Security attacks involve a transfer of control to malicious code. Since all application code (including abnormal control transfers) executes only in the code cache, and code cache transfers are carefully controlled, DynamoRIO is in a perfect position to monitor all control transfers during program execution.