Ring -1 Injection
HypervisorInject shellcode and DLLs via hypervisor physical memory access, bypassing Ring 0 protections.
Bypasses Ring 0 Protections
Ring -1 injection writes directly to physical memory via EPT, making it invisible to Ring 0 monitoring tools.
Methods
HV Shellcode Injection
Allocate RWX memory from Ring 0, write shellcode via hypervisor physical memory access.
- Open target process, allocate RWX memory via
ZwAllocateVirtualMemory - Touch memory via
RtlZeroMemorywhile attached — creates physical backing - Detach from process context
- VMCALL to hypervisor: EPT translate virtual → physical, write shellcode
- Create thread via
RtlCreateUserThreadat shellcode address
HV DLL Injection
Same physical memory approach for LoadLibraryW-based DLL injection.
- Allocate memory for DLL path, touch to page in
- VMCALL to write DLL path via physical memory
- Resolve
LoadLibraryWviaGetLoadLibraryWAddress() - Create thread with
RtlCreateUserThread(LoadLibraryW, path_addr)
Key Advantages
- • Physical memory writes — Bypasses Ring 0 memory protections
- • Invisible to Ring 0 — Monitoring tools can't see the writes
- • EPT translation — Direct virtual → physical address conversion
- • No usermode API calls — Bypasses all usermode hooks
Memory Paging Requirement
Important
Memory must be "paged in" before the hypervisor can write. Allocated virtual memory has no physical backing until accessed. The driver touches memory with
RtlZeroMemorywhile attached to the process context to force page-in.Usage
Access via two methods:
From Process Context Menu
Right-click process → Miscellaneous → HV Inject Shellcode (Ring -1) orHV Inject DLL (Ring -1)
From Hypervisor Tab
Hypervisor tab → Injection section → Select process, browse for shellcode/DLL
Return Values
HvInjectResult (Shellcode)
- •
bytes_written— Bytes written via VMCALL - •
thread_handle— Handle to created thread - •
shellcode_address— Where shellcode was written - •
success— Operation result
HvInjectDllResult (DLL)
- •
module_base— Base address of loaded DLL - •
path_address— Where DLL path was written - •
success— Operation result
IOCTLs
| IOCTL | Code |
|---|---|
| HV_INJECT_SHELLCODE | 0x840 |
| HV_INJECT_DLL | 0x841 |