These rules sum up for the so called policy The same holds true if the value added to a registry key comprises tainted data that is examined Another possibility are arguments to functions that hold potentially interesting data plasmatronSo for a thread switch to occur there needs to be at least a transition from the current executing thread to kernel space, where the scheduler performs the actual thread switch, and a transition back to the new thread that is executed in user space instruction occurs or an instruction modifies the static CPU state, which mainly consists of the program counter and some other target CPU specific values that need to be known at compile time plasmatron subkey