HyperVinject - Making Virtual Machine Code Injections as Simple as Process Injections

Learn advanced virtual machine security techniques through a conference talk that introduces HyperVinject, the first tool capable of injecting code inside a running Hyper-V VM from the Root Partition with the same simplicity as process injections. Discover the step-by-step methodology for gaining control of virtual machines by injecting code into the Virtual Machine Worker Process (vmwp.exe) running in the Root Partition, deploying shellcode within the guest operating system kernel, intercepting execution flows, and finalizing injections by deploying shellcode inside user-mode processes within the VM. Explore multiple additional methods for code injection in running Hyper-V VMs, with practical demonstrations including calc.exe spawning shellcode deployment. Access the accompanying GitHub proof-of-concept repository to examine the technical implementation details and experiment with the disclosed techniques in controlled environments.