BEGIN:VCALENDAR
VERSION:2.0
PRODID:Data::ICal 0.24
BEGIN:VEVENT
DESCRIPTION:   'Title: Memory Laundering via Metal: What EDR Can't See on Y
 our Mac\n   Tags: DEF CON Official Talk | Demo 💻\n   When: Saturday\, A
 ug 8\, 10:00 - 10:30 PDT\n   Where: LVCCW Level 1 Hall 3 1007 (Main Track 
 2) and DCTV-2 - [1]Map\n\n   Description:\n\n\n\n   DEF CON Abstract\n   =
 ===============\n\n   Metal is Apple's GPU framework\, it replaced OpenGL 
 and is now the only\n   way to talk to the GPU on macOS. Among its buffer 
 types is\n   StorageModePrivate: memory managed entirely by the GPU. The C
 PU can't\n   read it\, write to it\, or map it into virtual address space.
 \n\n   macOS endpoint security scans process memory through mach_vm_region
 \n   and task_for_pid. Apple's own Endpoint Security framework watches\n  
  mappings via ES_EVENT_TYPE_NOTIFY_MMAP. None of them see\n   StorageModeP
 rivate buffers. Those pages live in GPU firmware page\n   tables\, allocat
 ed through IOGPUDevice in the IOAccelerator family\,\n   completely outsid
 e Mach VM. No API exists to let a security tool\n   inspect them from anot
 her process.\n\n   I turned this gap into a working evasion technique. Inc
 oming payload\n   gets XOR-encoded to destroy signatures\, staged through 
 a shared\n   MTLBuffer\, then blitted into private GPU memory via\n   MTLB
 litCommandEncoder on AGXCommandQueue. All CPU-side artifacts get\n   wiped
 \, volatile pointers\, _syncsynchronize barriers\, multi-pass\n   zeroing.
  At that point the data exists only in pages no process on the\n   box can
  read. When I need it back\, I reverse the blit\, decode\,\n   execute\, a
 nd wipe again. Total CPU exposure is milliseconds.\n\n   Tested on the lat
 est Apple Silicon hardware. 100% evasion. No\n   entitlements\, no kexts\,
  no root. Runs from a sandbox\n\n   Apple Metal Framework Documentation:MT
 LBuffer\,\n   MTLResourceStorageModePrivate\, MTLBlitCommandEncoder\n   ht
 tps://developer.apple.com/documentation/metal\n\n   Apple Endpoint Securit
 y Framework Documentation:\n   ES_EVENT_TYPE_NOTIFY_MMAP\n   https://devel
 oper.apple.com/documentation/endpointsecurity\n\n   Apple Silicon Unified 
 Memory Architecture: Apple Platform Security\n   Guide https://support.app
 le.com/guide/security/welcome/web\n\n   IOKit IOAccelerator Family: GPU dr
 iver interface for macOS kernel\n   subsystem https://developer.apple.com/
 documentation/iokit\n\n   SpeakerBio:  Hxr1\n\n   15+ years specializing i
 n Red Teaming\, Adversary Emulation\, and\n   Application Security. Proven
  track record executing advanced offensive\n   operations across enterpris
 e environments. Active contributor to the\n   cybersecurity community focu
 sed on evolving offensive tradecraft and\n   automating purple team capabi
 lities.\n\n   '\n\n   1. #LVCCW_Level1_Hall3\n\n\n
DTEND:20260808T173000Z
DTSTART:20260808T170000Z
LOCATION:DEF CON Talks - LVCCW Level 1 Hall 3 1007 (Main Track 2) and DCTV-
 2
SUMMARY:Memory Laundering via Metal: What EDR Can't See on Your Mac
END:VEVENT
END:VCALENDAR