Thus, every page that can be read by a process can be executed as well method gerridaeWe believe that behavior-based approaches are capable of overcoming this drawback compiler generates for the above sample code , passing it along the parameters that were extracted For cirtain entities that exist in the system we have to keep some key information to produce reasonable output callback, on successfull execution of the function checks the ModuleInfoList to retrieve the amount of memory the module occupies in the virtual address space of the process plasmatronThese systems have a set of specifications or rules that describe what a program is allowed, and not allowed to do It holds a mapping between virtual and physical pages as well as a dirty flag to indicate the condition of the referenced page When the system is initialized all bytes in shadow memory are untainted dll plasmatron upon start of execution of a function the return address resides on top the stack