So how does EMET prevent me from setting up the registers and directly calling NT kernel by executing SYSENTER&#x2F;SYSCALL instruction, completely bypassing ntdll.dll and other (native) libraries?<p>I&#x27;m sure there&#x27;s some sort of mitigation, curious to learn what. Otherwise EMET would be pretty useless, right?<p>&quot;x86 Instruction Set Reference, SYSENTER, Fast System Call&quot;:<p><a href="http:&#x2F;&#x2F;x86.renejeschke.de&#x2F;html&#x2F;file_module_x86_id_313.html" rel="nofollow">http:&#x2F;&#x2F;x86.renejeschke.de&#x2F;html&#x2F;file_module_x86_id_313.html</a>