If I have to guess, this part looks suspicious: ``` ret = mach_vm_region( process_port, ®ion_address, ®ion_size, VM_REGION_BASIC_INFO_64, (vm_region_info_t)&info, &info_count, &object_name ); ``` ((vm_region_info_t)&info). That seems like the parameter which address on stack is below our 'written' (so writing past it can do this), and it is suspiciously casted.