Thank you for checking. I wonder if there's any more general solution to the problem of "I don't know whether this is evil code". Checksumming all storage seems a good one. If only it were possible to inspect all system calls and make sure none made permanent changes. I wonder what the state of research is on statically proving assembly code to be non-self-modifying. If so, maybe it'd be possible to prove that certain classes of actions aren't taken (i.e. writing to video BIOS, etc.)
I also did before and after snapshots of the registry and file system. As with any normal boot, there were some minor changes to both, but nothing that stood out particularly. A checksum of the hard drive would of course be different after every boot, with or without Kon-Boot.
