Windows Internals: Secure Calls - The Bridge Between The NT Kernel and Secure Kernel

This technical report reverse-engineers Windows Virtual Secure Mode’s secure call interface, showing how VTL0 requests services from the Secure Kernel (VTL1) via the Hyper-V hypercall path (`HvCallVtlCall`, 0x11) and how VM exits/entries, VMCS state, and GS-based per-CPU structures (partition, VMCS, virtual processor) are used to broker execution. It maps the flow from NT’s `VslpEnterIumSecureMode` through Hyper-V’s VM-exit handler to VTL transitions and Secure Kernel routines (`IumInvokeSecureService`, `SkpPrepareForNormalCall`), and explains parameter-passing patterns (MDLs, secure handles) and secure thread cookies. The author releases SkBridge to craft secure calls and references ETW-based monitoring (Vtl1Mon), providing researchers a practical interface to explore SK services.