[axoltl]

I do vulnerability research. Those things would do the exact opposite of what you're aiming for. They'd be received with glee by mercenary spyware companies, _especially_ being able to load things into higher levels of privilege.

[notepad0x90]

that wouldn't be a problem, apple signs extensions. In windows land for example, there are ELAM drivers for security software, they don't just hand them out, you basically have to convince people at Microsoft you're one of the good guys, in person.

[axoltl]

It means more surface (both from extensions themselves and the loader code), relaxation of things like KTRR/CTRR (you now need to add executable EL1 pages at runtime), plus the potential for signing keys to leak (Finding enterprise signing keys even for iOS is fairly easy).

As far as Windows goes, https://www.loldrivers.io is a thing.

[transpute]

Trusted high-privilege components, whether first or third party, are targeted for exploitation.

[Too]

Crowdstrike showed us how good idea that was.