Comment by fooker

Comment by fooker 10 months ago

2 replies

In software terms, this would be as difficult as switching out specific bits from a running program to fix bugs.

Certainly not impossible, but impractical as far as we can see.

dustingetz 10 months ago

that’s pretty much how windows update works (or used to work) to attempt to hot patch certain things without a reboot. Compiled functions in windows DLLs have a 5 byte prologue of nop instructions which is just long enough to overwrite with a jmp instruction to hook the function call and redirect it. https://devblogs.microsoft.com/oldnewthing/20110921-00/?p=95... In WinXP they started compiling this nop prologue in on purpose due to how useful it was. Before that, reverse engineers would need to get a bit lucky and find “room” for a jmp in some code path that was guaranteed to hit, in order to patch an executable without crashing it (iirc, i’m fuzzy on the details). Anyway, certainly not impossible, and we’d al be surprised by what can be made practical if the need is great enough.

  • robocat 10 months ago

    > 5 byte prologue of nop instructions

    Has this been around long enough that CPUs optimise it out?

    I presume there is a long list of CPU optimisations that are specific to the quirks of Windows object code . . .