Is it possible to use a hypervisor to trap all ring0<->ring3 transitions (both 0->3 and 3->0)?


Yes, it is possible. I do not want to go into details as there are a lot of comprehensive material available online:

One of the techniques is to monitor execution of the kernel-mode entering code pointed by IA32_SYSENTER_EIP/IA32_LSTAR.

This site is temporarily in read only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .