Hypervisor-enforced Paging Translation - The End of Non Data-driven Kernel Exploits?

This conference talk from Recon 2024 titled "Hypervisor-enforced Paging Translation - The end of non data-driven Kernel Exploits?" features Andrea Allievi and Satoshi Tanda exploring cutting-edge Windows kernel exploit mitigations. Dive into the current state of exploit mitigations in Windows 11, focusing on why protecting page tables is critical for system security. Learn about Hypervisor-enforced paging translation (HVPT), a new technology designed to address one of the last remaining weak points in the Windows kernel. The presenters, both experienced security researchers with extensive backgrounds in system-level development and virtualization security, explain what HVPT is, how it's implemented, and the challenges Microsoft faced in developing this protection. Perfect for those interested in Windows kernel internals and hardware-based security features, this 58-minute talk provides valuable insights into advanced OS protection mechanisms.