g for describing the action of labeling data that comes from untrusted sources or in more general data which we deem interesting and thus want to track through the system plasmatronThus at the beginning of the execution of every translation block the instruction pointer is used as a key into this hash map and the corresponding callback is executed if a call to a system service is detected To enable the guest to reach the Internet, or whatever network the host might be connected to, one might provide routing services on the host or simply bridge the tap interface with the physical interface of the host To this end we also implemented the possibility to call a trap function whenever a read or write operation on memory occurs ion cannondll, we had the entry points that are used to invoke the system services This is possible because we discovered a more recent version of the spyware for which no signatures exist yet are processes that are always started and are not under the authority of the service control manager we would need to extend the policy to include the status flags registers , names of DLL files that are under investigation ion sourceA compile time option is provided that configures this to only happen when tainted data is involved in the memory access