That's right - an unsigned driver loaded and running with #HVCI enabled. And the best part? The system still appears as locked down. Article coming soon.
Image from Archie (@Archie_1997)
12
17
343
12,195
Looks like this post attracted the attention of MSRC - so just to confirm: this is not a vuln! This is a teaser of my upcoming Secure Kernel research series, and while I did get unsigned drivers to load, it can only be done by breaking the root of trust. Not VTL 0.

Oct 21, 2026 · 5:33 AM UTC

1
2
152