www.alex-ionescu.

com
• Twitter: @aionescu
Example: Slack from Windows Store (File System )
 ▪ File System Virtualization
Helium ▪
(Wcsifs.sys, Wcnfs.sys)
Registry Virtualization
(Registry.sys + Native VReg)
▪ Runs on Host, Modifies Host
▪ “Application Silo”
▪
▪
Used by “Project Centennial”
Windows Bridge for Desktop
▪ Increasing amount of apps

▪ Object Manager Isolation ▪ “Server Silo”

Argon ▪
▪
Network Virtualization (Wnv.sys)
Isolated Service Session
▪
▪
Windows Server Container
Docker for Windows
▪ PID/TID Filtering ▪ Supported on Server SKU Only
▪ Runs on Base OS Image ▪ Not a Security Boundary

Runs on Host, Cannot Modify HVSI

Krypton
▪ ▪
▪ Base Image Created On The Fly ▪ Windows Defender Application
▪ Thin Hyper-V Partition Guard (WDAG)
▪ “Project Barcelona”

Argon w/ Base OS Image Windows Container

Xenon
▪ ▪
▪ Thin Hyper-V Partition ▪ Docker For Windows
▪ Supported on Client SKU
▪ Security Boundary / No Bounty
Applications in Server Silo see a different “OS”
https://docs.microsoft.com/en-
us/virtualization/windowscontainers/about/

https://github.com/moby/moby/