There are several methods. I've described some in this thread:

http://marc.theaimsgroup.com/?l=vuln-dev&m=101658483927663&w=2