I love posts like this, but I think the authors would benefit from a close read of the Microsoft Detours paper, which runtime patchers have been cribbing from for the past 5 years or so.
The general Detours approach:
* Disassemble the first N bytes of a target location
* Scoop N bytes worth of opcodes out of the target, and re-host them somewhere heap-allocated
* Replace the N bytes with an absolute jump to a heap-allocated trampoline
* Bounce to your code
* Execute the scooped-up N bytes worth of opcodes
* Jump back to the target
This approach (what the post calls "caller-side trampolines") works well when your targets are function prologues, and less well when it's an arbitrary bblock.
We have an implementation in pure Ruby, complete with a pure-Ruby ia32 assembler (which is one of the most useful little pieces of code I've written) at Timur's Ragweed repository --- google "Ruby ragweed github".
Comments
I love posts like this, but I think the authors would benefit from a close read of the Microsoft Detours paper, which runtime patchers have been cribbing from for the past 5 years or so.
The general Detours approach:
* Disassemble the first N bytes of a target location
* Scoop N bytes worth of opcodes out of the target, and re-host them somewhere heap-allocated
* Replace the N bytes with an absolute jump to a heap-allocated trampoline
* Bounce to your code
* Execute the scooped-up N bytes worth of opcodes
* Jump back to the target
This approach (what the post calls "caller-side trampolines") works well when your targets are function prologues, and less well when it's an arbitrary bblock.
We have an implementation in pure Ruby, complete with a pure-Ruby ia32 assembler (which is one of the most useful little pieces of code I've written) at Timur's Ragweed repository --- google "Ruby ragweed github".