[vardump]

You still need to store the write pointers somewhere. So this very quickly becomes a game of cat and mouse.

[saagarjha]

JavaScriptCore had an amusing scheme where they'd make an (executable) memcpy gadget with the address hardcoded, then throw away read permissions to that memory. So the pointer's address is thus not readable without modifying memory permissions.