Alex Ionescu

The article confuses address space and memory reservations as you note. It again makes the confusion when it suggests the virtual size column in Process Explorer is a reflection of the address space[1]. It also suggests that working set, private bytes, and committed memory are the same thing[2]. The article does not even live up to its click-baity title: Task Manager's default memory column of "private working set" is a decent measure of how much memory a process is uniquely using and task manager has the ability to add all the other measures of memory usage that the article mentions. For a better explanation of virtual memory in Windows, I recommend Mark Russinovich's article[3]. His tool VMMap[4] is useful for visualizing the memory usage of an individual process. [1]: The reserved memory is really large for 64-bit processes that use Control Flow Gaurd: http://www.alex-ionescu.com/?p=246 [2]: Task Manager and Process Explorer add to the confusion by calling the same memory different things (Process Explorer's "private bytes" number is the same as Task Manager's "commit size" number on Windows 10 1809). [3]: https://blogs.technet.microsoft.com/markrussinovich/2008/11/17/pushing… [4]: https://docs.microsoft.com/en-us/sysinternals/downloads/vmmap

This is a big capability. Right now it's quite difficult (requiring pinning together a few pieces of technology) to protect one process from another, especially if the other process is root. This isn't enough to get quite there, but it's a good start. Windows has been working on similar tech via Protected Processes[0], notably used for both LSASS and their new eBPF verifier. That's been a tricky technology to get right but I think it's interesting. > Andy Lutomirski repeatedly opposed making uncached mappings available, objecting to the performance cost and more; Interesting. I'll want to read more into this. My guess is that for the next 5 years there will be endless ways to leak these secrets and maybe, if we're lucky, things will improve over that time. [0] https://www.alex-ionescu.com/?p=97

They changed it in Windows 10 (RS1 IIRC)[1]. [1] http://www.alex-ionescu.com/?p=323

There is also "Protected Processes". http://www.alex-ionescu.com/?p=34

Looks like it's owned by a ReactOS developer with quite a bit of experience in digging into Windows low-level internals: http://www.alex-ionescu.com/?page_id=2

I assume this one for heaven's gate: https://www.alex-ionescu.com/closing-heavens-gate/ But that's very windows specific, I think the general term is jumping between long mode and protected mode?

> Apple is headed down the path that the old Microsoft was headed. Exactly. > Which they, Microsoft, have ironically backed away from. Are you really sure that Microsoft backed away from this path? Just google about "Intel SGX (Software Guard Extensions)" and inform yourself how Windows 10 uses/plans to use them. To help you a little bit for researching on this topic, here are two references: > https://sec.ch9.ms/slides/winHEC/03_WindowsSecurity.pdf > http://www.alex-ionescu.com/Enclave%20Support%20In%20Windows%2010%20Fa…

It's not "coming out of Black Hat". It's coming from Alex Ionescu, via his GitHub account. You have an identifiable person with a known reputation here, not some unidentifiable person hiding behind a pseudonym. The problems that you have are quite different ones: * Demonstrating that the Alex Ionescu of http://www.alex-ionescu.com/ and of https://microsoftpressstore.com/authors/bio.aspx?a=07cda0ad-d0ed-4ccc-… is the Alex Ionescu of https://twitter.com/aionescu/status/710477975288827904 and of https://github.com/ionescu007 . It's difficult to show a connection in that direction. The Alex Ionescu of https://alexionescu.net/#contact lets people connect the dots — a different set of dots, mind you. * Knowing that https://github.com/ is the real GitHub. If this is a problem for you, then you have more serious and urgent problems than viewing a PDF document. (-:

Note that Intel signs [1] software which runs in SGX enclaves. Windows 10 uses [2][3] SGX. Intel got a pretty long patent on SGX a few years ago. In it, they say that the launch enclave will only issue launch tokens after ensuring that the enclave's author has a business agreement with Intel. The patent also states that they expect enclaves to be useful for DRM, so I'm guessing they want to insert themselves into the entertainment content distribution systems and collect some royalties. [1] https://jbeekman.nl/blog/2015/10/intel-has-full-control-over-sgx/ [2] http://www.alex-ionescu.com/Enclave%20Support%20In%20Windows%2010%20Fa… [3] https://software.intel.com/en-us/sgx-sdk/documentation

Windows is doing a lot of work using their hypervisor to secure parts of the kernel -- This talk from Blackhat 2015 has some really cool details: http://www.alex-ionescu.com/blackhat2015.pdf