In Windows 10/11 the core of the Windows kernel can run in a virtual machine totally separated from the rest of the kernel. > HyperGuard takes advantage of VBS

In Windows 10/11 the core of the Windows kernel can run in a virtual machine totally separated from the rest of the kernel. > HyperGuard takes advantage of VBS – Virtualization Based Security > Having memory that cannot be tampered with even from normal kernel code allows for many new security features > This is also what allows Microsoft to implement HyperGuard – a feature similar to PatchGuard that can’t be tampered with even by malicious code that managed to elevate itself to run in the kernel. https://windows-internals.com/hyperguard-secure-kernel-patch-guard-part-1-skpg-initialization/ https://windows-internals.com/hyperguard-secure-kernel-patch...