code pages are marked read-only, but there is no reason that you cannot jump to data pages. Programs when running under a debuger usually don''t actually have a proper protected code segment (that would be the debuger). Self modifing code is kewl, but my assembly is so rusty I really can''t give you many hints on how to actually do this. Is there a call EAX? In any event the usual way to do this is to copy a function to a space in your data segment/heap, load it''s entry point into a register, and call [reg]. As the subroutine is just in a data segment you can change it to anything you want.

Note that there probably are a lot of optimizations that the processor turns off when executing instructions from a non read-only segment. For example the I-cache cannot be used, nor does the D-cache do you any good, I don''t think you can fetch/decode and instruction from the D-cache.

Years ago the borland (and other) math libraries had some self modifiying instructions that would replace function calls to floating point libaries with the co-processor equivilents at load time. PPro''s had _great_ grief with these and you more or less had to recompile everything with the co-processor instructions forced.

People do this for copy protection as well, and win3.? beta''s had some self modifiying code that checked to see if you were running DR-Dos and then reported a cryptic error code, that if you asked micros~1 about it they said "oh thats TERRIBLE, ms-dos has been courrupted and become HORRABLY UNSTABLE, all of your data is probably courrupt"

this article has the details. Note that this is all real mode stuff, but it''s still an interesting little trick.

Under a protected mode environment , such as Windows and under modes such as DOS4GW I think too, code pages are read-only, and you get a GP Fault trying to mess with them. But otherwise no, they're writable.

And I can give you a hint into self-modifying code in assembly. It's actually a trick to simulate more variables than you actually have. It works like so: lets say eax has the value 12345678h, and you want to save that. The problem is the following funcions and interrupts require the use of all variables! In that case you'd lose 12345678h! Well its time to write to the code segment. Heres how:

    ...mov eax, 12345678hmov [byte ptr @point-4], eax..   ;Functions that use all variables.   ;located here.mov eax, 11111111h@point:...  

Basically, you tell it to move your value into the code segment at 4 bytes less than than @point. That would be right after the opcode, where a regular value in a mov statement would be located! And it works; insta-variable. Unless you're in protected mode, where you get a GP Fault instead . That's what I remember from way ago. Why not just push the value? I can't remember why it said to use this way over pushing. Can't remember if it's possible or not. Hope i gave some insight though.

Edited by - Zipster on April 23, 2001 3:52:43 AM

What is self modifying code? Is it when your programs writes new code(code that wasn''t there at compile time), and some how you make it execute this piece of code? If this is the case or in any case, why would you want or need to put self modifying code into your program?

What about buffer overruns? They''re the most common method to hack a program to execute arbitrary code and so far as I know they won''t cause a GPF/core dump/whatever on any major OS. Sure it''s a very limited form of modifiable code, but it works.