Oh yeah... I see... won't bite... :-)
But not with two bytes.
Could you please point me to one of these kinds of attacks that
worked outside of a lab, i.e. made it into a piece of malware that
Two years from now, future hardware will be current hardware.
No without restricting existing legitimate applications.
Yes, but people like to play computer games! I remember days where
it was not unusual to on-the-fly compile some critical inner loop
code onto the stack and execute it there. Used to be the
politically correct alternative to self-modifying-code.
Yes but it is the way it is and cannot be changed easily (see above)
AFAIR, since Windows is sharing code sections between processes,
these ARE read only (via page protection)
Funny, I was suggesting that in a different post. Especially since
it seems easy to implement, like 5 lines of code in CreateThread or
one of its parent functions.
A kernel mode driver is a kernel mode driver and any protection
that is implementted at that level only can serve bug checking, not
I was proposing a solution that realistically may be implemented
with what's there. Should-have's describe problems, they don't
Older ones still would be immune, because JMP ESP would not work
the way the attacker intended. Crashing systems don't spread
Is this assessment backed up by actual knowledge or just a
guesstimate, like mine?
Thanks for the suggestion!