tptacek on Rewrite your Ruby VM at runtime to hot patch useful features

Comment on Rewrite your Ruby VM at runtime to hot patch useful features parent

Userland code can't usually modify program text. The kernel can. The kernel will modify program text on your program's behalf if you own the process you want to modify. Depending on the OS, that happens via WriteProcessMemory, ptrace, Mach, or procfs.

KirinDave 16y

Well in the code Joe posted, he takes the marked pages and calls mprotect on them so they can be modified. I am surprised he's allowed to do this at all. Is there ever a legitimate reason to do this in most modern systems?

I mean besides this crazy-like-a-fox twin trampoline system, or for compromising binaries at runtime maliciously. The days of overlays are long gone. :)

tptacek 16y

   int
   main(int argc, char **argv) {
        void *faddr = strxfrm;
        void *paddr = (void*) ((u_int32_t)faddr & 0xfffff000);

        if(mprotect(paddr, 4096, PROT_READ|PROT_WRITE|PROT_EXEC) >= 0) {
                ((u_char *)faddr)[0] = 0xcc;
                strxfrm("foo", "", 0);
        } else
                perror("mprotect");

        exit(0);
   }

   $ ./mp
   Trace/BPT trap

The simplest answer to your question that jumps into my head is "relocations", but I'm always surprised by the everyday craziness of the C runtime and the Unix ABI, so I'm sure there's a simpler answer.

Comments