If somebody tries to hot-patch an already-hot-patched function, how do they avoid conflicts?

This article discusses the challenges of hot-patching functions in Windows, particularly when a function has already been patched. It highlights the potential issues that arise when unauthorized patching occurs and the implications for system stability.

From the article

For the past few days, I did a quick survey of hot-patching mechanisms. But the hot-patch design accommodates only one hot-patcher. If somebody goes to hot-patch a function and finds that it’s already been hot-patched, what happens?

If somebody goes to hot-patch a function and finds that it’s already been hot-patched, then something has gone wrong.

The intended audience of hot-patching is Windows Update on systems that support hot-patching (as of this writing, Windows Server and more recently Windows 11 Enterprise , as far as I can tell). The idea is that when a Windows Update arrives, and the administrator has opted into hot-patching, and a file in the update is marked as “safe for hot-patching”,¹ then Windows Update will use the space reserved for hot-patching to replace the affected…

Share this resource