Thread: 64 bit drivers / process mangement
View Single Post
  #4  
Old 08-01-2013, 23:33
TheSwash
 
Posts: n/a
Quote:
Covertness: Changing the value of the IA32_SYSENTER_EIP MSR can be detected. For example, PatchGuard currently checks to see if the equivalent AMD64 MSR has been modified as a part of its polling checks.
Source

Regards!
Reply With Quote