1. A method comprising: on a virtual machine hosted by a physical device, running a program configured to execute one or more operations; at a virtual machine manager hosted by the physical device and configured to manage the virtual machine, monitoring execution of the program to detect an obfuscated trapping event that causes the virtual machine manager to take over operation of the program; and upon detecting at the virtual machine manager the obfuscated trapping event, performing, by the virtual machine manager, a specific operation that differs from an operation implied by static analysis of the program, wherein the virtual machine manager maintains a list of operations of the program that correlate with obfuscated trapping events, wherein the specific operation is known to the virtual machine manager prior to the program being executed and wherein the specific operation is an operation that the virtual machine manager would not otherwise perform as a result of executing the program.