Dynamic File Analyser for Hostile Code

you can detect it by looking at the IDT base address too

usually it is 0x80...... and on VPC/VMWARE it is 0xF.... or 0xE.... etc

RDTSC can also be catched, with a driver.
one can activate some flag in control registers to do that.

I suppose one could write a driver to avoid detection by such instructions.
Anyone ever tried?

{Edit by JMI: Line79 you DON"T get to increase your post count by posting TWO separate posts, 2 seconds apart. ]

Edit by Me: Rofl bullshits, i don't give a flying f... of my post count