3 ms·
At the end of the day, you pretty much need a kernel mode agent that hooks a couple dozen syscalls, but it's largely doable if you have a team of engineers at y
by 13of40 10y ago
At the end of the day, you pretty much need a kernel mode agent that hooks a couple dozen syscalls, but it's largely doable if you have a team of engineers at your disposal. Malware detonation shops like FireEye do it.
- eps 10y agoGenerally - yes, but there's also (cpuid[1] & 0x80000000) test. https://en.wikipedia.org/wiki/CPUID#EAX.3D1:_Processor_Info_and_Feature_Bits https://en.wikipedia.org/wiki/CPUID#EAX.3D1:_Processor_Info_...