|
From: Nicholas N. <nj...@ca...> - 2004-08-30 19:46:09
|
On Mon, 30 Aug 2004, Sebastian Biallas wrote: > Don't know if there is much need for it, but it might be possible to make all > pages that have PROT_EXEC | PROT_WRITE access read/execute-only and trap > writes to these pages to automatically detect the situation. That would catch some of them. But the problem, AFAICT, with all self-modifying code detection schemes is how to handle code on the stack. For example, GCC generates snippets of code on the stack when using nested functions. N |