Hi, SinaKarvandi :
Thank you very much for the tutorial, it helped me a lot.
But there is a problem that has been bothering me for a long time(OS: Windows 10 x64,19044, Disabled VBS). Without enabling EPT, the GUEST_RIP was able to execute every time the VMLAUNCH instruction was executed, but when I go (g) in windbg, the VM gets stuck and loses control from windbg and cannot enter the VM-exit handler, I tried the following method to try to find the reason: Before VMLANCH execution, I promoted IRQL > =DISPATCH_LEVEL to successfully enter the VM-exit handler every time the preset conditions in the control area are triggered. But as you know, the wrong IRQL will cause BSOD, but at least it will hit the VM-exit handler. I can't find a good solution, if you know, please help me correct it, thank you very much.