AMD VMCB Deep Dive: Internal Layout of the Virtual Machine Control Block
The VMCB is the sole virtualization state container of AMD SVM. It comprises a control area (0x000-0x3FF), a save area (0x400-0xFFF) and intercept bitmaps inside the control area — knowing this layout is essential for writing an SVM hypervisor.
Core Concepts
Intercept Bitmaps
The control area embeds three bitmaps (CR read/write, DR read/write, exceptions); a set bit intercepts the corresponding event.
Event Injection Fields
At control offset 0x60 you can write an injected-event encoding (type, vector, error code) to deliver interrupts/exceptions to the guest.
Save Area
Starting at 0x400, the save area holds guest GPRs, segment registers, CR0–CR17, EFER, RIP/RSP and more.
EXITCODE & EXITINFO
VMCB offset 0x08 records the last #VMEXIT reason and 0x10 holds qualifying info (e.g., the faulting RIP).
NP Control Fields
From control offset 0x40, NPT control fields: nCR3, gCR3, TLB control, etc.
VMCB Reuse
After #VMEXIT the VMCB holds the guest's latest state; the host can tweak it and VMRUN again without reinitializing everything.
Key Code
// AMD VMCB 常用偏移（C 语言示意）
#define VMCB_CTRL_INTERCEPT_CR 0x000
#define VMCB_CTRL_INTERCEPT_DR 0x010
#define VMCB_CTRL_INTERCEPT_EXC 0x020
#define VMCB_CTRL_EXITCODE 0x008
#define VMCB_CTRL_EXITINFO1 0x010
#define VMCB_CTRL_EXITINFO2 0x018
#define VMCB_CTRL_NPT_NCR3 0x040
#define VMCB_CTRL_EVENT_INJ 0x060
#define VMCB_SAVE_RAX 0x400
#define VMCB_SAVE_RIP 0x418
#define VMCB_SAVE_CR0 0x448
#define VMCB_SAVE_CR3 0x458
// 处理 #VMEXIT：
exit_code = *(u32 *)(vmcb + VMCB_CTRL_EXITCODE);
fault_rip = *(u64 *)(vmcb + VMCB_CTRL_EXITINFO2);Structure Cheat Sheet
| 0x000 Control Area | Intercept bitmaps, event injection, NPT control, exit info |
|---|---|
| 0x008 EXITCODE | Most recent #VMEXIT reason code |
| 0x010 EXITINFO1/2 | Exit qualifying info (address, error code, etc.) |
| 0x040 nCR3 | Nested page table (NPT) root |
| 0x060 Event Injection | Event encoding for injecting interrupts/exceptions |
| 0x400 Save Area | All guest registers and system state |
Related Reading
A systematic introduction to virtualization concepts, evolution and taxonomy, and the roles of Intel VT-x and AMD-V.
→A retrospective of three decades of x86 hardware virtualization: binary translation, Intel VT-x, AMD SVM, EPT/NPT, and the modern virtualization security ecosystem.
→In-depth explanation of Intel VT-x VMX root/non-root modes, the VM-exit/VM-entry mechanism, and the VMCS virtual machine control structure.
→Detailed semantics of VMXON/VMXOFF/VMLAUNCH/VMRESUME/VMREAD/VMWRITE and the six field areas of the VMCS layout.
→Explains VMX root/non-root dual-mode switching, the VM-exit event flow, and how VT debuggers exploit dual modes for invisible monitoring.
→How nested virtualization works: nested VMCS/VMCB, shadow-VMCS optimization, and its use in WSL2 and cloud environments.
→A full breakdown of AMD SVM (Secure Virtual Machine): VMCB, #VMEXIT, guest/host modes and AMD's hardware virtualization design.
→Explains AMD NPT two-level address translation, the nCR3 root pointer, TLB control, and its impact on performance and security monitoring.
→Explains AMD NPT two-level address translation, the nCR3 root pointer, TLB control, and it…
→A systematic comparison of AMD SVM vs Intel VT-x: mode design, state structures, interception, nested paging, and ecosystem support.
→A systematic comparison of AMD SVM vs Intel VT-x: mode design, state structures, intercept…
→Explains AMD-Vi IOMMU DMA remapping, interrupt remapping and device passthrough, plus its security roles.
→Explains AMD-Vi IOMMU DMA remapping, interrupt remapping and device passthrough, plus its …
→Step-by-step guide to enabling SVM on AMD platforms: BIOS entry points, naming differences, verification and common issues.
→An overview of the VT Debugger: hypervisor-layer isolation, EPT-based residue-free breakpoints, VM-exit event handling and invisible memory access.
→A feature-by-feature breakdown of the VT Debugger: invisible breakpoints, invisible hooks, kernel-level memory access, process protection and anti-anti-debugging.
→A complete getting-started tutorial from download and install to your first breakpoint: requirements, driver loading, attaching and troubleshooting.
→Quickly confirm CPU virtualization support and enablement via Task Manager, systeminfo, CPU-Z and command-line methods.
→Deep dive into the two core VT Hook implementations: EPT page-remapping hooks and write-protect hooks, and how they defeat integrity checks.
→From the detection surface of traditional breakpoints to EPT page-level and virtualized hardware breakpoints: implementation and anti-detection power.
→The VT-layer process protection stack: EPT memory hiding, TerminateProcess interception, anti-injection and anti-debugging.
→The role of virtualization in anti-cheat: from kernel-level detection to hypervisor-grade monitoring, and the bypass/counter-bypass arms race.
→