In the general case, if you have deployed software which has to work in the face of an arbitrary, integrity damaging attack, you're going to lose. That's becau

In the general case, if you have deployed software which has to work in the face of an arbitrary, integrity damaging attack, you're going to lose. That's because the attackers get to test their arbitrary code execution against your widely deployed countermeasure (e.g. AV with heuristics, EMET, whatever) until they win. You are the Maginot Line, and they are XYZ. Funnily enough though, security through obscurity / unusual security measures do beat a lot of canned attacks. Regehr does cool work on software validation though - it might do what it says. I hope he jumps into this thread and tells us what's actually up :)