Asia-24-VictorV-Unveiling-the-Cracks-in-Virtualization-Mastering-the-Host-System

Unveiling the Cracks in Virtualization, Mastering the Host SystemVMware Workstation EscapeSpeaker: VictorV#BHASIA @BlackHatEventsVMware Workstation Escape TianfuCup2018/2021/2023Zer0Con 2022HITB 2020Hyper-V EscapeCVE-2019-0887In 2021Bugs in SQLServer, RDP, QEMU, DNS, DHCP, Samba, ESXi…Top 3 of MSRC 2023 Q3/Q4 LeaderboardAbout Me : VictorV(@vv474172261) #BHASIA @BlackHatEvents目录CONTENTSVirtualization Basic InfoHistoric Bugs In UHCIExploit for TianfuCup2023Summary#BHASIA @BlackHatEventsVirtualization Basic InfoPART ONE#BHASIA @BlackHatEventsVirtualization Basic InfoVMware WorksationArchitecture#BHASIA @BlackHatEventsVirtualization Basic InfoVirtual Process Address and Guest Physical AddressGuest Virtual Address(GVA)Guest Physical Address(GPA)Host process Virtual Address(HVA)In Guest, use GVA access its physical memoryIn Host vmx, use HVA of GPA access Guest memory#BHASIA @BlackHatEventsVirtualization Basic InfoVirtual Device and Guest Driver InteractionVMX processGuest SystemIO PortInsb