PatchGuard is shown using a temporary LSTAR rewrite and a forced syscall path to expose naive hypervisor syscall hooks. The writeup is worth clicking for the mechanics, especially the read and write shadowing problem around MSR_LSTAR and the trap-frame trick for recovering the real syscall handler address.