (FakePage) while execution points to the breakpoint page (TrampolinePage).

Anti-Detection Mechanisms

• CPUID Spoofing: Clears ECX.HypervisorPresent (bit 31) on leaf 0x00000001 and returns zeros for vendor-specific VMM probe leaves (such as leaf 0x41414160).
• ETW Suppression: Intercepts EtwEventEnabled upstream of EtwWrite for Kernel-Memory, Kernel-Process, and Kernel-File providers. Events are dropped before creation, keeping the kernel EventsLost counter unaffected.
• Network Telemetry Interception: Intercepts NtDeviceIoControlFile to drop Ancillary Function Driver (AFD) send requests (IOCTL_AFD_SEND 0x1201F) from target PIDs, preventing real-time telemetry transmission to remote servers.

---

Intercepted Kernel Functions

System Calls (SSDT)

• NtQuerySystemInformation - Filters hidden processes and handles from system-wide lists.
• NtOpenProcess - Rejects handle creation for protected processes.
• NtQueryInformationProcess - Masks process debug ports and information structures.
• NtQueryVirtualMemory - Prevents probing of protected memory allocation regions.
• NtDuplicateObject - Blocks duplication of handles belonging to protected processes.
• NtGetNextProcess / NtGetNextThread - Excludes protected entries from enumeration routines.
• NtReadVirtualMemory - Returns zero-filled buffers instead of granting access or failing.
• NtWriteVirtualMemory - Blocks unauthorized cross-process memory modification.
• NtProtectVirtualMemory - Rejects page permission alterations on protected memory regions.
• NtTerminateProcess - Prevents termination signals targeted at protected processes.
• NtCreateThreadEx - Blocks remote thread injection attempts.
• NtSuspendThread / NtResumeThread - Blocks execution control commands on threads.
• NtGetContextThread / NtSetContextThread - Filters hardware breakpoint registers and register context modifications.

Kernel Exported APIs

• PsLookupProcessByProcessId / PsLookupThreadByThreadId
• ObReferenceObjectByHandle - Trims granted access permissions.
• MmCopyVirtualMemory - Intercepts cross-process memory copies.
• KeStackAttachProcess - Prevents thread target attachment.

Win32k System Calls (SSSDT)

• NtUserFindWindowEx
• NtUserWindowFromPoint
• NtUserBuildHwndList
• ValidateHwnd

Internal Kernel Routines (Pattern Scanned)

• PspInsertThread
• PspCallThreadNotifyRoutines
• KiInsertQueueApc
• ObfDereferenceObject
• ObReferenceObjectByHandleWithTag

---

CPUID Hypercall Interface

Ring 3 and Ring 0 components communicate directly with the Ring -1 hypervisor using the CPUID instruction with a magic key in EAX.

Leaf / Command	EAX Input	Description
CPUID_HV_MAGIC	0x41414150	Ping hypervisor status and verify active Ring -1 execution.
CPUID_HV_BATCH_READ	0x41414151	Execute high-speed scatter-gather physical memory page reads.
CPUID_HV_PROTECT_PID	0x41414152	Register target PID for process and handle isolation.
CPUID_HV_SET_HW_BP	0x41414153	Configure hardware debug register (DR0-DR3) at Ring -1.

---

System Requirements

• Processor: AMD CPU supporting AMD-V (SVM) and Nested Page Tables (NPT).
• Operating System: Windows 10 or Windows 11 x64 (Build 19041 or higher recommended).
• Development Toolchain: Visual Studio 2022 and Windows Driver Kit (WDK) 10.
• Execution Mode: Test signing mode enabled (bcdedit /set testsigning on) or a valid EV driver signing certificate.

---

Build and Deployment Instructions

1. Building the Kernel Driver

1. Open PowerVM_Core/SvmDebug.sln in Visual Studio 2022.
2. Select Release | x64 configuration.
3. Build the solution to produce SvmDebug.sys (PowerVM kernel driver).

2. Building the Controller

1. Open PowerVM_Launcher/CMakeLists.txt using Qt Creator or CMake with MSVC 2022 x64.
2. Configure the project using Qt 6.x.
3. Build to generate PowerVMLauncher.exe.

3. Launching PowerVM

1. Run PowerVMLauncher.exe with Administrator privileges.
2. Click Load PowerVM to register and start the kernel driver service.
3. Verify that the indicator displays SVM Active.
4. Select a process from the system process tree and click Protect Process to isolate it.
5. Click Launch & Protect Engine to attach the PowerVM debugging tool.
6. When finished, click Unload PowerVM to remove all NPT hooks and shut down the hypervisor safely.