Hint book:

* VMWare: most popular commercial OS virtualization product.

* Host: the VMWare hypervisor

* Guest: in this case, Windows Vista running under VMWare.

* VMWare backdoor interface: part of the feature that enables "VMWare Tools" to work, VMWare Tools being a set of features that make guest OS's more pleasant to use by making the host and guest communicate with each other.

* I/O instructions: the programmed IO features of the X86 ISA, nominally used by programs (usually the kernel) to communicate with peripherals. (The other common way of doing peripheral I/O is via memory mapping).

* CX, registers: the X86 ISA registers (CX is the 16-bit half of the 32-bit ECX register; EAX, ECX, EDX, and EBX are the primary X86 general-purpose registers with which X86 programs do virtually all their work).

* I/O port: the old addressing space for X86 peripherals.

* REP INSB: the bulk data version of "copy byte from I/O port to memory". Copies a count of bytes (in the ECX register) from the I/O port in the 16-bit DX register to the memory address specified in the EDI register.

* "High-bandwidth backdoor": a magic I/O port VMWare emulates in order to communicate between host and guest as if the host were a peripheral.

* Direction flag: The DF bit in the FLAGS register, determines whether bulk copy instruction sequences copy forwards or backwards; here, means "in the common case, VMWare pretends to do a REP INSB by having the host just call memcpy".

* Virtual DOS Mode (NTVDM or VDM): Windows' own built-in emulation of 16-bit DOS environments for programs not designed to work in 32 bit virtual address mode.

* ring-0, ring-3: kernel or userland, respectively.

* BIOS: The vestigial built-in firmware interface used in booting Windows on mainstream X86 hardware and, in the 1980s, as the "kernel" to which DOS programs (which had direct access to hardware) were programmed. Highly relevant in NTVDM, not so relevant to WinAPI programmers. BIOS ROM is, obviously, supposed to be read-only.

* NT!Whatever: Notation for C library function references: here, NTDLL.DLL the library, and "Whatever" the function. So, NT!VdmpInitialize is NTDLL's VdmpInitialize() function, which sets up memory for NTVDM environments launched by Windows. How does Derek know about this? Because all this stuff has been painstakingly reverse engineered over the last 15 years.

* INT instruction: generates a software interrupt, transferring control to the kernel's low-level interrupt handler.

* Interrupt vector table (IVT): An array of addresses of functions to be called to handle numbered interrupts. If you can overwrite any part of the IVT, you can cause the OS to unexpectedly redirect code somewhere else; that's an older Soeder NTVDM exploit, but not this one.

* INT 10h: the console video services interrupt, nominally handled by the BIOS. If you can overwrite the BIOS and have INT 10h generated, you can get control transfered to code you control. That's why the advisory keeps talking about hibernation and blue screen, both of which use BIOS video services (ie, classic DOS console video).

* HAL or HAL.DLL: the bottom edge of Windows hardware support, wraps & abstracts actual hardware. Somewhat equivalent to arch/i386/ in a Unix kernel.

* Real mode: the "nobody's ever going to need more than 64k of memory" mode in which 80's DOS programs expect to run, includes segmented memory and IN/OUT I/O instruction access. Emulated in NTVDM.

* TIB: Thread information block, the thread context, includes address space info. Remember that on Windows a process is basically a container of threads; an NTVDM process contains a VDM thread. An older Tavis Ormandy exploit targeted related memory ranges to forge trap frames so that when interrupt handlers "returned" in the kernel for NTVDM processes, they'd land in attacker-controlled code.

* Kernel stack pointer: part of the thread context, stores the current "position" of code in memory (for call/return... probably not going to bother explaining call stacks).

* info-set and info-get, VMdb guestinfo: akin to a config registry for VMware, a key-value store of ASCII strings.