News for hackers. Stuff that matters.

A comment on If somebody tries to hot-patch an already-hot-patched function. Parent comment

Re:If somebody tries to hot-patch an already-hot-patched fun... by dezgeg on Thursday October 08, 2026 @03:59AM (#50003048)
Doesn't the Microsoft implementation work by having nop instruction as the first instruction of the function, which can then be patched to a jump to the patched code, that finally jumps back to the original function past the NOP?

Naive implementation of this scheme doesn't allow stacking.

[ Parent | on HN ]
Re:If somebody tries to hot-patch an already-hot-patched fun... by Dwedit on Thursday October 08, 2026 @10:35AM (#50006310)
If you have the standard two-byte backwards jump pointing to a longer jump instruction, you also have another happy case for overriding it (just change the long jump).

Meanwhile, the Microsoft Detours library supports detouring other kinds of instructions at the beginning of a function. It's not exclusively for the 'two byte nop and blank space' thing.

[ Parent | on HN ]