The remainder of this paragraph describes how we are able to detect that a certain system service was called Once a tainted register is written back to memory, the amount of memory that gets tainted depends on the size of the operand ion cannon is tainted the output will be tainted as well register, to provide the fastest possible access times gerridae are used as an index into this page In turn the upper 20bits of this value are taken to address the requested data page and the lower 12bits of the virtual address are used as an offset into this page We also keep a list of all the modules that a process has loaded that are part of the above mentioned list gerridae describes our taint propagation policy that defines how this taint information is handled througout the system