Maybe it injects itself using some hardware hooks, more or less the same way as described in this this previously submitted article: https://news.ycombinator.co

Maybe it injects itself using some hardware hooks, more or less the same way as described in this this previously submitted article: https://news.ycombinator.com/item?id=6393029 https://news.ycombinator.com/item?id=6393029 With such a hardware root-kit, it could be possible to detect other software root-kits by looking for patterns in memory and/or other suspicious behaviour.