Hacker News Reader

Comment by saagarjha | Hacker News Reader

The real issue with self-modifying code is that it's basically a security bug waiting to happen, plus you have other complications like having to flush the instruction cache on architectures like ARM. Generally, the benefits are not worth it unless except for very specific cases.

View on HN

I've seen points like these made before, but never really understood how. Can you give an example of self-modifying code becoming a security issue?

Self modifying code is not a security issue in and of itself, but it requires memory that is writable and executable (though, not necessarily at the same time). This is usually a bad idea because it makes arbitrary code execution much easier if your code has unrelated bugs in it, because it provides attackers a place to write shellcode and get it to run.

There's a security feature called W^X [0] (also called DEP in Windows). Basically you can use special mode which prevents memory pages to be writeable and executable at the same time, so self-modifying code is not allowed, but it prevents exploits from modifying memory containing executable code. OpenBSD uses it as well.

0: https://en.wikipedia.org/wiki/W%5EX

That's not what DEP is, but it is dependent on DEP. DEP is just another word for the NX bit, that allows a page to be marked as non-executable. With DEP you can still have a page that is RWX if you set its permissions that way.

Some (most?) of the problems with c stem from not checking array bounds.

Now if you break out of an array bound in read only memory, you cant do much damage, but what happens if you could rewrite the code to do what you want?

Theres also the issue that you can have viruses that hide what they're doing until they actually run, so virus scanners cant pick them up.

I'm no expert. There maybe other classes of attack.

Yes, I was thinking historical examples. When such things were a concern.

Don't forget there can be code size gains also.

BTW I think all modern processors have instruction caches. In ARM it might not automatically flush?

Reply on news.ycombinator.com