pi3 blog

bug bugs bughunt exploit exploiting research vulnerabilities

• Home
• About

“He who fights with monsters should be careful lest he thereby become a monster. And if thou gaze long into an abyss, the abyss will also gaze into thee.”

~Friedrich Nietzsche

• Subscribe

  

• Categories

  • Bughunt (28)
  • Exploiting (36)
  • Ideas (28)
  • LKRG (10)
  • Meeting (6)
  • O wszystkim i o niczym (34)

• Recent Posts

  • RISC-V: Vice Chair of the J-extension Task Group
  • CVE-2023-34367
  • Bug bounties are broken – the story of “i915” bug, ChromeOS + Intel bounty programs, and beyond
  • My talks @ BlackHat 2021 and DefCon29
  • LKRG 0.9.0 has been released!

• Archives

  • November 2023
  • June 2023
  • May 2023
  • July 2021
  • April 2021
  • January 2021
  • December 2020
  • October 2020
  • September 2020
  • June 2020
  • May 2020
  • March 2020
  • October 2019
  • July 2019
  • May 2019
  • April 2019
  • February 2019
  • August 2018
  • July 2018
  • March 2018
  • February 2018
  • January 2018
  • April 2017
  • September 2016
  • July 2015
  • February 2015
  • March 2014
  • August 2013
  • July 2013
  • May 2013
  • April 2013
  • March 2013
  • February 2013
  • October 2012
  • May 2012
  • April 2012
  • December 2011
  • September 2011
  • August 2011
  • July 2011
  • March 2011
  • November 2010
  • October 2010
  • July 2010
  • May 2010
  • March 2010
  • February 2010
  • January 2010
  • December 2009
  • November 2009
  • October 2009
  • September 2009

• Friends

  • Bothunters – Borys Łącki
  • Gynvael Coldwind
  • Icewall
  • j00ru
  • Piotr Bania

• Pages

  • About

One of the author of Windows Internals (Andrea Allievi) asked me and my friend David Kaplan if we could write a section about System Guard Runtime Attestation for their book. We’ve written about 3-4 pages describing internals of that project which we fully designed. Our section will be included in Windows Internals 7th edition part 2 (release date around August 2019):

Secure Kernel chapter of the new Windows Internals is done! … including also a section of System Guard Runtime Attestation (thanks @Adam_pi3 and @depletionmode) + Trustlets, Enclaves and SK Memory manager. Hurrah! I start to see the end of the tunnel 🙂

— Andrea Allievi (@aall86) April 2, 2019

Windows Defender System Guard Runtime Attestation (SGRA / SGRM) is internally known as a project Octagon which me and Dave fully designed and implemented together with Octagon v-team. Octagon is now included in every Windows build and first implementation of this new technology has been introduced in Windows 10 April 2018 Update (RS4). You can learn more about this project here:

https://www.microsoft.com/security/blog/2018/04/19/introducing-windows-defender-system-guard-runtime-attestation/

Best regards,
Adam