Diskjacker

August 13, 2025 ยท View on GitHub

A proof of concept project which hijacks Hyper-Vs VM Exit handler at runtime using DDMA.

Video

https://github.com/user-attachments/assets/5e02db13-113d-44e1-90cb-c199b70d3d06

How it works

Read at readcc.net, archived at archive.org.

Requirements

  1. AMD CPU with Virtualization Capabilities (Intel support in theory possible)
  2. Windows 11 24H2 (requires offset update in GetVmcb function in hyperv.hpp otherwise)
  3. IOMMU Disabled
  4. Hyper-V Enabled

Usage

  1. Compile the project using Visual Studio 2022 and WDK.
  2. Use a tool like HXD or bintoc to copy the bytes of payload.sys to payloadData inside of payloadBytes.h
  3. Run loader passing kernel driver as parameter
  4. Run usermode
  5. Profit!

Resources