Posted: Mon Nov 12, 2007 3:05 am
Hi,
If you insert bytes into the middle of a binary, then all absolute addresses where the target is after the insertion point need to be changed, and all relative addresses which cross the insertion point (e.g. a conditional branch that jumps over the insertion point) need to be changed.
There is 2 ways to avoid this that I can think of. The first way is to put a table of target addresses at the start of the binary, so that the table is always before any insertion point, and so that you only need to change that table itself rather than searching through code. This increases overhead because you end up using indirect addressing (e.g. "call [fixedAddress]" instead of "call targetAddress") and doesn't help much with instructions that use relative addresses (e.g. there is no "Jcc [fixedAddress]" instruction).
The other way is to use large amounts of padding so that you can replace the padding instead of inserting bytes. The only disadvantage here is the increased size (and related cache efficiency and disk bandwidth problems).
Cheers,
Brendan
There's 2 types of references - references that use absolute addresses and references that use relative addresses.Dkelly wrote:Actually it doesn't... (For the most part), and whomever can tell me why, I'll believe you've hand coded machine languageBrendan wrote:something as simple as inserting a few instructions into existing code would involve searching for all CALL, JMP and branch instructions and adjusting the target addresses,
If you insert bytes into the middle of a binary, then all absolute addresses where the target is after the insertion point need to be changed, and all relative addresses which cross the insertion point (e.g. a conditional branch that jumps over the insertion point) need to be changed.
There is 2 ways to avoid this that I can think of. The first way is to put a table of target addresses at the start of the binary, so that the table is always before any insertion point, and so that you only need to change that table itself rather than searching through code. This increases overhead because you end up using indirect addressing (e.g. "call [fixedAddress]" instead of "call targetAddress") and doesn't help much with instructions that use relative addresses (e.g. there is no "Jcc [fixedAddress]" instruction).
The other way is to use large amounts of padding so that you can replace the padding instead of inserting bytes. The only disadvantage here is the increased size (and related cache efficiency and disk bandwidth problems).
Cheers,
Brendan