NoirVisor

NoirVisor - The Grimoire Hypervisor solution for AMD64 Processors.

Tips: if the link for QQ Group does not work, try to hover the icon over the shield icon and see text.

Introduction

NoirVisor is a Type-1 bluepill hypervisor that aims to provide custom virtualization and secure computing services.

IMPORTANT NOTES: If you're looking for a stealthy hypervisor implementation, you're at the wrong place.

C Version

This project was written in C once upon a time. It is archived as the c-archive branch.
This branch will no longer receive updates and no patches will be accepted for it.

Processor Requirement

Your CPU must support either Intel VT-x /w EPT or AMD-V /w NPT. However, this does not mean only Intel and AMD CPUs are supported.

• Processors produced by Intel, VIA, Zhaoxin (兆芯) and Montage (澜起) may support Intel VT-x.
• Processors produced by AMD and Hygon (海光) may support AMD-V.

Build

See documentation for more information about preparation and using python script to build NoirVisor.

Run

To run NoirVisor, you will have to boot NoirVisor's hypervisor before an OS loads

Windows Driver

If you the NoirVisor service is not installed:

sc create NoirVisor type= kernel binPath= <Path to NoirVisor driver file>

Once NoirVisor service is installed, start the driver:

sc start NoirVisor

You may unload NoirVisor by using command-line:

sc stop NoirVisor

If you need to uninstall NoirVisor service:

sc delete NoirVisor

EFI Application and Runtime Driver

There are several methods to run NoirVisor.

Running on a physical machine

This method can also be used on VMware.
Use a USB flash stick and setup with GUID Partition Table (GPT). Construct a partition and format it info FAT32 file system. After you successfully build the image, you should see two images: bootx64.efi and NoirVisor.efi
Those two files are EFI Application and Runtime Driver respectively.
Copy EFI Application to \EFI\BOOT\bootx64.efi
Copy EFI Runtime Driver to \NoirVisor.efi
As the USB flash stick is ready, enter your firmware settings and set it prior to the operating system. Disable Secure Boot feature unless you can sign the executable.

Running on a virtual machine

After you built NoirVisor, several virtual disk image options are available: raw, vhdx and vmdk. Add the image to your virtual machine as a hard drive.
Also see Quick Start on Emulators.

Documents

This repository provides additional documents which help new developers to join development.

Customizable VM

Customizable VM is a feature that provides a set of APIs to run an arbitrary guest, instead of to just subvert the host system. In a word, it is aimed to be a competitor of the Windows Hypervisor Platform (WHP).

Security Advisories

You should not report security vulnerabilities through the GitHub issue. You should read this document to check out the steps to report security vulnerability.

Publications

Here lists some informal publications (blogs) regarding hypervisor development:

• Extending the Tradition Hypervisor's Approach of System Call Hooking in the Post-2018 Windows Operating Systems: https://tangptr.com/?p=149
• MTRR Emulation: Beginner’s Common Mistake in EPT Setup: https://tangptr.com/?p=163
• Introduction to NoirVisor CVM: The Open-Source Alternative of the Windows Hypervisor Platform: https://tangptr.com/?p=173

License

This repository is dual licensed with MIT and Apache-2.0, just like rust.