Hm, looking some traces of browser IPC to see if that can be used to communicate with a rootkit (since you're guaranteed context switches in many cases), and it seems like it's difficult to reliably trigger a context switch with registers containing at least a sum of 128 bits of arbitrary information, so I have to rethink this and consider if there may be a way to write a good "fuzzy" API that checks for data at each context switch without too much overhead. It'd have to be stateful...
A simple (but kinda dumb) idea would be to get the 8 LSBs or something of each register over a period of, say, 100 context switches, run them through some kind of ECC, and use that as a key (most of the rootkit is encrypted while in memory, so the key has to be cryptographic), but the overhead would be too easy to notice.
