What fails when VBS no longer owns the memory
Download More RAM’s case studies show what the post-bypass memory capability changes in practice. The focus is not a catalog of products, but a comparison of what was read, modified, disabled, or merely shown to be reachable across VBS Enclaves, anti-malware, anti-cheat, and managed Windows policy. That distinction lets the reader judge the evidence without treating a product’s user-mode detection result as proof that the lower-level memory boundary still holds.
By this stage, the attack has a stronger physical-memory path than the fragile RAM-disk overlay. The relevant question becomes how much authority each protected system actually receives from Windows, and what happens when the shared foundation beneath those protections can be altered.
Two kinds of lost authority
The VBS Enclave case is the clearest test of the isolation promise itself. A VBS Enclave is an isolated user-mode environment that can be called by a host application running in ordinary user mode. The host may invoke the enclave, but it is not supposed to read the enclave’s code and data in return. That one-way relationship supports uses such as keeping decrypted secrets inside the protected environment.
The researchers built an enclave around a small, deliberately observable computation. Its logic used an XOR operation to derive and validate a secret from predefined values. With the aliased-memory view, they could locate the enclave’s code and data, read them, and change the operation from XOR to AND. The application then produced the altered, unsuccessful result expected from the modified logic.
That demonstration establishes two different failures. Reading the enclave’s contents is a confidentiality failure: the host-side environment has obtained material that the enclave boundary is intended to keep private. Changing the operation is an integrity failure: the host-side environment has altered what the protected computation does. The result is stronger than observing an error or inferring a secret from output. It shows that the memory holding the enclave’s logic and state was reachable through the lower-level physical view.
The qualification is equally important. The authors loaded their test enclave in Windows test mode. That setup is not evidence that an arbitrary unsigned enclave can be installed on a production system with ordinary security settings. It is evidence about the isolation relationship once the researchers had a controlled enclave present: the memory alias can expose and modify protected enclave state that the host is not supposed to reach. A careful account therefore says that the experiment demonstrated a VBS Enclave isolation failure under its test setup, not that every production enclave deployment has been reproduced.
The anti-malware case tests a different authority. PPL is supposed to prevent a lower-protection process, including an ordinary administrator process, from reading, writing, or terminating a protected anti-malware service. Windows Defender and EDR products use this kind of protection because stopping security software is often an early step in a rootkit or ransomware chain.
Download More RAM reaches this protection indirectly. After the code-integrity gate has been weakened, the researchers can revive a previously blocked signed-driver attack. The driver provides the stronger memory operations that the RAM-disk path could not safely provide.