Active Program Modification

Abstract

While the previous chapter showed several examples of using dynamic binary modification systems to analyze or debug programs, all such examples were passive in that they inserted new code to observe behaviors of the guest application, but not modify those behaviors. By contrast, this chapter focuses on tools that actively modify the original functionality of an application. Modifications can be fine grained, such as changing register or memory values of individual instructions, or modifying the control flow of a program. They can also be coarse grained, such as adding or deleting relevant functionality, replacing entire procedures, or applying optimizations or security features to an entire guest application.