Hype Post

rawwhp turns WHP into a scriptable byte-lab

You pick exact guest physical regions. You load optional files into them. You run one probe. You dump exactly what changed. No full VM image ceremony. Just controlled memory topology and fast exit feedback.

Tool: rawwhp

Date: February 24, 2026

Coverage: real/unreal/protected/long + CPL 0/3

Evidence: commands executed on this host

Fastest Win: One Command, One Exit, One Report

When you only need a deterministic VM-exit observation, this is the shortest path.

_test\rawwhp.exe /area 10000 20 tests\rawwhp\probes\generated\hlt.bin /at 10000 /ticks 40 /report hype\captures\hlt_report.json

mode=real cpl=0 at=0x10000 ticks=0x40 areas=1 dumps=0 pedantic=no maps=1
  area[0] [0x10000..0x10020) init=tests\rawwhp\probes\generated\hlt.bin
  runtime-area [0x11000..0x15000)
[tick 0x1] exit=X64Halt(0x00000008) rip=0x1 rsp=0x3ff0 rflags=0x2 cpl=0

The report captures host support vs requested vs enabled masks, run result, and mapped segments in machine-readable JSON.

Workflow 1: Round-Trip Code/Data in One Run

Use paired dumps to inspect bytes on screen and persist output artifacts for diffing.

_test\rawwhp.exe /area 10000 20 tests\rawwhp\probes\generated\hlt.bin /at 10000 /ticks 40 ^
  /dump 10000 10 /dump 10000 10 hype\captures\dump.bin /report hype\captures\dump_report.json

DUMP start=0x10000 len=0x10 -> stdout
Legend: ADDR | HEX | ASCII
00010000  F4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
dump [0x10000..0x10010) -> hype\captures\dump.bin

Perfect for micro payload bring-up: map bytes, execute, inspect exact post-state, save binary evidence.

Workflow 2: Privilege Topology Without a Full OS

Flip to ring-0 behavior with /cpl 0 and provoke high-value exits directly.

_test\rawwhp.exe /mode long /cpl 0 /area 10000 100 tests\rawwhp\probes\generated\rdmsr_unk.bin ^
  /at 10000 /ticks 400 /report hype\captures\msr_report.json

mode=long cpl=0 at=0x10000 ticks=0x400 areas=1 dumps=0 pedantic=no maps=1
  area[0] [0x10000..0x10100) init=tests\rawwhp\probes\generated\rdmsr_unk.bin
  runtime-area [0x11000..0x19000)
[tick 0x1] exit=X64MsrAccess(0x00001000) rip=0x10005 rsp=0x14ff0 rflags=0x2 cpl=0
  msr-access is-write=0 msr=0xDEADBEEF rax=0x0 rdx=0xa60f12

This gives you a clean path to test exception vs intercepted-exit behavior by mode/CPL, with no device-model noise.

Workflow 3: Host-Aware Regression Gate

Use the bundled suite to keep behavior stable while accounting for host capability variation.

powershell -ExecutionPolicy Bypass -File tests\rawwhp\run.ps1 -SkipBuild

[1/4] Mapping granularity checks
[2/4] Dump behavior checks
[3/4] Capability gate
[4/4] Strict exit matrix
PASS strict matrix: 13/13

This is where rawwhp moves from "handy command" to "maintainable platform tool."

How to Aim the Tool (Layering Model)

Host layer: WHvGetCapability defines what is possible.
Partition layer: property masks define what is accepted now.
Guest layer: /mode, /cpl, /area, /at shape execution context.
Probe layer: instruction bytes decide the actual exit.

Use discover.ps1 to map baseline behavior, then lock focused checks into strict_exits.json.

Guardrails (Keep It Honest)

Mapping is page-oriented (4 KiB), not byte-isolated.
In long mode, identity page tables use 2 MiB entries for mapped segments.
extended_vm_exits_supported_mask can be broader than the accepted/requested partition mask.
/cpl 3 vs /cpl 0 can completely change expected exits.

Verdict for builders: rawwhp is now a serious micro-hypervisor harness for repeatable exit topology work.