>Modification in the system calls are not that >covert: the DF bit can be detected as the change of >the address for the int 1's handler.

really DF bit? or it's mismatch and TF bit means.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/infocus/1828/34#34