An explanation attempt: This demo consists of actually two programs. A test loop, which gets exploited and the malicious code. The test loop needs to run until

An explanation attempt: This demo consists of actually two programs. A test loop, which gets exploited and the malicious code. The test loop needs to run until patched. It is completely running from the cache. When the exploit runs, it modifies the 4 first bytes of the cached loop into 4 NOPs via the cache exploit. When the change happens, the exploit is successful. This test code is save for c2d users to try. It just checks, if the cache modification is possible. A real exploit would combine this with other explotation code and would change the machine code of the test loop into a jump or a call. The real scary part of this is, that it is possible to patch code despite of access rights. If the loop is really changed, I have no doubt that this can be made into an effective exploit.