If somebody tries to hot-patch an already-hot-patched function

Re:If somebody tries to hot-patch an already-hot-patched fun... by quotemstr on Thursday October 08, 2026 @12:08AM (#50001743)

Detours rewrites instructions at the start of the detoured function. Why should it know or care whether the instructions it's overwriting happen to be ones written by a previous detour? Why would you need to synchronize?

[ Parent | on HN ]

Re:If somebody tries to hot-patch an already-hot-patched fun... by dezgeg on Thursday October 08, 2026 @03:59AM (#50003048)

Doesn't the Microsoft implementation work by having nop instruction as the first instruction of the function, which can then be patched to a jump to the patched code, that finally jumps back to the original function past the NOP?

Naive implementation of this scheme doesn't allow stacking.

[ Parent | on HN ]

Re:If somebody tries to hot-patch an already-hot-patched fun... by Dwedit on Thursday October 08, 2026 @10:35AM (#50006310)

If you have the standard two-byte backwards jump pointing to a longer jump instruction, you also have another happy case for overriding it (just change the long jump).

Meanwhile, the Microsoft Detours library supports detouring other kinds of instructions at the beginning of a function. It's not exclusively for the 'two byte nop and blank space' thing.

[ Parent | on HN ]

Re:If somebody tries to hot-patch an already-hot-patched fun... by drdexebtjl on Thursday October 08, 2026 @08:12AM (#50004873)

[delayed]

[ Parent | on HN ]