Overview
Download More RAM shows how writable DIMM SPD data can create aliased physical addresses beneath Windows VBS: a false map destabilizes Windows, enables raw-memory disclosure, and supports a fragile code-integrity bypass. The series traces each authority transition, tested impacts, evidence limits, and defenses, including Microsoft’s partial April 2026 Secure Boot mitigation. It requires local administrator access and specific hardware; it is not a universal or unprivileged exploit.
Learning outcomes
- Writable SPD can make two reported physical addresses reach the same cells, but only on qualifying DIMMs and platforms.
- The demonstrated chain separates alias creation, Windows stabilization, raw-memory access, limited writing, and driver admission; each stage can fail.
- The paper reports protected-memory disclosure and integrity effects, including VBS Enclave modification and Defender disablement, under tested conditions.
- Microsoft’s April 2026 changes mitigate the tested stabilization route on Secure Boot systems, but do not prove universal protection against alternate paths.
Keywords
Preview every chapter · Unlock full text, audio, and video from chapter 4
PlansFAQ
What is Download More RAM?
Download More RAM is a software-induced memory-aliasing attack in which writable DIMM SPD data makes extra reported addresses resolve to existing cells. The paper studies Windows 11 VBS under specific hardware and privilege conditions.
Does Download More RAM bypass Windows VBS?
Yes, the paper demonstrates a VBS confidentiality failure and later integrity effects on tested systems, but not an immediate or universal bypass: it requires local administrator access, suitable hardware, and a multi-stage chain.
What hardware condition enables Download More RAM?
The starting condition is a consumer DIMM whose relevant SPD configuration blocks are writable; partial protection prevented the demonstrated rewrite in testing. Firmware and motherboard behavior must also accept and apply the altered geometry.
Is the April 2026 Windows update a complete fix for Download More RAM?
No. The paper reports that it removes the tested memory-removal stabilization behavior on Secure Boot systems, while systems without Secure Boot remained affected in observations; alternate stabilization paths were not ruled out.