Model-specific Registers

Intel processors support a special category of processor-specific registers known as Model-specific Registers (MSRs). MSRs provide software with the ability to control various hardware and software features. Unlike other registers, MSRs are tied to a specific processor model and are not guaranteed to be supported in future versions of a processor line. Some of the features that MSRs offer include enhanced performance monitoring and debugging, among other things. Software can read MSRs using the rdmsr instruction and write MSRs using the wrmsr[23].

This subsection will describe some of the MSRs that may be useful in the context of a local kernel-mode backdoor.

• IA32_SYSENTER_EIP