Top all-time · #4271
Alex Ionescu
Personal blog · alex-ionescu.comsystemssecurity
Alex Ionescu's personal blog at alex-ionescu.com covers systems and security. Since 2012, 18 different Hacker News readers have linked it 28 times, most often “Owning the Object File Format, the Compiler Toolchain, and the Operating System”. The last post was in 2019, but the archive is still widely read.
Too few sampled comments (11) to say how often HN recommends it.?
Why HN links it
HN readers link Alex Ionescu's site for his Windows low-level internals work, covering kernel memory, Protected Processes, SGX and hypervisor security, and a Black Hat 2015 talk.
Summarised by Claude from a sample of 11 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Owning the Object File Format, the Compiler Toolchain, and the Operating System3 people · 3 mentions · first linked 2016-05-06
- Dynamic Tracing in Windows 103 people · 3 mentions · first linked 2018-08-02
- Intel SGX Enclave Support in Windows 10 Fall Update [pdf]2 people · 4 mentions · first linked 2015-12-30
- How Windows 10 Rewrites OS Architecture: Battle of SKM and IUM [pdf]2 people · 2 mentions · first linked 2015-10-23
- Bringing Call Gates Back2 people · 2 mentions · first linked 2017-08-07
- How Control Flow Guard Caused Windows 8.1 Address Space and Behavior Changes2 people · 2 mentions · first linked 2015-01-24
What Hacker News says?
They changed it in Windows 10 (RS1 IIRC)[1]. [1] http://www.alex-ionescu.com/?p=323
Comment linking /?p=323
on “Windows 7 patch for Meltdown enabled arbitrary reads and writes in kernel memory”Submitted Windows Internals, 7th Edition as a story · 174 points
HN discussionIt's not "coming out of Black Hat". It's coming from Alex Ionescu , via his GitHub account. You have an identifiable person with a known reputation here, not some unidentifiable person hiding behind a pseudonym. The problems that you have are quite different ones: * Demonstrating that the Alex Ionescu of http://www.alex-ionescu.com/ and of https://microsoftpressstore.com/authors/bio.aspx?a=07cda0ad-... is the Alex I…
Comment linking /
on “The Linux kernel hidden inside Windows 10”Submitted How Windows 10 Rewrites OS Architecture: Battle of SKM and IUM [pdf] as a story · 59 points
HN discussion> Apple is headed down the path that the old Microsoft was headed. Exactly. > Which they, Microsoft, have ironically backed away from. Are you really sure that Microsoft backed away from this path? Just google about "Intel SGX (Software Guard Extensions)" and inform yourself how Windows 10 uses/plans to use them. To help you a little bit for researching on this topic, here are two references: > https://sec.ch9.ms/sl…
Comment linking /Enclave%20Support%20In%20Windows%2010%20Fall%20Update.pdf
on “What Apple Gives You for $100 as a Safari Extension Developer”Submitted Writing a Hyper-V Bridge for Fuzzing: Hypercalls and MDLs as a story · 52 points
HN discussionWindows is doing a lot of work using their hypervisor to secure parts of the kernel -- This talk from Blackhat 2015 has some really cool details: http://www.alex-ionescu.com/blackhat2015.pdf
Comment linking /blackhat2015.pdf
on “Linus Torvalds Talks Linux Security at LinuxCon”Submitted Bringing Call Gates Back as a story · 47 points
HN discussionThe article confuses address space and memory reservations as you note. It again makes the confusion when it suggests the virtual size column in Process Explorer is a reflection of the address space[1]. It also suggests that working set, private bytes, and committed memory are the same thing[2]. The article does not even live up to its click-baity title: Task Manager's default memory column of "private working set"…
Comment linking /?p=246
on “Do Not Use Task Manager for Memory Info”Submitted How Control Flow Guard Caused Windows 8.1 Address Space and Behavior Changes as a story · 42 points
HN discussionThis is a big capability. Right now it's quite difficult (requiring pinning together a few pieces of technology) to protect one process from another, especially if the other process is root. This isn't enough to get quite there, but it's a good start. Windows has been working on similar tech via Protected Processes[0], notably used for both LSASS and their new eBPF verifier. That's been a tricky technology to get ri…
Comment linking /?p=97
on “Memfd_secret() in 5.14”Submitted Lego's packing process isn't perfect as a story · 32 points
HN discussionThere is also "Protected Processes". http://www.alex-ionescu.com/?p=34
Comment linking /?p=34
on “Reducing Chrome crashes caused by third-party software”Submitted A Codeless PE Binary File That Runs as a story · 10 points
HN discussionAlex Ionescu wrote a paper [1] on Win10 and SGX. > It’s important to realize that for now, only Intel has > the required key to allow an enclave to be launched > without knowing the required CPU-specific enclave key, > and no other (even signed) enclaves can be launched > without it. Once Intel releases a permissive loader, or > if Intel ME vulnerabilities are found to extract the key, > then the real abuse will beg…
Comment linking /Enclave%20Support%20In%20Windows%2010%20Fall%20Update.pdf
on “Intel SGX Explained”Submitted Intel SGX Enclave Support in Windows 10 Fall Update [pdf] as a story · 4 points
HN discussionNote that Intel signs [1] software which runs in SGX enclaves. Windows 10 uses [2][3] SGX. Intel got a pretty long patent on SGX a few years ago. In it, they say that the launch enclave will only issue launch tokens after ensuring that the enclave's author has a business agreement with Intel. The patent also states that they expect enclaves to be useful for DRM, so I'm guessing they want to insert themselves into th…
Comment linking /Enclave%20Support%20In%20Windows%2010%20Fall%20Update.pdf
on “Intel Software Guard Extensions – Memory Encryption Engine”Submitted Owning the Object File Format, the Compiler Toolchain, and the Operating System as a story · 3 points
HN discussionLooks like it's owned by a ReactOS developer with quite a bit of experience in digging into Windows low-level internals: http://www.alex-ionescu.com/?page_id=2
Comment linking /?page_id=2
on “Windows 10 Technical Preview Source Tree”Submitted Hooking Nirvana: Stealthy Instrumentation Techniques (2015) [pdf] as a story · 3 points
HN discussionI assume this one for heaven's gate: https://www.alex-ionescu.com/closing-heavens-gate/ But that's very windows specific, I think the general term is jumping between long mode and protected mode?
Comment linking /closing-heavens-gate/
on “i386 in Ubuntu Won't Die”Submitted Writing a Hyper-V “Bridge” for Fuzzing as a story · 2 points
HN discussionSubmitted Dynamic Tracing in Windows 10 as a story · 2 points
HN discussionSubmitted Solving Intractable Performance Problems Through Vertical Engineering as a story · 2 points
HN discussionSubmitted Dynamic Tracing in Windows 10 19H1 as a story · 1 points
HN discussionSubmitted Microsoft Windows SystemGuard root of trust and runtime attestation [pdf] as a story · 1 points
HN discussionSubmitted Dynamic Tracing in Windows 10 19H1 as a story · 1 points
HN discussionSubmitted Bringing Call Gates Back as a story · 1 points
HN discussion
