JTAG debug of Windows Hyper-V / Secure Kernel with WinDbg and DCI/EXDI

No ratings

Presented at REcon 2024 by

Alan Sguigna

Ivan Rouzanov

For the first time, JTAG debugging tools for x64 are available to the general public. Using EXDI to connect WinDbg with the SourcePoint debugger, and Intel Direct Connect Interface (DCI) on the AAEON UP Xtreme i11, Windows Hyper-V and Secure Kernel can be debugged as never before. This presentation and demonstration will cover run-control, VMM breakpoints, Intel Processor Trace, Architectural Event Trace and other new technologies on an off-the-shelf HV/SK/VBS enabled target.