Is there any real application being self modifying code?

Question

There are few examples on the web demonstrating how to write a self-modifying code. But they're just examples. I would like to know if there is any real application being self modifying code. Thanks!

Answer 1

Am I allowed to reference other architectures? Because, when you're working with weaker systems, like embedded applications, SMC is often used, since there is only a limited amount of RAM available for the programs to run in.

Also, wikipedia has quite a nice list.

Answer 2

The first thing that comes to mind are viruses, trojaners and the likes.

Self-modifying code makes it harder for anti-virus applications to identify your application as malicious.

Another area were self-modifying code is used is genetic programming

There's also a Wikipedia article covering your question.

Answer 3

I know a program that contains a self modifying code (works as a protection scheme), it's role is to decrypt itself if the right password was entered and the decrypted code plays a big role into saving the opened file to disk, this program is called 'WinHEX'.. you can find the SMC code right above the call to virtual protect, and if the right password is entered, the program calls the write process memory api to decrypt the section, and to eventually save the file to disk.

Answer 4

The Dynamic Language Runtime (DLR) uses self-modifying code to optimize for the common types of a given call site.

Let's say you're writing a dynamically typed language on top of .NET, and you have source code in your language as follows:

x + y

Now, in a statically typed language, the types of x and y can be determined at compile time -- say x and y are ints, then x + y will use the IL "add" instruction.

But in a dynamically typed language, this resolution could be different every time. Next time, x and y could be strings, in which case the value resolution for this call site would use String.Concat. But resolving which IL to use is liable to be very costly. In fact, if in the first hit of the call site x and y are a pair of ints, it's highly likely that successive hits on this call site will also be with a pair of ints.

So the DLR iterates as follows: The compiled code of the callsite looks like this:

return site.Update(site, x, y);

The first time a given set of types is passed in -- say, a pair of ints, the Update method turns to the language implementation to resolve which method/instruction should be used with a pair of ints and a +. Those rules are then recompiled into the callsite; the resulting compiled code looks something like this:

if (x is int x1 && y is int y1) { return x1 + y1; }
return site.Update(site, x, y);

Successive calls with pairs of ints leave the compiled code unchanged.

If a new type pair is encountered, the code self-rewrites into something like this:

if (x is int x1 && y is int y1) { return x1 + y1; }
if (x is string x2 && y is string y2) { return String.Concat(x2, y2); }
return site.Update(site, x, y);

For more information on how this works, see Jim Hugunin's talk at PDC 2008 on dynamic languages and the DLR design documentation at the DLR project.

Answer 5

'Self modifying code' may also refer to bytecode modifications in Java. This is used by many frameworks like Guice, JPA, EJB- and Webcontainers and almost all AOP (Aspect Oriented Programming) frameworks. Basically they modify the bytecode before it is loaded and executed by the JVM. All those frameworks try to add behaviour to the class without the need to code cross-cutting concerns by hand. Transaction control, dependency injection, scope or context injection are the usual suspects.