Risks of RWX memory pages
After getting negative comments on this answer - can i implement counter in the .text area without using registers? , I performed a little investigation, trying to understand if RWX memory pages are really non-usual and rare thing, or every popular program has some. ( Science! ) I attached to MSVS by WinDBG, executed !address /f:Image,PAGE_EXECUTE_READWRITE , and I saw a lot of lines like this: 7a534000 7a537000 3000 MEM_IMAGE MEM_COMMIT PAGE_EXECUTE_READWRITE Image "C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\6836a951700c2eb01a933212425cda4e\System.ni.dll" I examined its sections,