visualstudioblyat https://visualstudioblyat.dev amd svm hypervisors, smm exploitation, custom firmware. everything below the kernel. en-us Building an AMD SVM Blue-Pill Hypervisor from Scratch https://visualstudioblyat.dev/01-blue-pill.html https://visualstudioblyat.dev/01-blue-pill.html Thu, 05 Feb 2026 00:00:00 GMT from zero to 16-core virtualization in rust. vmcb setup, npt, msr intercepts, 150-cycle tsc offset. SmmInfect: Launching a Hypervisor from Ring -2 https://visualstudioblyat.dev/02-smminfect.html https://visualstudioblyat.dev/02-smminfect.html Fri, 06 Feb 2026 00:00:00 GMT custom smm module flashed into motherboard firmware. code execution before secure boot, before everything. Faking VBS: Spoofing Core Isolation from L0 https://visualstudioblyat.dev/03-vbs-spoof.html https://visualstudioblyat.dev/03-vbs-spoof.html Sat, 07 Feb 2026 00:00:00 GMT npt shadow pages on ci.dll, cpuid leaf spoofing, registry manipulation. the kernel thinks hyper-v is running. VMCB Swap: Running a Guest VM Inside a Blue-Pill https://visualstudioblyat.dev/04-vmcb-swap.html https://visualstudioblyat.dev/04-vmcb-swap.html Mon, 09 Feb 2026 00:00:00 GMT ovmf booting on dedicated cores. the swap storm, gif=0 safety, atomic sipi delivery. 25 Detection Vectors and How I Beat Them https://visualstudioblyat.dev/05-detection.html https://visualstudioblyat.dev/05-detection.html Tue, 10 Feb 2026 00:00:00 GMT tsc compensation, cpuid masking, msr filtering, apic id spoofing. full anti-detection suite. NPT Shadow Pages: Serving Fake Memory to the Kernel https://visualstudioblyat.dev/06-npt-shadow.html https://visualstudioblyat.dev/06-npt-shadow.html Wed, 11 Feb 2026 00:00:00 GMT remapping guest physical addresses. a 4kb page split turns g_CiOptions into whatever i want. Booting Windows Under a Custom Hypervisor https://visualstudioblyat.dev/07-windows-boot.html https://visualstudioblyat.dev/07-windows-boot.html Fri, 13 Feb 2026 00:00:00 GMT the 0xC0000225 saga. gdt patching, mtrr shadows, deferred disk i/o, 40gb through a virtual nvme. The Page You Cannot Shadow: KUSER_SHARED_DATA https://visualstudioblyat.dev/08-kusd.html https://visualstudioblyat.dev/08-kusd.html Sat, 14 Feb 2026 00:00:00 GMT static npt shadow on a page the kernel writes every tick. instant MEMORY_MANAGEMENT bsod. GPU VRAM Overlay: Hiding in Video Memory https://visualstudioblyat.dev/09-gpu-vram.html https://visualstudioblyat.dev/09-gpu-vram.html Sun, 15 Feb 2026 00:00:00 GMT tiling formulas, swizzle patterns, hypervisor data invisible in gpu-addressable vram. From SMM to DMA: Alternative Paths to Arbitrary R/W https://visualstudioblyat.dev/10-dma.html https://visualstudioblyat.dev/10-dma.html Tue, 17 Feb 2026 00:00:00 GMT pcie bus mastering, envme on nanopc-t6, flashable i210 nics, iommu bypass from smm. NPT Deep Dive: Identity Mapping, Page Splitting, and the Hidden Page Table https://visualstudioblyat.dev/11-npt-deepdive.html https://visualstudioblyat.dev/11-npt-deepdive.html Wed, 18 Feb 2026 00:00:00 GMT 4-level page tables, 2mb large pages, split_2mb_to_4kb(), find_pde(), the pages[] array. CPUID Masking: Becoming Microsoft Hyper-V https://visualstudioblyat.dev/12-cpuid-masking.html https://visualstudioblyat.dev/12-cpuid-masking.html Thu, 19 Feb 2026 00:00:00 GMT every leaf from 0x40000000 to 0x40000006. "microsoft hv" vendor string, feature flags, fake vbs. MSR Filtering: The Hypercall Page and Synthetic Timers https://visualstudioblyat.dev/13-msr-filter.html https://visualstudioblyat.dev/13-msr-filter.html Sat, 21 Feb 2026 00:00:00 GMT msrpm bitmap, hypercall vmmcall;ret stub, synthetic timers, synic, reference tsc page. LBRV: Hardware LBR Auto-Swap on VMRUN https://visualstudioblyat.dev/14-lbrv.html https://visualstudioblyat.dev/14-lbrv.html Sun, 22 Feb 2026 00:00:00 GMT one flag in the vmcb, zero code, entire lbr detection surface eliminated. PM Timer Emulation: The Other Timing Side-Channel https://visualstudioblyat.dev/15-pmtimer.html https://visualstudioblyat.dev/15-pmtimer.html Mon, 23 Feb 2026 00:00:00 GMT acpi pm timer at port 0x408, cross-reference detection, iopm intercept, aperf/mperf. HPET Emulation: Memory-Mapped Timing at 0xFED00000 https://visualstudioblyat.dev/16-hpet.html https://visualstudioblyat.dev/16-hpet.html Tue, 24 Feb 2026 00:00:00 GMT npt page fault on hpet mmio, compensated counter, three clocks in agreement. TPM Emulation: Faking the Trusted Platform Module https://visualstudioblyat.dev/17-tpm.html https://visualstudioblyat.dev/17-tpm.html Wed, 25 Feb 2026 00:00:00 GMT pcr measurements, tpm mmio intercept, anti-cheats that check hardware attestation. The MMIO Emulation Framework https://visualstudioblyat.dev/18-mmio-framework.html https://visualstudioblyat.dev/18-mmio-framework.html Fri, 27 Feb 2026 00:00:00 GMT npt unmap, #npf dispatch, instruction decode. one framework for tpm, hpet, apic, and everything else. Virtual APIC ID Spoofing https://visualstudioblyat.dev/19-apic-spoof.html https://visualstudioblyat.dev/19-apic-spoof.html Sat, 28 Feb 2026 00:00:00 GMT guest cores 14/15 see apic id 0/1. acpi tables match, mp table matches, os boots multicore. Atomic SIPI Delivery: Waking Up Application Processors https://visualstudioblyat.dev/20-sipi.html https://visualstudioblyat.dev/20-sipi.html Sun, 01 Mar 2026 00:00:00 GMT bsp sets atomicbool flags, ap checks in hlt handler. kvm-style sipi without touching another core's vmcb. GIF=0: Running Exit Handlers with Interrupts Masked https://visualstudioblyat.dev/21-gif0-safety.html https://visualstudioblyat.dev/21-gif0-safety.html Mon, 02 Mar 2026 00:00:00 GMT no interrupts, no nmis, no smis. what you can and can't do at gif=0. the simpleSvm pattern. The Registry Write That Would Have Turned On Real Hyper-V https://visualstudioblyat.dev/22-dangerous-registry.html https://visualstudioblyat.dev/22-dangerous-registry.html Tue, 03 Mar 2026 00:00:00 GMT volatile vs persistent keys. one wrong write and next reboot launches real hyper-v. KERNEL_SECURITY_CHECK_FAILURE: Proof the Kernel Saw My Fake Bits https://visualstudioblyat.dev/23-kernel-security-check.html https://visualstudioblyat.dev/23-kernel-security-check.html Thu, 05 Mar 2026 00:00:00 GMT bsod 0x139 on devirt. the kernel enforced my fake g_CiOptions values. spoofing worked too well. WMI vs NtQuerySystemInformation: Which Check Surface Actually Matters https://visualstudioblyat.dev/24-wmi-vs-ntquery.html https://visualstudioblyat.dev/24-wmi-vs-ntquery.html Fri, 06 Mar 2026 00:00:00 GMT five ways windows reports vbs status. they don't agree. which ones i can fake, which ones i can't. 0xC0000225: The Windows Boot Error That Took Two Weeks https://visualstudioblyat.dev/25-0xc0000225.html https://visualstudioblyat.dev/25-0xc0000225.html Sat, 07 Mar 2026 00:00:00 GMT bootmgfw loaded, winload loaded, progress bar 100%, then STATUS_NOT_FOUND. six bugs, two weeks of serial. GDT Patching: Fixing #GP in the Boot Path https://visualstudioblyat.dev/26-gdt-patching.html https://visualstudioblyat.dev/26-gdt-patching.html Sun, 08 Mar 2026 00:00:00 GMT winload expects specific gdt layout. uefi gdt had code segments where data was needed. #gp on mov ss. MTRR Shadow: Memory Type Emulation https://visualstudioblyat.dev/27-mtrr-shadow.html https://visualstudioblyat.dev/27-mtrr-shadow.html Mon, 09 Mar 2026 00:00:00 GMT shadow mtrr msrs so the guest sees cache attributes matching its own memory layout, not the host's. Deferred Disk I/O: Serving 40GB Through a Virtual NVMe https://visualstudioblyat.dev/28-deferred-io.html https://visualstudioblyat.dev/28-deferred-io.html Wed, 11 Mar 2026 00:00:00 GMT 4gb in ram, rest via worker thread + zwreadfile. write bounds bug corrupted kernel pool. The 500 Million Exit Limit https://visualstudioblyat.dev/29-500m-exits.html https://visualstudioblyat.dev/29-500m-exits.html Thu, 12 Mar 2026 00:00:00 GMT safety limit calibrated against ovmf. windows boot generates 800M exits. my own code killed the guest. SMM Timer Callback: Why 50 Ticks Was Too Late https://visualstudioblyat.dev/30-smm-timing.html https://visualstudioblyat.dev/30-smm-timing.html Fri, 13 Mar 2026 00:00:00 GMT periodic smi fires every 64ms. 50 ticks = 3.2s. hvlphase0initialize already ran at 2.6s. missed the window. VirtualizeCore(): Hardcoded for Windows, Broken for UEFI https://visualstudioblyat.dev/31-virtualize-core.html https://visualstudioblyat.dev/31-virtualize-core.html Sat, 14 Mar 2026 00:00:00 GMT cr4, efer, segment registers all hardcoded from a running kernel. timer fires during uefi, crash. Parasitic Hyper-V Hook: The GetVariable Injection https://visualstudioblyat.dev/32-parasitic-hv.html https://visualstudioblyat.dev/32-parasitic-hv.html Sun, 15 Mar 2026 00:00:00 GMT hook efi getvariable from smm. when hvax64.exe reads a variable, i identify the caller and inject code. PSB Unfused: Why Consumer Boards Accept Any Firmware https://visualstudioblyat.dev/33-psb-unfused.html https://visualstudioblyat.dev/33-psb-unfused.html Mon, 16 Mar 2026 00:00:00 GMT amd platform secure boot is a hardware fuse. consumer boards never fuse it. q-flash accepts anything. Core Isolation Toggle Leaves Hyper-V Active in BCD https://visualstudioblyat.dev/34-core-isolation-bcd.html https://visualstudioblyat.dev/34-core-isolation-bcd.html Tue, 17 Mar 2026 00:00:00 GMT turned off core isolation in ui. hyper-v still in bcd. hvci still blocking my test-signed driver. V_INTR_MASKING: The Bit That Prevents CLOCK_WATCHDOG_TIMEOUT https://visualstudioblyat.dev/35-vintr-masking.html https://visualstudioblyat.dev/35-vintr-masking.html Wed, 18 Mar 2026 00:00:00 GMT must set bit 24 of vmcb v_intr for guest vms. without it, clock watchdog timeout on every boot. GuestRegs vs GuestGprs: The Layout Bug That Froze Everything https://visualstudioblyat.dev/36-guestregs-vs-gprs.html https://visualstudioblyat.dev/36-guestregs-vs-gprs.html Thu, 19 Mar 2026 00:00:00 GMT blue-pill asm saves r15..rcx. stage 8 asm saves rcx..r15. casting between them corrupts every register. The Swap Storm: VMEXIT_INTR Infinite Loop https://visualstudioblyat.dev/37-swap-storm.html https://visualstudioblyat.dev/37-swap-storm.html Fri, 20 Mar 2026 00:00:00 GMT guest yields on vmexit_intr, host re-arms guest immediately. infinite swap loop. 50-exit countdown fix. TLB_CONTROL: The Field Hardware Reads Fresh Every Time https://visualstudioblyat.dev/38-tlb-control.html https://visualstudioblyat.dev/38-tlb-control.html Sat, 21 Mar 2026 00:00:00 GMT tlb_control is never cached by hardware. don't overwrite handler-set flush values. Zen 3 to Zen 5: What Changes, What Doesn't https://visualstudioblyat.dev/39-zen3-to-zen5.html https://visualstudioblyat.dev/39-zen3-to-zen5.html Sun, 22 Mar 2026 00:00:00 GMT testing on epyc zen 5. svm behavior differences, new msrs, what breaks when you change microarchitecture. Features I Stripped for Stability https://visualstudioblyat.dev/40-stripped-features.html https://visualstudioblyat.dev/40-stripped-features.html Mon, 23 Mar 2026 00:00:00 GMT everything i removed during stability testing. sometimes less code is the fix. kov-lang: Building a Programming Language That Compiles to RISC-V https://visualstudioblyat.dev/41-kov-lang.html https://visualstudioblyat.dev/41-kov-lang.html Tue, 24 Mar 2026 00:00:00 GMT wrote a compiler from scratch. lexer, parser, codegen targeting rv64gc. runs on bare metal. This Blog: Generated by a Static Site Generator Written in My Own Language https://visualstudioblyat.dev/42-this-blog.html https://visualstudioblyat.dev/42-this-blog.html Wed, 25 Mar 2026 00:00:00 GMT the blog itself is compiled from kov-lang source. custom ssg, dot grid, viz panels, dark monochrome.