Back in the olden Mac Plus days, I used a disassembler/monitor/mini-assembler called TMON[1] that allocated a chunk of otherwise unused memory - 256 bytes, I think, called "PlayMem".
Since linking on a Mac Plus took upwards of 11 minutes for our project, I'd would typically replace any particular line with a JMP $PlayMem to patch up whatever registers or memory wasn't right, and then jump back into the middle of the routine.
Oh, and then there was Steve Jasik's "The Debugger"[2] which would let you crash and then switch to a (capabilities limited) MPW environment to let you edit and re-link individual routines which it would then hot-patch back in place. I think for that one, he actually shipped own linker, which was a hand patched copy of Apple's.
Life in 24 bits of flat address space was more fun. Shorter, but more fun.
[1] http://www.mactech.com/articles/mactech/Vol.01/01.10/TMONDeb...
To change the configuration, the program would write new values to the struct, and then patch the executable. Since I knew how to find the offset of the struct instance in the executable based on the runtime address of the instance, this was easy.
The big advantage to this was speed - being on floppy disk systems, having to do a file lookup/read was very slow.
Sadly, what killed this technique was when antivirus software appeared and decided that an executable patching itself was malware.