I would like to leave the 0day behind for now and just stare! The patch is just beautiful. Active patching in memory, no static address... rather generic patching in memory, searching for several signatures. Beautiful work from Gil Dabah. Take a look: http://zert.isotf.org/advisories/zert-2007-01.htm Gadi.