Intel VT-x Basics: VMX Modes and Core Virtualization Concepts
Intel VT-x is the core of Intel's hardware-assisted virtualization. It adds VMX root and VMX non-root operation modes and uses the VMCS structure to hold VM state. These basics are the essential path to understanding the VT Debugger.
Core Concepts
VMX Operation Modes
VMX root mode hosts the VMM (hypervisor); VMX non-root mode hosts the guest. Both have four privilege levels, but in non-root mode privileged instruction behavior is governed by the VMCS.
VMXON / VMXOFF
VMXON enters VMX operation and VMXOFF leaves it. Before entering, CR4.VMXE must be set and a VMXON region prepared.
VMCS (Virtual Machine Control Structure)
A hardware-maintained memory region holding guest state, host state and execution-control fields. The VMM accesses it via VMREAD/VMWRITE.
VM-entry / VM-exit
VMLAUNCH/VMRESUME cause VM-entry into the guest; when the guest executes a controlled instruction or event, a VM-exit occurs and the CPU saves guest state and loads host state.
VM-exit Reasons
Every VM-exit carries a 32-bit reason code (e.g., #UD, EPT violation, CPUID, CR access) that the VMM dispatches on.
EPT & VPID
EPT translates guest-physical to host-physical addresses; VPID keeps per-vCPU TLB entries to avoid flushes after VM-exits.
Key Code
; 进入 VMX 操作的最小流程（汇编示意）
mov eax, cr4
or eax, 0x2000 ; CR4.VMXE = 1
mov cr4, eax
vmxon [vmxon_region] ; 进入 VMX root 模式
mov eax, vmcs_region
vmptrld eax ; 加载当前 VMCS
; 填充 guest/host 状态后:
vmlaunch ; 首次进入客户机（VM-entry）
; 发生 VM-exit 后回到这里，检查 VMCS 退出原因
vmread eax, [exit_reason_field]Structure Cheat Sheet
| VMXON Region | 4KB-aligned region used when entering VMX operation |
|---|---|
| VMCS Region | 4KB-aligned structure holding VM state, with guest/host state areas |
| VMREAD/VMWRITE | Instructions that read/write VMCS fields by encoding |
| VMLAUNCH | First entry into the guest (launches the VMCS) |
| VMRESUME | Re-entry into the guest (resumes the VMCS) |
| CR4.VMXE | VMX enable bit; must be set before VMXON |
| INVEPT/INVVPID | Instructions that invalidate EPT caches or VPID TLBs |
Related Reading
A systematic introduction to virtualization concepts, evolution and taxonomy, and the roles of Intel VT-x and AMD-V.
→A retrospective of three decades of x86 hardware virtualization: binary translation, Intel VT-x, AMD SVM, EPT/NPT, and the modern virtualization security ecosystem.
→Detailed semantics of VMXON/VMXOFF/VMLAUNCH/VMRESUME/VMREAD/VMWRITE and the six field areas of the VMCS layout.
→Explains VMX root/non-root dual-mode switching, the VM-exit event flow, and how VT debuggers exploit dual modes for invisible monitoring.
→How nested virtualization works: nested VMCS/VMCB, shadow-VMCS optimization, and its use in WSL2 and cloud environments.
→A full breakdown of AMD SVM (Secure Virtual Machine): VMCB, #VMEXIT, guest/host modes and AMD's hardware virtualization design.
→Field-by-field analysis of the AMD VMCB memory layout: control area, save area, intercept bitmap and precise offsets.
→Explains AMD NPT two-level address translation, the nCR3 root pointer, TLB control, and its impact on performance and security monitoring.
→Detailed semantics of VMXON/VMXOFF/VMLAUNCH/VMRESUME/VMREAD/VMWRITE and the six field area…
→A systematic comparison of AMD SVM vs Intel VT-x: mode design, state structures, interception, nested paging, and ecosystem support.
→Explains VMX root/non-root dual-mode switching, the VM-exit event flow, and how VT debugge…
→Explains AMD-Vi IOMMU DMA remapping, interrupt remapping and device passthrough, plus its security roles.
→A systematic introduction to virtualization concepts, evolution and taxonomy, and the role…
→Step-by-step guide to enabling SVM on AMD platforms: BIOS entry points, naming differences, verification and common issues.
→An overview of the VT Debugger: hypervisor-layer isolation, EPT-based residue-free breakpoints, VM-exit event handling and invisible memory access.
→A feature-by-feature breakdown of the VT Debugger: invisible breakpoints, invisible hooks, kernel-level memory access, process protection and anti-anti-debugging.
→A complete getting-started tutorial from download and install to your first breakpoint: requirements, driver loading, attaching and troubleshooting.
→Quickly confirm CPU virtualization support and enablement via Task Manager, systeminfo, CPU-Z and command-line methods.
→Deep dive into the two core VT Hook implementations: EPT page-remapping hooks and write-protect hooks, and how they defeat integrity checks.
→From the detection surface of traditional breakpoints to EPT page-level and virtualized hardware breakpoints: implementation and anti-detection power.
→The VT-layer process protection stack: EPT memory hiding, TerminateProcess interception, anti-injection and anti-debugging.
→The role of virtualization in anti-cheat: from kernel-level detection to hypervisor-grade monitoring, and the bypass/counter-bypass arms race.
→