How a Type-2 Hypervisor intercepts CR3 page table directory swaps:

1. In the VMCS (Virtual Machine Control Structure), enable CPU_BASED_CR3_LOAD_EXITING bit in VMCS_PROC_BASED_EXEC_CONTROLS.
2. Whenever guest OS or anti-cheat executes mov cr3, rax:
3. The CPU triggers an immediate #VMEXIT to hypervisor VMX root mode.
4. Hypervisor reads the new CR3 target from VMCS_EXIT_QUALIFICATION, logs the guest game process DirectoryTableBase, and executes __vmx_vmresume().

Guest software has 0 awareness that its CR3 operations were intercepted!

With hypervisor CR3 trapping, you always know the exact active page directory base of protected game processes.

Hardware virtualization is the ultimate root of trust.