"It works by utilizing special hardware features in 64-bit x86 processors to monitor and prevent device drivers or other kernel-mode software from modifying the Windows kernel itself." . . . .