Microsoft KB Archive/127904

{|
 * width="100%"|

How to Modify Executable Code in Memory

 * }

Q127904

-

The information in this article applies to:


 * Microsoft Win32 Application Programming Interface (API), included with:
 * the operating system: Microsoft Windows NT, versions 3.5, 3.51
 * Microsoft Windows 95

-

Follow the steps in this article to create self-modifying code; that is, to modify code pages while they are in memory and execute them there.

NOTE: Self-modifying code is not advised, but there are cases where you may wish to use it.

Step-by-Step Example

 * 1) Call VirtualProtect on the code pages you want to modify, with the PAGE_WRITECOPY protection.
 * 2) Modify the code pages.
 * 3) Call VirtualProtect on the modified code pages, with the PAGE_EXECUTE protection.
 * 4) Call FlushInstructionCache.

All four steps are required. The reason for calling FlushInstructionCache is to make sure that your changes are executed. As processors get faster, the instruction caches on the chips get larger. This allows more out of order prefetching to be done. If you modify your code, but do not call FlushInstructionCache, the previous instructions may already be in the cache and your changes will not be executed.

Additional query words: 3.50 4.00

Keywords : kbOSWinNT350 kbOSWinNT351 kbOSWin95

Issue type :

Technology : kbAudDeveloper kbWin32sSearch kbWin32API