1. One or more computer-readable media having computer-readable instructions therein that, when executed by a computing device, cause the computing device to perform acts comprising: identifying, from memory inaccessible by an entity operating within an operating-system privilege mode, a set of one or more resources of an operating system; and determining, from the memory, whether one or more of the set of one or more resources have been altered.