USING VBS ENCLAVES FOR ANTI-CHEAT PURPOSES

Summary from the TLDR InfoSec newsletter

Virtualization-based security enclaves are a Windows 11 feature that allows code to be run in a Secure Enclave that runs at a higher privilege mode than the kernel. The author of this post decided to attempt to write a simple Pong game that would run the core game logic in a VBS enclave and only run the code to write the display and read keypresses in the user mode. The theory was that if a game could run in a VBS enclave, then an attacker would only be able to cheat if they hooked into the Windows boot chain before the VBS enclave was loaded. Ultimately, the author found that the performance and API limitations that result from using VBS enclaves makes it an infeasible option.