Hi&nbsp;Yuanhao,<br /><br />1) The code comments and copy code suggest that the stacks are located low and the function is located high (good). However, the&nbsp;<span style="white-space: pre-wrap;">SetMemorySpaceAttributes() call un-XP's Address, which is the low address. So, do I misunderstand the changes, or are you un-XP'ing the first stack (and keep the function XP'd)?<br /><br />2) The same </span><span style="white-space: pre-wrap;">SetMemorySpaceAttributes() call, you now pass </span><span style="white-space: pre-wrap;">ApLoopFuncSize over</span><span style="white-space: pre-wrap;"> </span><span style="white-space: pre-wrap;">ApSafeBufferSize. The latter was explicitly page-aligned, while the former is not. How is it guaranteed it is indeed aligned? If it is not, I don't think this is supported, at least universally.<br /><br />3) Similar to 2), the stack size is much smaller than the page size, no? How do you guarantee the function is on a page boundary for memory protection?<br /><br />4) A proper W^X flow should be to wait with un-XP till the CopyMem() for the </span><span style="white-space: pre-wrap;">function code has returned. Right before that, the copied code should be marked read-only.<br /><br />Best regards,<br />Marvin</span>