Bitdefender Napoca Hypervisor

WARNING: ARCHIVED PROJECT

This project is no longer maintained and is provided for historical and research purposes only.

• No security support: No further development, security support, maintenance, bug fixes, or releases are planned.
• Vulnerabilities: The repository contains known security vulnerabilities and must not be used in production or security-sensitive environments.
• Known Issues:
  • CVE-2026-10046: Out-of-bounds write in Napoca BIOS INT 0x15 E820 memory map handler (napoca/guests/bios_handlers.c).
  • CVE-2026-10047: Out-of-bounds write in Napoca real-mode hook handler via guest-controlled SS:SP (napoca/kernel/handler.c).
• No Patching: Patches and pull requests are no longer accepted.

Before deploying, be aware of the following constraints:

• Hardware: Only Intel platforms (with Intel Virtualization Technology) are currently supported.
• Virtualization Nesting: Because Napoca requires access to native platform virtualization support, it may not function correctly when running inside another hypervisor. It is recommended to deploy Napoca on physical Windows installations that are not themselves virtualized.

The Napoca project consists of the following core components:

1. Napoca: The core hypervisor implementation.
2. Winguest: Windows components for interacting with the hypervisor, including a user mode DLL (winguestdll) and a kernel mode driver (winguest).
3. Winguest_sample: A user mode sample application built on Winguest to serve as a starting point for developing new tools.
4. EfiPreloader: A minimal EFI loader that enables a custom chain of trust for the hypervisor and OS boot flow, facilitating UEFI Secure Boot adoption.
5. EfiLoader: A Napoca boot loader application specifically for UEFI systems.

To build Napoca, you must use the Microsoft Visual Studio build toolchain on Windows. Ensure the following are installed:

• Visual Studio 2019 with the following workloads and components:
  • Workload: Desktop Development with C++
  • Component: MSVC v142 - VS 2019 C++ x64/x86 Spectre-mitigated libs (ensure version matches unmitigated libs)
  • Component: C++ ATL for latest v142 build tools with Spectre Mitigations (x86 & x64)
  • Component: Windows 10 SDK (10.0.18362) [1903]
• Windows 10 WDK 10.0.18362 [1903]
• Git
• NASM: Must be added to the system PATH.
• PowerShell 5.0+: Enable scripts by running Set-ExecutionPolicy Unrestricted as Administrator.
• Python 3: Install PyYAML via py -3 -m pip install PyYAML.
• Doxygen (Optional): Required only for generating HTML/LaTeX documentation.

Build

Open the dacia.sln solution in Visual Studio and perform a full build using your desired platform and configuration (e.g., x64 - Release).

Create Deployable Package

Use the provided PowerShell script to generate an installation folder:

./deploy_binaries.ps1 -Platform x64 -Configuration Release -Destination .\install

To verify the hypervisor is running correctly:

1. Run winguest_sample.exe as Administrator.
2. Run the following commands:

drvconnect
queryhv

Use the help command within winguest_sample.exe to see all available commands.

Preparation

1. Disable Secure Boot on the target machine.
2. Disable driver signature enforcement by running: bcdedit -set testsigning on.

Installation Steps

Assuming the install folder was copied to C:\dacia:

1. Run winguest_sample.exe as Administrator.
2. Execute the following commands in sequence:

# Install the driver
drvinstall C:\dacia\install\driver\winguest.inf {8a5531a8-2c02-482e-9b2e-99f8cacecc9d}\BdWinguest

# Connect to the driver
drvconnect

# Set paths for hypervisor components
setpath 1 C:\dacia\install\hv\
setpath 2 C:\dacia\install\hv\updates_intro\
setpath 3 C:\dacia\feedback\

# Enable configuration
config enable

3. Reboot the machine.

WPP Software Tracing

Logs are generated via WPP Software Tracing by the winguest and winguestdll components. Refer to their respective trace.h files for the required GUIDs and flags.

Serial Debugging

You can use a debug console over a serial port:

1. In winguest_sample, run: config enable serial.
2. Attach a serial cable to the onboard COM port.
3. Note: You may need to uninstall Windows' serial drivers to prevent them from competing for the COM port.
4. Type help in the console to see available commands.

Failsafe Mechanism

Napoca includes a failsafe: if the hypervisor is booted 3 times without loading the user-mode components, it will be disabled.

• Use setfailcnt to manage the failure count.
• Use resetfailcnt to reset the failure count.

The Napoca sample utility supports execution via command line arguments. If arguments are provided, the application parses and executes them immediately using CmdLineMatchAndExecuteCommands. Note that when passing arguments, you should skip the first argument (the program name) by passing Argc - 1 and &Argv[1].

// If command line arguments are provided (Argc > 1)
status = CmdLineMatchAndExecuteCommands(Argc - 1, &Argv[1]);

Before interacting with the Napoca hypervisor or using functions from winguestdll.dll, you must initialize all necessary imports and DLLs. This is typically done using ImportsInit().

NTSTATUS status = ImportsInit();
if (!NT_SUCCESS(status)) {
    // Handle error
}

If no command line arguments are provided, the application enters an interactive loop. You can provide commands as strings via standard input, which are then processed by CmdLineParseUserStringAndExecuteCommands.

// In an interactive loop, parse a user-provided string
status = CmdLineParseUserStringAndExecuteCommands(userInputString);