> They'll push the scanning to the OS level I don't know if this is possible so ...

> They'll push the scanning to the OS level

I don't know if this is possible so easily. Does the OS scan the memory of all applications? How does it know what is text and image data?

What if it is encryped or even just obfuscated? Does the OS then track all changes of memory etc?

Or you think it'll just have a rolling keylogger so you can't type in s.th. malicious?

Everything a process does beyond touching memory is going through a syscall. The OS serves every key press to such a program.