PatchGuard is shown using CPU behavior around SYSCALL, MSRs, trap flags, and debug exceptions to spot when a hypervisor is hiding guest state. The good part is the mechanism detail, especially how LSTAR and #DB handling can leak the real control path when RDMSR and WRMSR are being polished for the guest.