Awesome Virtualization

A curated list of awesome resources about virtualization.

Chronology

• 2005-November-13: Intel VT-x released on Pentium 4 (Model 662 and 672) processors
• 2006-May-23: AMD AMD-V released on Orleans and Windsor processors
• 2007-September-10 : AMD Barcelona offer support for RVI (SLAT)
• 2008-November: Intel Nehalem offer support for EPT (SLAT)
• 2010-January-7: Intel Westmere offer support for unrestricted guests
• 2013-June-4: Intel haswell offer support for VMCS Shadowing

Books

• Intel® 64 and IA-32 architectures software developer's manual volume 3C
• Virtual Machines: Versatile Platforms for Systems and Processes
• Mastering KVM Virtualization

Courses

• Memory Virtualization playlist by Udacity
• Full Virtualization by Geoffrey Challen
• Xen and the Art of Virtualization by Geoffrey Challen
• Container Virtualization by Geoffrey Challen
• Open Security Training Advanced VT-x course
• From Kernel to VMM

Papers

• A comparison of software and hardware techniques for x86 virtualization by K. Adams and O. Agesen (2006)
• Bringing Virtualization to the x86 Architecture with the Original VMware Workstation by Edouard Bugnion, Scott Devine, Mendel Rosenblum, Jeremy Sugerman, And Edward Y. Wang
• The evolution of an x86 virtual machine monitor by O. Agesen, A. Garthwaite, J. Sheldon, and P. Subrahmanyam
• Formal Requirements for Virtualizable Third Generation Architectures by Gerald J. Popek & Robert P. Goldberg
• Modern Operating System 4th Edition (Chapter: Virtualization and the cloud) by Andrew Tanembaum
• Xen and the Art of Virtualization by Paul Barham, Boris Dragovic, Keir Fraser, Steven Hand, Tim Harris, Alex Ho, Rolf Neugebauer, Ian Pratt, Andrew Warfield
• Understanding Full Virtualization, Paravirtualization and Hardware Assisted Virtualization by VMWare
• Dynamic Binary Translation from x86-32 code to x86-64 code for Virtualization by Yu-hsin Chen.

Projects

• 2011:
  • ramooflax
  • TinyVM
• 2014: HOSS
• 2015: Bareflank
• 2016:
  • SimpleVisor
  • HyperPlatform
  • kHypervisor
• 2017: hypervisor-for-beginners
• 2018:
  • hvpp
  • ACRN
  • gbhv

KVM

• KVM website
• KVM forum
• set of KVM documentations
• How VT-x, KVM and QEMU Work Together

Xen

• Xen website

QEMU

• QEMU website

VirtualBox

• VirtualBox website
• VirtualBox documentation

Hyper-V

• Hyper-V technet

Hypervisor From Scratch

• Part 1: Basic Concepts & Configure Testing Environment
• Part 2: Entering VMX Operation
• Part 3: Setting up Our First Virtual Machine
• Part 4: Address Translation Using Extended Page Table (EPT)

Virtual Machine Introspection

• Zero-Footprint Guest Memory Introspection from Xen by Mihai Dontu - [Slides] [Update]
• Hypervisor memory introspection at the next level
• Bringing Commercial Grade Virtual Machine Introspection to KVM by Mihai Donțu - [Slides]
• Hypervisor-based, hardware-assisted system monitoring
• Virtual Machine Introspection to Detect and Protect
• Hypervisor Memory Forensics - [Slides]
• Who Watches The Watcher? Detecting Hypervisor Introspection from Unprivileged Guests

Attacking Hypervisors

• Blackhat 2010 - Hacking the Hypervisor
• Unboxing your virtualBox - [Slides]
• Software Attacks on Hypervisor Emulation of Hardware - [Slides]
• Lessons Learned from Eight Years of Breaking Hypervisors - [Slides]
• Virtualization under attack: Breaking out of KVM - [Slides]
• Attacking Hypervisors Using Firmware And Hardware - [Slides]
• Performant Security Hardening of KVM by Steve Rutherford - [Slides]
• The Arms Race Over Virtualization - [Slides]
• Ouroboros: Tearing Xen Hypervisor With the Snake
• Subverting the Xen hypervisor
• Preventing and Detecting Xen Hypervisor Subversions
• Bluepilling the Xen Hypervisor
• Cloudburst: Hacking 3D And Breaking Out Of Vmware
• Breaking Out of VirtualBox through 3D Acceleration - [Slides]
• Ring 0 to Ring -1 Exploitation with Hyper-V IPC
• XenPwn: Breaking paravirtualized devices - [Slide]
• The Great Escapes Of Vmware: A Retrospective Case Study Of VMWare Guest-To-Host Escape Vulnerabilities
• Out of the Truman Show: VM Escape in VMware Gracefully
• Advanced Exploitation: Xen Hypervisor VM Escape
• Xen exploitation part 1: XSA-105, from nobody to root
• Xen exploitation part 2: XSA-148, from guest to host
• Control Register Access Exiting and Crashing VMware
• VirtualBox VMSVGA VM Escape
• VirtualBox NAT DHCP/BOOTP server vulnerabilities

CVEs

• Wandering through the Shady Corners of VMware Workstation/Fusion
• CVE-2018-2844: From Compiler Optimization to Code Execution - VirtualBox VM Escape
• CVE-2017-3558: Oracle VM VirtualBox - Guest-to-Host Privilege Escalation via Broken Length Handling in slirp Copy
• Better slow than sorry - VirtualBox 3D acceleration considered harmful
• Analyzing a Patch of a Virtual Machine Escape on VMware
• VirtualBox 3D Acceleration: An Acceleration Attack Surface
• A bunch of Red Pills: VMware Escapes
• SSD Advisory – Oracle VirtualBox Multiple Guest to Host Escape Vulnerabilities
• Pandavirtualization: Exploiting the Xen hypervisor

Malware analysis

• DEFCON 17: Reverse Engineering By Crayon: Hypervisor Based Malware Analysis and Visualization
• Hypervisors In Ur Toolbox: Monitoring N Controlling System Events With HyperPlatform
• How to hide a hook: A hypervisor for rootkits