Hacker News new | ask | show | jobs
by junon 1900 days ago
NOP on x86 is one byte. Patching out an instruction with a NOP is always possible.

Further, not all jumps are equal; while you can certainly patch the assembly and let the assembler manage the variant selection and relocations etc., doing bytecode patching is a different story. You might have to change the jump instruction altogether depending on how "far" away the pointer is.

Also, jumps hold conditions in most cases (the exception being an unconditional jump, JMP) which means that you have to adhere to whatever state is expected at that point in time.

The NOP approach is usually the soundest and safest.

1 comments

It's more general, but also more invasive. Replacing jumps with another jump as discussed in the article leaves part of the original intent (the test or the address) intact, while a NOP sequence leaves no indication of what it replaces.