1. A method, performed by one or more computers, comprising: receiving a native code module for an ARM 64-bit instruction set, wherein: the instruction set comprises a plurality of types of store instructions; one or more of the plurality of types of store instructions are forbidden instructions; and the native code module comprises one or more store instructions; loading the native code module into a secure runtime environment, wherein an address space of the secure runtime environment is divided into a plurality of regions, and wherein one of the regions is a write area; validating the native code module, comprising: verifying that no reachable store instruction in the native code module is a forbidden instruction; and verifying that, for each reachable store instruction in the native code module that uses a 64-bit base register, the 64-bit base register used by the instruction is masked by one or more diffuser instructions; defining a first write area buffer zone above and adjacent to the write area; defining a second write area buffer zone below and adjacent to the write area; determining that a first reachable store instruction in the native code module has an extended register offset, wherein a destination address of the first reachable store instruction is determined as a sum of an address contained in a first base register and a scaled 32-bit offset value contained in a first 64-bit offset register; and determining that each write area buffer zone is at least 16 gigabytes in size.