Windows hot-patching: what happens if a function is already patched
The post, on Microsoft's Old New Thing developer blog, follows a quick survey of hot-patching mechanisms the author did over the past few days. It takes up one narrow question: the hot-patch design accommodates only one hot-patcher, so what happens if someone goes to hot-patch a function and finds it has already been hot-patched? The short answer is that something has gone wrong.
The author explains the intended use. Hot-patching is aimed at Windows Update on systems that support it, which as of this writing means Windows Server and, more recently, Windows 11 Enterprise, as far as the author can tell. When an update arrives, the administrator has opted into hot-patching, and a file in the update is marked "safe for hot-patching", Windows Update uses the space reserved for hot-patching to replace the affected functions on the fly. Because Windows Update is the only code authorized to use that space, the system never has to handle a function already hot-patched by somebody else. In the author's words, there is no other code authorized to be somebody else.
The harder case is a function that has been detoured or otherwise patched by code that had no right to do so. The author's reading of the hot-patching code is that if it detects such rogue patching, it declares the file not hot-patchable, and the system will have to reboot. The author adds that this tends to make customers unhappy.
There is also a race condition. The prescan may show that every function is safe to patch, and then something patches a function after the prescan completes. The patcher gets halfway through, discovers the rogue-patched function, and is stuck. It cannot continue forward, and it cannot reliably roll back, because the rollback is probably going to fail too: the patch got overpatched. The result is a binary in memory that is half-patched, and as the author puts it, who knows what will happen then.
The author closes with an analogy: an application that uses the hot-patching space is parking in a fire zone. Everything seems fine until the fire truck shows up, and then somebody's house burns down because the truck cannot get there. A footnote adds that not every change is safe for hot-patching. A change to a data structure's layout or invariants is not hot-patchable, because instances created before the hot-patch would not be in a legal state afterwards. The post also links to related reading on application compatibility layers, which it says are there for the customer, not for the program.
Key facts
- Windows hot-patching is designed for one patcher only: Windows Update, on systems that support it (Windows Server and more recently Windows 11 Enterprise, as far as the author can tell).
- Hot-patching applies when the administrator has opted in and a file in the update is marked safe for hot-patching; Windows Update then replaces affected functions on the fly in the reserved space.
- By the author's reading of the code, detecting rogue patching makes the file not hot-patchable and the system will have to reboot.
- A race can leave a half-patched binary in memory: the prescan passes, a function is patched afterwards, and the patcher can neither go forward nor reliably roll back.
- Changes to a data structure's layout or invariants are not hot-patchable, since instances created before the patch would be in an illegal state afterwards.
Why it matters
Hot-patching lets Windows replace functions in running code without a restart, and this post spells out an assumption it rests on: nobody else touches the reserved hot-patch space. It shows what happens when that assumption breaks, and the answer is a forced reboot or, in a race, an unrecoverable half-patched state.
Who it affects
Mainly developers of software that detours or patches Windows functions in memory, and administrators who opt into hot-patching. The author names Windows Server and, more recently, Windows 11 Enterprise as the systems that support it, as far as the author can tell.
How to use it
The post is explanation rather than a tool. Its practical lesson comes from the author's analogy: do not use the hot-patching space in your own application, because it is reserved for Windows Update. Only files marked safe for hot-patching in an update are eligible, and the administrator must have opted in.
How solid is it
This is a first-hand explanation from a Microsoft developer blog, but the key claim is hedged. The reboot behaviour is the author's own reading of the hot-patching code, not an official statement. The race condition and failed rollback are described in general terms, with no specific build, patch or real incident named.
Risks and caveats
The race condition is the main danger: a function patched after the prescan leaves a half-patched binary in memory, and rollback will probably fail as well. The author says only that the outcome is unpredictable. Even in the simpler case, a forced reboot tends to make customers unhappy. The post gives no figures on how often either outcome occurs.
“There is no other code authorized to be somebody else!”
— From the Old New Thing post on hot-patching