aaron foo wrote: > guess can do this by some how finding and jumping to an exit point > in the currently executing trace`s MCode but then the state will be > messed up anyway. maybe the cleanest fix would be to map something > real to the address space then wait for the hook to get executed. IMHO that doesn't look like a reasonable approach. Why don't you check the access bounds instead? It's not that costly. --Mike