Hypervisor cracks are not safe...

Before getting into this, I want to say I have nothing against these crackers and I'm just going off what I've read and know. My point is if this risk shows up, it's not just about trusting them anymore.

The risk comes in if the cracker behind the hypervisor tool decides to go malicious, or if some other threat actor gets into that OS from a bad download or exploit. With the hypervisor running at Ring -1, it's below the OS level. It sees all OS activity, but the OS and any AV can't detect it properly.

Dual boot doesn't keep things separate. Safe OS on SSD1 and the cracked OS on SSD2 are different areas in the same building. When you boot SSD2, SSD1 is still connected via the hardware. The hypervisor or any kernel-level code can ignore OS file systems and send direct commands to the drive controller to access or change sectors on any drive.

If the cracker decides to turn or another group sneaks in via any of the two OS, here's how dual boot fails. You boot SSD2 or SSD1 with Secure Boot and TPM off. The hypervisor loads at Ring -1, or other malware hits kernel level. It controls the CPU and hardware fully. It spots your safe drive easily. Then it drops code into SSD1's EFI partition since Secure Boot isn't checking signatures. You shut down, boot SSD1, and that altered EFI runs the code before the OS loads. Your OS is infected.

Secure Boot only allows signed code from trusted sources at startup. Without it, any unsigned code runs without blocks. TPM verifies if boot files changed. Off means no check for EFI tweaks. So if another group gets in through a download and gets kernel via BYOVD or other way, they can write to EFI partitions across drives without hardware stopping them. Both drives end up affected.

Only way to avoid this is to unplug the cable for your safe SSD when using the cracked one.

TLDR: based on how this works, dual boot leaves openings if the cracker changes or another actor gets in. And if Secure Boot/TPM is disabled, it makes it simple for them to spread to your safe drive. This is just based on my own knowledge on kernel. If I’m missing a hardware-level safeguard or if my understanding of isolation is off, please feel free to correct me.