still surprised that after working on Unicorn (uses QEMU engine, but with Python API to CPU instruction set and register set, useful for malware analysis) that the Intel TLB invalidate cache doesn’t work if the immediate address points to within its opcode’s own tiny operands.

Bah! A foolproof detector of being at virtualization within guest level is to use XOR opcode with Gx operand; and witness no change of its self-modified operand.