We're running as a layer between the application and the operating system, for minimum intrusiveness -- yet, the operating system's actions are invisible to us, causing a few headaches in ensuring that we cover all user mode code that is ever executed.