Don stated
And you have to ensure that there is *no* way the
user can
execute code *before* your interpreter/virtual machine/etc.
gains control of the CPU. I.e., at the very least, you
need physical control over the machine. This isnt possible
in all cases (e.g., a consumer device!)
You can make it very difficult, though.
The X-box uses cryptographic hashes, the AS/400 uses completely undocumented (in the
public sphere)
hardware instructions.