"More trouble than it's any reasonable person would have expected it to be worth" turns out to be a pretty good description of modern exploit development. For instance, from Derek Soeder:<p><i>The author's proof-of-concept exploit uses this technique to implement a six-stage approach, comprising: (1) the replacement INT 10h handler, a tiny, low-byte arithmetic / PUSH / Jcc sequence that computes the offset of the next stage, pushes it, and branches to a nearby RET, RETF, or IRET; (2) a larger, low-byte sequence stored over the 8x8 graphics font table (hopefully in video BIOS ROM pointed to by the INT 1Fh vector) that computes the bytes of the next stage, pushes them onto the stack, and branches to a nearby RETF or IRET; (3) a small, base-64-like decoder that decodes and executes the next stage, which was also stored in the font table; (4) a loader that reads the subsequent stages into RAM from the "guestinfo" database via the VMware backdoor interface, decodes them, and executes the next stage; (5) the main V86-mode payload, which prepares the next stage to execute in ring 0 using the appropriate, aforementioned HAL or NTOSKRNL infiltration technique; and (6) the main kernel payload, which creates an interrupt gate for convenient kernel access and cleans up the environment so that execution can resume without crashing. The Win32 portion of the exploit can then use the interrupt gate as needed.</i><p>(This is, of course, art, and it's hanging on the wall in our Chicago office.)