HLAT

HLAT is the defense this site's homepage curve has been waiting for, and the reason its platform selector has an HLAT toggle. With it active, the processor translates kernel-mode addresses through paging structures the hypervisor owns and populates lazily; the guest's own page tables still exist, but they no longer govern what kernel-mode code sees. Every technique whose last step is "edit a guest PTE" stops at that step.

What it does not do is equally important, and this page's inventory keeps both halves honest: HLAT protects translation, not data, and its guarantee covers supervisor mode.

Layer	Kernel. The protected asset is kernel-mode address translation itself.
Enforced by	Hypervisor. Parallel paging structures maintained above the guest.
Mechanism	Supervisor-mode walks resolve through hypervisor-populated tables, updated lazily as the guest legitimately maps pages.
Introduced	Intel VT-rp hardware, 11th-generation and newer; active with VBS, default on Windows 11 24H2-era builds.

One mechanism, closed family, open edges

FIG_020: What the guest may edit, and what the processor uses

<text class="ks-label" x="30" y="30">WITHOUT HLAT</text>
<rect class="ks-box" x="30" y="44" width="340" height="60"/>
<text class="ks-annotation" x="45" y="66">Kernel and user mode both walk guest page tables.</text>
<text class="ks-annotation" x="45" y="84">Edit a PTE, redirect the kernel. The DOG family lives here.</text>

<text class="ks-label" x="450" y="30">WITH HLAT</text>
<rect class="ks-box" x="450" y="44" width="340" height="30"/>
<text class="ks-annotation" x="465" y="64">Kernel mode: hypervisor-owned tables. PTE edits do nothing.</text>
<rect class="ks-box" x="450" y="82" width="340" height="30"/>
<text class="ks-annotation" x="465" y="102">User mode: still guest tables. The open edge.</text>

<text class="ks-annotation" x="30" y="150">The closed family is large: SSDT, Shadow SSDT, IDT and GDT hijacking via FWA-backed clones,</text>
<text class="ks-annotation" x="30" y="168">PTE repointing, and page-swapping supervisor data pages all end in the same step, and the</text>
<text class="ks-annotation" x="30" y="186">same step is the one HLAT removes. The open edges are different in kind: user-mode access</text>
<text class="ks-annotation" x="30" y="204">through remapped guest PTEs, and data-only attacks that never touch translation at all.</text>
<text class="ks-annotation" x="30" y="236">See the DOG profile for the family prediction this page's first row now carries.</text>

Bypass inventory

Why the inventory looks like this

HLAT is a single-purpose defense, and the inventory is wide at the top and open at the bottom for the same reason: it removes exactly one step, the supervisor-mode PTE redirection, and everything that ends in that step falls with it, while everything that never needed the step was never in scope. That shape is the site's whole thesis in one page: same Windows version, same HVCI checkbox, different silicon, materially different answers.

The practical reading for a defender: on a fleet of 11th-generation-and-newer Intel machines with VBS, the FWA-and-clone family and the page-swap class are closed pending a public falsification, and the remaining kernel threat is the data-only one, which no translation control addresses. On mixed or older fleets, both classes are live, which is the gap the bypass matrix expresses per build and per CPU.

What a defender sees

VBS and HLAT status per machine, reported alongside HVCI, is the health signal; the hardware floor means fleet age, not policy, decides coverage. A PTE edit attempt succeeding in user mode while kernel-mode redirection fails is the signature of HLAT doing its job while its documented edge stays open, and belongs in the same telemetry stream as the data-only detections.

Sources

Intel VT-rp and Microsoft's hypervisor documentation for the mechanism; Fortinet (FortiGuard Labs), "The Swan Song for Driver Signature Enforcement Tampering", and CryptoPlague, "The dusk of g_CiOptions", for the page-swap class; the Exploit Pack DOG series for the table-hijack family this page's first row predicts closed.