{"repo":"Hanohov/IUM-Debugger","free":true,"listed":false,"github":"https://github.com/Hanohov/IUM-Debugger","clone":"git clone https://github.com/Hanohov/IUM-Debugger.git","description":"Patching the Secure Kernel to enable debugging of VTL 1 Isolated User Mode","language":"C#","stars":74,"topics":["debugging","hyper-v","virtualization-based-security","windows-kernel","isolated-user-mode"],"license":null,"category":"dev-tools","readme_excerpt":"The IUM Debugger The IUM Debugger is a Windows utility, run on the Hyper-V host, that persuades a guest's Secure Kernel to permit debugging of its own trustlets. Background Virtualization-Based Security splits Windows across two Virtual Trust Levels on the same hypervisor: - VTL 0 — the NT kernel and every normal user-mode process. - VTL 1 — the Secure Kernel ( securekernel.exe ) and the Isolated User Mode trustlets ( LsaIso.exe , vmsp.exe , NgcIso.exe , etc.). VTL 0 cannot read or write VTL 1 memory, even with kernel privilege. The Secure Kernel decides, per process, whether debugging is allowed. On a default consumer system it always says no, so every attempt to attach a debugger to a trustlet is rejected. The check is enforced from code inside securekernel.exe . The file on disk is signed — patching it there fails signature verification at boot and the guest bluescreens. The only viable target is the live Secure Kernel image as it sits in the running guest's physical memory. How it works A Hyper-V parent partition can read and write the physical memory of any guest it hosts, including pages assigned to VTL 1. LiveCloudKd ships these primitives behind a signed driver ( hvmm.sys ). The IUM Debugger runs on the host and uses hvmm.sys to: 1. Locate the Secure Kernel code that enforces the debug check in inside the running guest. 2. Overwrite that check in the guest's live physical memory so it always allows debugging. Installation 1. Use the LiveCloudKd build bundled in this r","default_branch":null,"files":null,"tree":[],"storefront":"/r/Hanohov","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/Hanohov/IUM-Debugger/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}