MoRE Shadow Walker: The Progression of TLB-Splitting on x86
summary
Presents a method to re-create TLB-splitting on Core i–series by using an EPT and VPID-based hypervisor that traps EP faults, tags TLB entries per-VM, and primes the ITLB by single-step priming of ITLB (trap flag) so code and data map differently to the guest. Implements a ~2k-line VMX hypervisor that handles Windows copy‑on‑write and rare thrash cases (copies one instruction), demonstrates stable executable checksums while data changes, and measures <2% runtime overhead in typical tests.
AI-written summary · about
chapters (10)
- 0:00Introduction to TLB splitting
- 2:12x86 paging and TLB basics
- 7:45Implementing the TLB split
- 11:34History of TLB splitting
- 14:56Modern x86 hardware changes
- 17:31New techniques with virtualization
- 22:25Real-time executable measurement
- 26:53Technical challenges overcome
- 31:51Results and demonstration
- 37:44Offensive applications and future
related talks
41mUsing Microarchitectural Design to Break KASLR and More
40mUpcoming x86 Technologies for Malicious Hypervisor Protection
32mLVBS and Advanced Kernel Integrity
36mStore-to-Leak Forwarding: There and Back Again
53mXenpwn: Breaking Paravirtualized Devices
25mHigh Performance VM Introspection
27mTranslation Leak-aside Buffer: Defeating Cache Side-channel Protections
36mLost Control-Breaking Hardware-Assisted Kernel Control-Flow Integrity with Page-Oriented Programming