One or more tangible computer-readable media storing non-transitory computer-executable instructions that, when executed by a processor of a device, implement a virtual machine monitor, VMM, to: enable an untrusted application and a trusted application, TA, to run on top of a single operating system, OS, while preventing the untrusted application from accessing memory used by the trusted application, by: using a first extended page table, EPT, to translate a guest physical address, GPA, into a first host physical address, HPA, for the untrusted application; and using a second EPT to translate the GPA into a second HPA for the trusted application; wherein the first and second EPTs map the same GPA to different HPAs; the untrusted application to run on top of the OS in a virtual machine, VM, in a rich execution environment, REE; and the trusted application to run on top of the OS in the VM in a trusted execution environment, TEE, that prevents the untrusted application from accessing memory used by the trusted application; and wherein the instructions, when executed, further implement a platform protection technology, PPT,, to: generate a secret cookie value, SCV, for the trusted application; save the SCV to a PPT data structure associated with the trusted application; patch the SCV into trampoline code that provides for transferring control from the untrusted application to the trusted application; in response to the untrusted application calling the trusted application, before allowing the trusted application to execute, determine whether the trampoline code and the PPT data structure contain matching SCVs; allow the trusted application to execute only if the trampoline code and the PPT structure contain matching SCVs; before allowing the trusted application to execute in the TEE, create a dump buffer in the TEE; in response to a fault during execution of the trusted application, saving fault data from the TEE to the dump buffer; and sharing the dump buffer with the REE. enable an untrusted application and a trusted application, TA, to run on top of a single operating system, OS, while preventing the untrusted application from accessing memory used by the trusted application, by: using a first extended page table, EPT, to translate a guest physical address, GPA, into a first host physical address, HPA, for the untrusted application; and using a second EPT to translate the GPA into a second HPA for the trusted application; wherein the first and second EPTs map the same GPA to different HPAs; using a first extended page table, EPT, to translate a guest physical address, GPA, into a first host physical address, HPA, for the untrusted application; and using a second EPT to translate the GPA into a second HPA for the trusted application; wherein the first and second EPTs map the same GPA to different HPAs; the untrusted application to run on top of the OS in a virtual machine, VM, in a rich execution environment, REE; and the trusted application to run on top of the OS in the VM in a trusted execution environment, TEE, that prevents the untrusted application from accessing memory used by the trusted application; and wherein the instructions, when executed, further implement a platform protection technology, PPT,, to: generate a secret cookie value, SCV, for the trusted application; save the SCV to a PPT data structure associated with the trusted application; patch the SCV into trampoline code that provides for transferring control from the untrusted application to the trusted application; in response to the untrusted application calling the trusted application, before allowing the trusted application to execute, determine whether the trampoline code and the PPT data structure contain matching SCVs; allow the trusted application to execute only if the trampoline code and the PPT structure contain matching SCVs; before allowing the trusted application to execute in the TEE, create a dump buffer in the TEE; in response to a fault during execution of the trusted application, saving fault data from the TEE to the dump buffer; and sharing the dump buffer with the REE. generate a secret cookie value, SCV, for the trusted application; save the SCV to a PPT data structure associated with the trusted application; patch the SCV into trampoline code that provides for transferring control from the untrusted application to the trusted application; in response to the untrusted application calling the trusted application, before allowing the trusted application to execute, determine whether the trampoline code and the PPT data structure contain matching SCVs; allow the trusted application to execute only if the trampoline code and the PPT structure contain matching SCVs; before allowing the trusted application to execute in the TEE, create a dump buffer in the TEE; in response to a fault during execution of the trusted application, saving fault data from the TEE to the dump buffer; and sharing the dump buffer with the REE.