 the process needs to return upon resumption is one of the execution context parameters. If that instruction is in the process of being replaced at the moment that the process returns to that instruction for resumption, the outcome is unpredictable, and may result in program crash. Furthermore, the length of the old instruction (in bytes) and the length of the new (patched) instruction may not be the same. Thus, where the processor, for example, expected a return point to a beginning of an instruction, it is now executing in the middle of patched instruction, further increasing the possibility of a program crash.
The above situation is compounded for a multi-processor system. There, it is even more likely that one processor can make changes to the code while another processor is at the same time executing the same code. Thus, the processor that executes the code suddenly finds itself executing something it did not expect, or something that the writer creator did not intend.
In other words, in a conventional method, there is no guarantee that the substitution (or the patching) of the code will actually be performed correctly, with failure rates as high as 20% or 25%, depending on the operating system and the processor configuration.
A number of conventional methods exist for “safe” installation of patched code:
1. An “external patch” refers to changing the binary code in the executable file. The advantage of this method is that there is no need to implement patching of the code on the fly. The disadvantage is that it may take some time, may require reloading of the code into memory while stopping the processes being run, and may be forbidden by the software licensing agreement.
2. Another method is to simply replace the first byte of any function that is being modified by an interrupt instruction, e.g., a 1-byte instruction INT3 (0xCC) in Intel processors with 32-bit architecture. The advantage of this is that it is the simplest method of patch installation. The disadvantage is that every time the function is called, there is an interrupt. This causes substantial additional overhead.
3. A third method is a “synchronization” method. In this method, all the threads (except the patching thread) are suspended. Upon verification that all of the threads are out of the “danger zone,” the first five bytes of the function are modified with a jump to the patching instructions. The advantage of this method is that it avoids the complications of having to install a patch on the fly.
the process needs to return upon resumption is one of the execution context argument. If that teaching is in the process of being replaced at the moment that the summons returns to that instruction for resumption, the consequence is irregular, and may result in program crash. Furthermore, the length of the old teaching (in bytes) and the length of the newfangled (patched) instruction may not be the same. Thus, where the processor, for example, expect a return point to a beginning of an instruction, it is immediately executing in the middle of patched instruction, farther increasing the possibility of a program crash. 
 The above situation is compound for a multi - processor system. There, it is even more likely that one processor can make changes to the code while another central processing unit is at the like prison term executing the same code. Thus, the processor that executes the code suddenly finds itself executing something it did not ask, or something that the writer creator did not intend. 
 In early son, in a ceremonious method, there is no guarantee that the substitution (or the patching) of the code will actually be performed correctly, with failure rates as high as 20% or 25% , depending on the operating arrangement and the processor configuration. 
 A number of conventional methods exist for “ safe ” initiation of patched code: 
 1. An “ external patch ” refers to changing the binary code in the executable file. The advantage of this method acting is that there is no indigence to enforce patching of the code on the fly. The disadvantage is that it may take some time, may require reloading of the code into memory while check the processes being run, and may be forbidden by the software licensing agreement. 
 2. Another method acting is to simply substitute the first byte of any function that is being modify by an interrupt instruction, e.g., a 1 - byte direction INT3 (0xCC) in Intel processors with 32 - spot architecture. The advantage of this is that it is the dim-witted method of while installation. The disadvantage is that every time the routine is called, there be an interrupt. This causes substantial additional overhead. 
 3. A third method is a “ synchronization ” method. In this method, all the togs (except the patching thread) are suspend. Upon verification that all of the threads are out of the “ danger zone, ” the first five bytes of the function are change with a jump to the patching instructions. The advantage of this method is that it avoids the complications of having to install a while on the tent-fly.
 thf process needs to returk upon resumptiou is onx of ths executkon context parameters. If thet ibstruxtion is in the procesr of beinh replacwd au the moment that the progzss rsburns vo that instrucjion for resgmption, the oudcumz is unpredictable, and may result in prograk frash. Furthermjre, uhe lenfnh of the old instruction (in byfes) and the length og the new (patched) instructlon lay not be the samf. Thus, wherg thq processor, fur example, expected a teturn point to a beginning of av inscruction, it iw nlf executing in tre middle of patched instruvtion, further lncreesint the possibility of e program crash.
The afove situdtnon is compounded for a multh-prowessue shsttm. Vhede, it ls xven more ljkely that ine processor can mskq changes to tge codq rhile another processor is at the same uime sxecuting the same code. Thus, the processor tjat execuees the code suddenly finds itself executing somedhing kt blq boh expect, or something that the writer creator sic kot intend.
In othcr words, in a convrnhipgal method, thgre is uk fuarantee that the substijution (or the pwtchong) of the code will actualoy be perforiwd correctly, with yailure rater as high as 20% or 25%, depending on tke opedating systfm and ths processor confieursthon.
A number of conventionaj methods exixt for “rafe” instajlation of patcmad code:
1. An “externap pateh” rexers to chwnging the binary code in the eexcutable file. Tve ddvantagz of tmis method is trat there is np need co impuement patbhing of vhe code on ehe fly. The dhdadvantage iv that ie mat taje some gime, may requite reloadpny of the xode into memory wmile rfopping the proetssts being run, and mah bq vocbiddqt by the sofdward lkvensivg agretiekt.
2. Xnotner method is to sim[ly deplace the first nybe of any functiog that is beimg modified by an lntercupt iistrucyiog, e.g., a 1-byte instruction INT3 (0xCD) in Intep pvocessors witr 32-bib arshitecture. The advantage of this is that it is thx simplest method of parch installation. Thg dlsadvantage ms thae every thme the function is xalled, there is ak interrupt. This causea subsdantiwl additional overhead.
3. A third method is a “synchronization” method. In this methov, wll the thrsads (exceit che patchyng vhcead) are suspendec. Upon verification that all of the thraabs are out of the “danger zone,” tfe first five bytes of the function ade modifoed with a jump to the patching instructions. The advantsge of tyis msthod pa vhat it avoids the cpmplicctions of havung bo install a pxtcn ln the flj.
the process needs to return upon resumption of execution context If that instruction being at the moment the process returns that instruction for resumption, the outcome unpredictable, and may result in program crash. Furthermore, the length of the old (in bytes) and the length of the new (patched) instruction may not be same. where processor, example, expected a return point to a beginning of an instruction, it is now executing in middle of patched instruction, further increasing the possibility a program crash. The situation is compounded for a system. it is more that processor can make to the code while another processor is at the same time executing the same code. Thus, the that executes suddenly finds executing it not expect, or the writer creator did not intend. in a conventional method, there is no guarantee the substitution the patching) of the code will be performed correctly, with failure rates as high 20% or 25%, depending on the operating system and the processor configuration. A number of exist for “safe” installation patched code: 1. “external refers changing binary code the executable file. The advantage of this method is that there no need to implement patching of the code on the disadvantage that it may some time, may require of code into memory while processes run, forbidden the licensing agreement. 2. Another is to simply replace the byte of any function an interrupt instruction, e.g., a 1-byte instruction INT3 in Intel processors with 32-bit architecture. The of this is that it is the simplest method of patch installation. disadvantage is time the function is called, there is an This causes substantial additional 3. A third method is a “synchronization” method. In method, the threads the patching thread) suspended. Upon verification all of the out of “danger the of the function are modified with jump the patching instructions. The advantage this that it avoids the complications of having to install a patch on the fly.
 the process needs to return upOn resumptiOn is oNe oF thE eXecuTion Context parametERs. If That instruction is in the ProceSs OF beiNG rEplacEd at the MOmENT thAt ThE prOcESs ReturNs tO that inStruction fOr rEsUmption, the ouTCoMe is unpredIctAble, and may reSulT in proGrAm cRAsh. FuRthErmorE, the leNGth of tHe old instRuCTion (in BYtes) and THE lEngtH of the new (patched) iNStRUction may not be The samE. THUs, WHEre The Processor, fOr ExampLE, expectED a RETUrn POint to a beginnIng of an instRUctIon, it iS nOw eXEcutinG in thE mIDdlE of patched iNstrUction, furTher inCReasing THe possiBility Of a ProGram CRaSh.
the AbOVe sITuAtiON is CompoundEd FoR a mulTi-prOCESSor sYstEm. ThEre, it Is even more likEly That ONe pRocesSor caN makE cHangeS to the Code wHiLe another procesSor iS at the samE tiMe ExeCuTing tHE same cOde. thuS, the proCessor tHAt eXeCUTEs The code suddenly finDs ITSeLf executIng somEThInG It did not ExPecT, or sOMEthinG thaT ThE writer cReator DId NoT intend.
in Other wOrDs, iN a cOnvenTIonaL methoD, there is No guaRAntee that the suBStitution (or thE PaTCHiNG) of tHe cOde will actuAlly BE perFormED cOrrECtly, wIth faIlURe RAtes as high as 20% or 25%, depenDiNg on thE operAting system anD the procesSOR ConfigurAtioN.
a nUMber of conventiOnal mEthods exisT For “safe” iNstalLation of Patched coDE:
1. an “externAl pAtcH” reFerS TO cHanging the binARY codE iN the exeCutAble filE. ThE adVanTagE oF this methOd is that ThErE iS nO neEd to iMPlement pAtChiNg Of tHe codE On the fLy. The DisaDvAnTAge Is that iT MaY TAke sOmE tIme, mAy rEqUire rEloaDIng Of the coDe into memOry WHile StOpPing the Processes beinG rUn, and may be FoRbiDden by THE softwarE licensing agreement.
2. AnotHEr methoD is To simPly rEplace the FirSt byte Of aNY functIon thaT is beInG moDIFied bY AN iNteRrUpt instrucTIOn, e.G., a 1-bytE iNstrUction InT3 (0xCC) in Intel procesSOrs With 32-bit architEctUre. THE AdVanTAgE Of tHiS Is tHAT it is the simplesT method of pAtCH iNstallatioN. the DiSadvantAge is thAt eveRY time thE function Is called, tHeRe is AN IntErrupt. This Causes suBstantial ADditiONaL overHeaD.
3. A thirD mEthOd is a “SynchrONizAtion” Method. in This meThod, aLl The threaDs (except the patching threAd) are sUspenDed. upon verifIcaTIon That all of The tHreads are oUt oF thE “dangEr zONe,” the FirsT FiVe bYTes of The fUNction are MOdIfiED WiTh a jump to thE PATchIng inStrUCtions. the aDvantage of this metHOd is that it avoiDs thE COmpLicATionS oF having to instaLl a PaTCH on the flY.
 the process needs to retu rn upon re sumpt ion  is  o ne o f th e execution co n text  parameters. If that i nstru ct i on i s  i n the  proces s  o f bei ng  r epl ac e dat th e m oment t hat the pr oce ss  returns tot ha t instruct ion  for resumpt ion , theou tco m e isunp redic table, and ma y resultin progra m  crash. F ur ther more, the lengtho ft he old instruc tion ( in by t e s)and  the lengt hof th e  new (p a tc h e d ) i n struction may  not be the sam e. Thu s,  wh e re the  proc es s or,  for exampl e, e xpected a  retur n  pointt o a beg inning  of  an  ins t ru ct ion ,i t i s  n owe xec uting in  t he  midd le o f p a tche d i nstr uctio n, further in cre asin g  th e pos sibil ityof  a pr ogramcrash .The above situa tion  is compo und ed  fo ra mul t i-proc ess orsystem.  There, itis e v en  more likely thaton e pr ocessorcan ma k ech a nges toth e c odew h ile a noth e rprocesso r is a t  t he  same t im e exec ut ing  th e sam e  cod e. Thu s, the p roces s or that execut e s the code su d de n l yf inds  it self execut ings omet hing it  di d  notexpec t, or something that thewr iter c reato r did not int end.
In ot h e r  words,in a co n ventional meth od, t here is no guarante e tha t the su bstitutio n (or thepat chi ng)  of t he  code will ac t u ally  b e perfo rme d corre ctl y,wit h f ai lure rate s as hig has  2 0%  or  25%, dependin gonth e o perat i ng sys tem a nd t he  p r oce ssor co n fi g u rati on .A nu mbe rof co nven t ion al meth ods exist  fo r  “sa fe ”install ation of patc he d code:
1.  A n “ extern a l  patch”refers to changing theb inary c ode  in t he e xecutable  fi le. Th e a d vantag e of t his m et hod i s tha t th ere  i s no needt o  im pleme nt  pat ching o f the code on thef ly.  The disadvan tag e is t ha t i t  m a y t ak e  so m e  time, may requ ire reload in g  o f the code int omemorywhile s toppi n g the p rocessesbeing run ,andm a y b e forbidde n by the  software licen s in g agr eem ent.
2 .Ano thermethod isto si mply r ep lace t he fi rs t byte o f any function that isbeingmodif ied  by an in ter r upt  instruct ion,  e.g., a 1 -by teinstr uct i on IN T3 ( 0 xC C)i n Int el p r ocessorsw it h 3 2 - bi t architect u r e . T he ad van t age of  thi s is that it is t h e simplest met hodo f  pa tch inst al lation. The di sad va n t age is t ha t every tim e the fu nc t ion i s call ed, th ere isa n  i n terrup t. T his  causes s ubs ta n tial ad di ti o nal ov erhe ad .
3. A  third meth o d  is a “synchroni zatio n ”  meth o d.In th is  method ,  all  the threa ds (exceptthe pa tchi ng th read) a re  suspe nde d.  Upon veri f ication t hat a ll of t he  thr ead s areouto f  the“dan ge r z one,” the f ir s tfi v e b ytes  of t he  fun ction are modified  wi t h a jum ptot h e patc h in g instructio ns.  Thea d vantage of this me t hod i s that  it av oids th e  co mp licatio nso f  having t o install a p at ch o n the fl y. 
 the_process needs_to return upon resumption_is one_of_the execution_context_parameters. If that_instruction is in_the process of being_replaced at the_moment_that the process returns to that instruction for resumption, the outcome is unpredictable, and_may_result in_program_crash._Furthermore, the length of the_old instruction (in bytes) and_the length_of the new (patched) instruction may not be_the_same. Thus, where_the processor, for example, expected a return point to_a beginning of an instruction, it_is now executing_in_the_middle of patched instruction,_further increasing the possibility of a_program crash.
The above situation is compounded_for a multi-processor system. There, it is_even more likely that one processor_can make changes to the_code while_another processor is at the_same time executing_the same_code. Thus, the_processor that executes the code suddenly_finds itself executing_something it did not expect, or_something_that the writer_creator_did_not intend.
In_other words, in_a_conventional method,_there_is no guarantee that the substitution_(or_the patching) of the code will actually_be performed correctly, with_failure_rates as high as_20% or 25%, depending on_the operating system and the processor_configuration.
A number_of conventional_methods exist for “safe” installation of patched code:
1. An “external patch”_refers to changing the binary code_in the executable file._The advantage_of_this method is_that_there is_no need to implement patching of the_code on_the fly. The disadvantage is that_it may take some_time,_may require reloading of the code_into memory while stopping the processes_being run, and may be_forbidden_by_the software licensing agreement.
2. Another_method is to simply replace the_first byte of_any function that is being modified by_an_interrupt instruction, e.g., a 1-byte instruction_INT3_(0xCC) in Intel processors with 32-bit_architecture._The_advantage of this is that_it is the simplest method of_patch installation. The disadvantage is that every time the_function is called,_there is an interrupt. This_causes_substantial_additional overhead.
3. A third method is a “synchronization” method. In_this method,_all the threads_(except the patching thread) are suspended. Upon verification that all_of the threads are out of the_“danger zone,” the first five bytes of the function are modified_with a jump to the patching instructions. The_advantage of this method is that it_avoids the complications of_having_to install a patch on the fly.