MemoryModule icon indicating copy to clipboard operation
MemoryModule copied to clipboard

flush instruction cache after performing relocations

Open hMihaiDavid opened this issue 9 years ago • 4 comments

Flush instruction cache to avoid executing stale code after performing relocations. According to MSDN: "Applications should call FlushInstructionCache if they generate or modify code in memory. The CPU cannot detect the change, and may execute the old code it cached.". After performing relocation we have modified executable code, so if we don't flush the cache maybe the old code without relocation is executed instead. So far the code has woked without flushing instruction cache but it's better to be safe.

https://msdn.microsoft.com/en-us/library/windows/desktop/ms679350(v=vs.85).aspx

hMihaiDavid avatar Dec 31 '16 17:12 hMihaiDavid

Now the instruction cache is flushed only for each page-sized block of image where relocations have been performed. The FlushInstructionCache is now called inside PerformBaseRelocations, and it uses GetCurrentProcess instead of hard-coding (HANDLE)-1

hMihaiDavid avatar Jan 04 '17 14:01 hMihaiDavid

I cannot see ANY sense in calling FlushInstructionCache(). You want to execute this function after relocating the code section. But this happens long before the code is executed by calling the entry point. You want to call FlushInstructionCache() when the section has not even been marked as executable with VirtualProtect()

Elmue avatar Jul 02 '20 15:07 Elmue

The correct usage of this function may be called by user code, not MemoryModule itself - after multiple loads in a row, for example.

This also may be an undesirable behavior to call additional APIs with unclear functions.

akasandra avatar Jul 03 '20 09:07 akasandra

I don't know what you want to say with "additional APIs with unclear functions" ???? However I cannot see the sense of calling this function. You did not help to clarify this.

Elmue avatar Jul 04 '20 05:07 Elmue