---
id: 9942
title: "IUM-Debugger: Patching Secure Kernel to Enable Debugging of VTL 1 Isolated User Mode Trustlets"
source_domain: github.com
source_url: "https://github.com/Hanohov/IUM-Debugger"
published_at: "2026-05-06T09:43:08Z"
tags: ["windows", "red-team", "reverse-engineering", "kernel"]
phying_url: "https://phying.com/item/9942"
lang: en
---

# IUM-Debugger: Patching Secure Kernel to Enable Debugging of VTL 1 Isolated User Mode Trustlets

## Summary

The IUM Debugger is a Windows host-side utility designed to bypass Virtualization-Based Security (VBS) debugging restrictions. By leveraging LiveCloudKd's signed hvmm.sys driver to access guest physical memory from the Hyper-V host, it dynamically patches the debug-permission check in the running guest's live securekernel.exe image, enabling WinDbg to attach to and debug isolated VTL 1 trustlets such as LsaIso.exe and NgcIso.exe.

## Why it matters

Overcomes signature-enforced boot protections on securekernel.exe to unlock dynamic live debugging of Windows VBS trustlets (e.g., Credential Guard), greatly simplifying reverse engineering and vulnerability research against isolated secure enclaves.

## Intelligence Metadata

- **Sources:** github.com
- **Published:** 2026-05-06T09:43:08Z
- **Original:** https://github.com/Hanohov/IUM-Debugger
- **Phying News:** https://phying.com/item/9942