nope, at least I know about Windows and GMER, you can dynamically get REAL SSDT address from ntoskrnl.exe and you can't modify ntoskrnl.exe itself while OS is running and I'm not talking about MBR rootkits and most sophisticated codes to modify ntoskrnl.exe without causing BSOD and crash. So I think something similar should be possible for Linux too, like checking for real address in kernel code online from kernel.org etc. I think it's possible, at least in windows, what do you think about Linux now? —
user3404070 9 mins ago