The Payload Podcast #002 with Connor McGarr

The episode explores modern Windows security architecture, detailing the shift to hypervisor-enforced isolation via Virtual Trust Levels (VTLs) and ARM-specific mitigations like Pointer Authentication (PAC) to counter kernel-level threats.

Key Takeaways:
• Windows security now relies on Hyper-V to isolate the "Secure Kernel" in VTL1, preventing kernel-mode attackers from bypassing memory integrity checks 15:00-16:00.
• ARM64 utilizes Pointer Authentication (PAC) to sign pointers, protecting return addresses from stack overflow exploits in the absence of x64 Shadow Stacks 41:00-42:00.
• WinDbg queries reveal unique PAC keys per process and mitigation flags, highlighting the complexity of validating modern exploit protections 55:00-56:00.
• The Secure Kernel manages system call handlers and protects MSRs via intercepts, effectively neutralizing rootkit techniques that attempt to corrupt system registers 36:00-37:00.
• Reverse engineering ARM Windows presents challenges due to a lack of public documentation compared to x86/x64 architectures 49:00-50:00.

This discussion highlights the increasing complexity of low-level Windows security and the necessity for researchers to understand hypervisor-enforced boundaries.

Sources:

• 15:00 Overview of the new virtualized Windows security model
• 24:00 Diagram of VTL0 and VTL1 isolation
• 41:00 Explanation of ARM Pointer Authentication (PAC)
• 55:00 WinDbg demonstration of process mitigation flags and PAC keys