This is caused by the self-modifying code: + /* Replace the ret by a nop */ + *(PCHAR)RtlPrefetchMemoryNonTemporal = 0x90; I guess we should have function where all self-modifying code is located in that takes care of page protections before and after modifying the code. - Thomas