What is "hooksafe"

Hooksafe is a hypervisor-based light system that safeguards a computer's kernel from rootkit attacks.

It prevents thousands of kernel hooks in the guest operating system from being hijacked. This is achieved by making a shadow copy of all the kernel hooks at one central place and adding an indirection layer on it to regulate attempts to access the hooks. A prototype of Hooksafe was used on a Linux guest and protected nearly 6000 kernel hooks. It focuses on protecting kernel control data that are function pointers. It provides large scale hook protection with small performance overhead