$ cat README

i write hypervisors,
break anti-cheats,
and flash custom firmware.

amd svm // smm ring -2 // npt memory manipulation
hardware dma // everything below the kernel

012026-02-05//14 min
Building an AMD SVM Blue-Pill Hypervisor from Scratch
from zero to 16-core virtualization in rust. vmcb setup, npt, msr intercepts, 150-cycle tsc offset.
hypervisoramd-svmrust
022026-02-06//11 min
SmmInfect: Launching a Hypervisor from Ring -2
custom smm module flashed into motherboard firmware. code execution before secure boot, before everything.
smmfirmwarering-2
032026-02-07//12 min
Faking VBS: Spoofing Core Isolation from L0
npt shadow pages on ci.dll, cpuid leaf spoofing, registry manipulation. the kernel thinks hyper-v is running.
vbsstealthnpt
042026-02-09//15 min
VMCB Swap: Running a Guest VM Inside a Blue-Pill
ovmf booting on dedicated cores. the swap storm, gif=0 safety, atomic sipi delivery.
vmcbguest-vmstage-9
052026-02-10//16 min
25 Detection Vectors and How I Beat Them
tsc compensation, cpuid masking, msr filtering, apic id spoofing. full anti-detection suite.
stealthanti-detectiontiming
062026-02-11//10 min
NPT Shadow Pages: Serving Fake Memory to the Kernel
remapping guest physical addresses. a 4kb page split turns g_CiOptions into whatever i want.
nptmemorystealth
072026-02-13//14 min
Booting Windows Under a Custom Hypervisor
the 0xC0000225 saga. gdt patching, mtrr shadows, deferred disk i/o, 40gb through a virtual nvme.
windowsbootdebugging
082026-02-14//7 min
The Page You Cannot Shadow: KUSER_SHARED_DATA
static npt shadow on a page the kernel writes every tick. instant MEMORY_MANAGEMENT bsod.
nptbsoddebugging
092026-02-15//9 min
GPU VRAM Overlay: Hiding in Video Memory
tiling formulas, swizzle patterns, hypervisor data invisible in gpu-addressable vram.
gpuvramstealth
102026-02-17//11 min
From SMM to DMA: Alternative Paths to Arbitrary R/W
pcie bus mastering, envme on nanopc-t6, flashable i210 nics, iommu bypass from smm.
dmapciehardware
112026-02-18//13 min
NPT Deep Dive: Identity Mapping, Page Splitting, and the Hidden Page Table
4-level page tables, 2mb large pages, split_2mb_to_4kb(), find_pde(), the pages[] array.
nptmemoryamd-svm
122026-02-19//10 min
CPUID Masking: Becoming Microsoft Hyper-V
every leaf from 0x40000000 to 0x40000006. "microsoft hv" vendor string, feature flags, fake vbs.
cpuidstealthhyper-v
132026-02-21//12 min
MSR Filtering: The Hypercall Page and Synthetic Timers
msrpm bitmap, hypercall vmmcall;ret stub, synthetic timers, synic, reference tsc page.
msrhyper-vstealth
142026-02-22//6 min
LBRV: Hardware LBR Auto-Swap on VMRUN
one flag in the vmcb, zero code, entire lbr detection surface eliminated.
lbrvstealthamd-svm
152026-02-23//8 min
PM Timer Emulation: The Other Timing Side-Channel
acpi pm timer at port 0x408, cross-reference detection, iopm intercept, aperf/mperf.
timingstealthmmio
162026-02-24//7 min
HPET Emulation: Memory-Mapped Timing at 0xFED00000
npt page fault on hpet mmio, compensated counter, three clocks in agreement.
hpettimingmmio
172026-02-25//7 min
TPM Emulation: Faking the Trusted Platform Module
pcr measurements, tpm mmio intercept, anti-cheats that check hardware attestation.
tpmstealthmmio
182026-02-27//9 min
The MMIO Emulation Framework
npt unmap, #npf dispatch, instruction decode. one framework for tpm, hpet, apic, and everything else.
mmiostealthnpt
192026-02-28//6 min
Virtual APIC ID Spoofing
guest cores 14/15 see apic id 0/1. acpi tables match, mp table matches, os boots multicore.
apicstealthguest-vm
202026-03-01//8 min
Atomic SIPI Delivery: Waking Up Application Processors
bsp sets atomicbool flags, ap checks in hlt handler. kvm-style sipi without touching another core's vmcb.
sipiguest-vmmulticore
212026-03-02//8 min
GIF=0: Running Exit Handlers with Interrupts Masked
no interrupts, no nmis, no smis. what you can and can't do at gif=0. the simpleSvm pattern.
gifsafetyamd-svm
222026-03-03//5 min
The Registry Write That Would Have Turned On Real Hyper-V
volatile vs persistent keys. one wrong write and next reboot launches real hyper-v.
vbsdebuggingclose-call
232026-03-05//6 min
KERNEL_SECURITY_CHECK_FAILURE: Proof the Kernel Saw My Fake Bits
bsod 0x139 on devirt. the kernel enforced my fake g_CiOptions values. spoofing worked too well.
bsodvbsdebugging
242026-03-06//7 min
WMI vs NtQuerySystemInformation: Which Check Surface Actually Matters
five ways windows reports vbs status. they don't agree. which ones i can fake, which ones i can't.
vbsdetectionwindows
252026-03-07//12 min
0xC0000225: The Windows Boot Error That Took Two Weeks
bootmgfw loaded, winload loaded, progress bar 100%, then STATUS_NOT_FOUND. six bugs, two weeks of serial.
windowsbootdebugging
262026-03-08//7 min
GDT Patching: Fixing #GP in the Boot Path
winload expects specific gdt layout. uefi gdt had code segments where data was needed. #gp on mov ss.
gdtbootdebugging
272026-03-09//8 min
MTRR Shadow: Memory Type Emulation
shadow mtrr msrs so the guest sees cache attributes matching its own memory layout, not the host's.
mtrrbootstealth
282026-03-11//10 min
Deferred Disk I/O: Serving 40GB Through a Virtual NVMe
4gb in ram, rest via worker thread + zwreadfile. write bounds bug corrupted kernel pool.
diskioboot
292026-03-12//6 min
The 500 Million Exit Limit
safety limit calibrated against ovmf. windows boot generates 800M exits. my own code killed the guest.
debuggingperformancehypervisor
302026-03-13//8 min
SMM Timer Callback: Why 50 Ticks Was Too Late
periodic smi fires every 64ms. 50 ticks = 3.2s. hvlphase0initialize already ran at 2.6s. missed the window.
smmtimingfirmware
312026-03-14//7 min
VirtualizeCore(): Hardcoded for Windows, Broken for UEFI
cr4, efer, segment registers all hardcoded from a running kernel. timer fires during uefi, crash.
smmuefidebugging
322026-03-15//9 min
Parasitic Hyper-V Hook: The GetVariable Injection
hook efi getvariable from smm. when hvax64.exe reads a variable, i identify the caller and inject code.
smmhyper-vfirmware
332026-03-16//6 min
PSB Unfused: Why Consumer Boards Accept Any Firmware
amd platform secure boot is a hardware fuse. consumer boards never fuse it. q-flash accepts anything.
firmwaresecurityhardware
342026-03-17//6 min
Core Isolation Toggle Leaves Hyper-V Active in BCD
turned off core isolation in ui. hyper-v still in bcd. hvci still blocking my test-signed driver.
hyper-vdebuggingdrivers
352026-03-18//5 min
V_INTR_MASKING: The Bit That Prevents CLOCK_WATCHDOG_TIMEOUT
must set bit 24 of vmcb v_intr for guest vms. without it, clock watchdog timeout on every boot.
vmcbbsoddebugging
362026-03-19//7 min
GuestRegs vs GuestGprs: The Layout Bug That Froze Everything
blue-pill asm saves r15..rcx. stage 8 asm saves rcx..r15. casting between them corrupts every register.
vmcbdebuggingasm
372026-03-20//8 min
The Swap Storm: VMEXIT_INTR Infinite Loop
guest yields on vmexit_intr, host re-arms guest immediately. infinite swap loop. 50-exit countdown fix.
vmcbguest-vmdebugging
382026-03-21//5 min
TLB_CONTROL: The Field Hardware Reads Fresh Every Time
tlb_control is never cached by hardware. don't overwrite handler-set flush values.
vmcbstealthamd-svm
392026-03-22//7 min
Zen 3 to Zen 5: What Changes, What Doesn't
testing on epyc zen 5. svm behavior differences, new msrs, what breaks when you change microarchitecture.
amdhardwarecompatibility
402026-03-23//6 min
Features I Stripped for Stability
everything i removed during stability testing. sometimes less code is the fix.
stabilitydebuggingdesign
412026-03-24//11 min
kov-lang: Building a Programming Language That Compiles to RISC-V
wrote a compiler from scratch. lexer, parser, codegen targeting rv64gc. runs on bare metal.
kovrisc-vcompiler
422026-03-25//5 min
This Blog: Generated by a Static Site Generator Written in My Own Language
the blog itself is compiled from kov-lang source. custom ssg, dot grid, viz panels, dark monochrome.
kovmetaweb