Even if an attacker finds a vulnerability in a kernel driver, they cannot simply "allocate" new executable memory or change the permissions of existing memory because the hypervisor—which sits "below" the Windows OS—will block the request. Why Target HVCI?
This article explores what HVCI is, why it is so difficult to circumvent, and the common techniques used to achieve a bypass. What is HVCI? Hvci Bypass
HVCI uses Second Level Address Translation (SLAT) to mark memory pages. Even if an attacker finds a vulnerability in