Hypervisor-enforced Paging Translation - The End of Non Data-driven Kernel Exploits?
Learn EDR Internals: Research & Development From The Masters
Google, IBM & Microsoft Certificates — All in One Plan
Overview
Google, IBM & Meta Certificates — All 10,000+ Courses at 40% Off
One annual plan covers every course and certificate on Coursera. 40% off for a limited time.
Get Full Access
This conference talk from Recon 2024 titled "Hypervisor-enforced Paging Translation - The end of non data-driven Kernel Exploits?" features Andrea Allievi and Satoshi Tanda exploring cutting-edge Windows kernel exploit mitigations. Dive into the current state of exploit mitigations in Windows 11, focusing on why protecting page tables is critical for system security. Learn about Hypervisor-enforced paging translation (HVPT), a new technology designed to address one of the last remaining weak points in the Windows kernel. The presenters, both experienced security researchers with extensive backgrounds in system-level development and virtualization security, explain what HVPT is, how it's implemented, and the challenges Microsoft faced in developing this protection. Perfect for those interested in Windows kernel internals and hardware-based security features, this 58-minute talk provides valuable insights into advanced OS protection mechanisms.
Syllabus
Recon 2024-Andrea Allievi&Satoshi Tanda-HypervisorEnforced Paging Translation....
Taught by
Recon Conference