I was recently reading An Introduction to Hardware-Assisted Virtual Machine (HVM) Rootkits (PDF), and it wasn't entirely clear about the conditions under which the hypervisor rootkit can start virtualization. If virtualization is enabled then everything is fine, but what happens if virtualization is disabled?
Specifically, does either Intel VT-x or AMD-v (VMX and SVM) support unlocking and enabling HAV after the BIOS (or a later hypervisor) has disabled and locked it? I am not interested in modifying the BIOS or changing its settings, purely in whether a hypervisor can change these settings.
(If anyone is wondering: No, I am not planning on creating a malicious rootkit :P)
(If anyone is wondering: No, I am not planning on creating a malicious rootkit :P)
Coincidentally, that's exactly what someone creating a malicious rootkit would say. Just saying...