logoalt Hacker News

mcculleyyesterday at 4:35 PM2 repliesview on HN

Not just security. Instruction caches must also be aware of self-modifying code.


Replies

WalterBrightyesterday at 5:49 PM

Back in the 1980s, text editors had configuration files. The configuration file would be read every time the editor was loaded. This was very slow on a floppy disk system.

I realized that, instead of a configuration file, I could configure the executable instead! So, any changes in configuration meant the editor would patch its own exe file!

This marvelous technique came to an end when attempts to stop malware got folded into the operating system.

show 4 replies
inigyouyesterday at 5:27 PM

yes but it's easy enough to issue a cache flush when you modify the code.

The overhead of cache flushing means some old school techniques are no longer viable, like modifying a constant in the next instruction. However it is still interesting to write machine code snippets once and execute them many times, like the nested function trampolines. I had a case where I had RGB masks like R=0x00ff0000 etc (loaded at startup once) and wanted to convert 0x00rrggbb to match the mask (so no-op in the common case but not always) which could have involved setting the shift amounts in a series of shift instructions.

The Linux kernel uses self-modification to change branches depending on whether certain features are on. For example when a user-mode process starts tracing a certain function, it adds code to the beginning of that function to trace the call, otherwise it pads that space with a no-op. JIT compilers also make good use of knowing whether a class has any subclasses, which is statically unknowable in Java but dynamically knowable.

show 1 reply