Hacker News new | ask | show | jobs
by HelloNurse 1904 days ago
Changing JZ into JZ to the following address has the advantage of ease of editing: same length, same opcode, reliably copied, pasted and inspected value. A NOP sequence is more general but making it the wrong length is not impossible.
1 comments

NOP on x86 is one byte. Patching out an instruction with a NOP is always possible.

Further, not all jumps are equal; while you can certainly patch the assembly and let the assembler manage the variant selection and relocations etc., doing bytecode patching is a different story. You might have to change the jump instruction altogether depending on how "far" away the pointer is.

Also, jumps hold conditions in most cases (the exception being an unconditional jump, JMP) which means that you have to adhere to whatever state is expected at that point in time.

The NOP approach is usually the soundest and safest.

It's more general, but also more invasive. Replacing jumps with another jump as discussed in the article leaves part of the original intent (the test or the address) intact, while a NOP sequence leaves no indication of what it replaces.