Self-modifying Code program intentionally modifies code in the program by overwriting machine code may be used by code designers to obscure branch addresses -> obfuscation - security through obscurity sometimes used to write really tight code (really discouraged, code not maintainable)
Microprocessor Architecture ADD R0,NUM Microprocessor Architecture Instruction Fetch Execute 1. MAR<-PC, read 7. alu<-R0, add 2. wait, PC<-PC+1 Write Back 3. IR <- MDR 8. MDR<-buffer Instruction Decode 9. MAR<- ‘NUM’, 4. MAR <- ’NUM’, read write 5. Wait 10. wait 6. Acc <- MDR Single bus architecture, instruction execution (simplified!) M D R Accumulator IR SP MAR PC Rn … R0 ALU CCR buffer
1006 223A FFFA move.l start+2(pc),d1 code/data reuse Objective: obscure value in D1 1000 ORG $1000 1000 start: 1000 203C 20012002 move.l #$20012002,d0 1006 223A FFFA move.l start+2(pc),d1 100A 4EB9 00001xxx jsr dobasedond1 ... 1xxx 4E72 2700 stop #$2700 1xxx dobasedond1: 1xxx 4E75 rts END start
1000 4EBA 000E entry: jsr label2(pc) 1004 4EBA 0006 jsr label(pc) self modifying code 1000 ORG $1000 1000 4EBA 000E entry: jsr label2(pc) 1004 4EBA 0006 jsr label(pc) 1008 4E72 2700 stop #$2700 100C label: 100C 4E75 rts 100E 4E71 nop ← code of interest here 1010 41FA FFFA label2: lea label(pc),a0 1014 30BC 4E71 move.w #$4e71,(a0) 1018 4E75 rts 101A END entry
data dc.l $13fc01ff, $00e0110,$533901e0,$001067f8,$4e722600 self modifying code 1000 START ORG $1000 1000 41F9 00001020 lea data,a0 1006 2E3C 00000FFF move.l #4095,d7 100C 203C 00000100 move.l #$100,d0 1012 B198 loop: eor.l d0,(a0)+ 1014 51CF FFFC dbra d7,loop 1018 6000 0006 bra data 101C 4E72 2700 stop #$2700 1020= 13FC01FF 000E0110 ... data dc.l $13fc01ff, $00e0110,$533901e0,$001067f8,$4e722600 1034 END START
1008 41FA 000A time1 lea label+2(pc),a0 100C 3210 move.w (a0),d1 self modifying code 1000 START ORG $1000 1000 343C 0004 move.w #$0004,d2 1004 303C 0005 move.w #5,d0 1008 41FA 000A time1 lea label+2(pc),a0 100C 3210 move.w (a0),d1 100E B541 eor.w d2,d1 1010 30C1 move.w d1,(a0)+ 1012 51C8 FFF4 label dbra d0,time1 1016 4E72 2700 stop #$2700 END START