Hardware-assisted integrity monitor

A monitor machine comprising one or more processors, the monitor machine including:

• a network module configured to:
• receive a current memory state of at least one memory register acquired on a target machine operating in a system management mode session;
• receive a current CPU register state of at least one CPU register acquired on a target machine operating in the same system management mode session without leaving the system management mode session;
• and
• transmit the current memory state and the current CPU register state from the target machine operating in the same system management mode session without leaving the system management mode session;
• and
• at least one analysis module configured to:
• determine memory state differences between the current memory state and a preexisting memory state of the target machine;
• and
• determine CPU register state differences between the current CPU register state and a preexisting CPU register state of the target machine.

A non-transitory computer readable medium containing a series of system management mode computer readable instructions configured to cause one or more processors to perform a process comprising:

• entering a system management mode session;
• determining a current CPU register state of at least one CPU register while in the same system management mode session without leaving the system management mode session;
• determining a current memory state of at least one memory register while in the same system management mode session without leaving the system management mode session;
• and
• communicating the current CPU register state and the current memory state to a monitor machine while in the system management mode session.