Is this protection really all that helpful? Surely there are functions you can call into the top of to do your diabolical deeds for you. It would be more help

Is this protection really all that helpful? Surely there are functions you can call into the top of to do your diabolical deeds for you. It would be more helpful if callers would store some machine specific hash of the function prototype and the function itself would check the hash, so that you could only redirect to calling a function with the right signature. But that would also increase the overhead further. Already this is bad enough that it makes jump tables unattractive (which is too bad, considering the usually jump tables have little to no risk of control flow redirection).