Hardened Anti-Reverse Engineering System (HARES)

[deroko]

@Kerlingen: On x64 you may use hardware virtualization to catch int 0e, and of course, your vmenter can be redirected to code which will act as int 0e hook, thus implementing this on x64 is trivial In this scenario it doesn't really matter if it's old vmx which causes TLB to be flushed on vmexits or new which can preserve it, as anyhow physical page to which you want to access has P bit cleared in PTE and if TLB is flushed you come to your int 0e hook, only benefit which new vmx brings in terms of preserving TLB is just speedup in case of access to nonpaged code/data in kernel memory