{"id":983,"date":"2014-05-15T07:00:00","date_gmt":"2014-05-15T14:00:00","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/oldnewthing\/2014\/05\/15\/is-writeprocessmemory-atomic\/"},"modified":"2014-05-15T07:00:00","modified_gmt":"2014-05-15T14:00:00","slug":"is-writeprocessmemory-atomic","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20140515-00\/?p=983","title":{"rendered":"Is WriteProcessMemory atomic?"},"content":{"rendered":"

\nA customer asked,\n“Does\nWrite­Process­Memory<\/code>\nwrite the memory atomically?\nI mean, if I use\nWrite­Process­Memory<\/code>\nto write 10 instructions for a total of 20 bytes,\ncan\nWrite­Process­Memory<\/code>\nwrite those 20 bytes atomically?”\n<\/p>\n

\nCPUs typically provide only modest atomic update capabilities.\nThe x86 family of processors, for example, can update up to eight bytes\natomically.\nTwenty bytes is beyond the capability of the processor.<\/p>\n

\nI was kind of baffled at what sort of mental model of computing the\ncustomer had developed.\nIt apparently permits\nWrite­Process­Memory<\/code>\nto accomplish something that the CPU is not physically capable of\nperforming.\n<\/p>\n

\n“Will my aluminum hammer withstand temperatures above 700C?”\n<\/p>\n

\nGiven that aluminum melts at 660C,\nit doesn’t matter whether you make a hammer or a ladder or a scaffold.\nAs long as you make it out of aluminum, it will melt at 660C\nbecause that’s a fundamental property of aluminum.\n<\/p>\n

\nThe only thing I can think of is that the\ncustomer thought that maybe the kernel suspended all of the\nthreads in the process,\nupdated the memory,\nand then unfroze them all.\nIt wouldn’t be an atomic update in an absolute sense\n(somebody else doing a\nRead­Process­Memory<\/code> might read an in-progress\nwrite),\nbut it would be atomic from the viewpoint of the process\nbeing written to.\n<\/p>\n

\nBut no, the\nWrite­Process­Memory<\/code>\nfunction does no such thing.\nIt merely writes the memory into the process address space.\n<\/p>\n

\nAnother way of thinking about it is\nusing the thought experiment\n“Imagine if this were true.”\nIf it were true that\nWrite­Process­Memory<\/code>\nprovided atomicity guarantees for 20 bytes,\nthen all sorts of multi-threaded synchronization problems\nwould magically disappear.\nIf you wanted to update a block of memory in your process atomically,\nyou would just call\nWrite­Process­Memory<\/code>\non your own process handle!\n<\/p>\n

\nI noted that the underlying scenario sounds really fishy.\nUsing Write­Process­Memory<\/code> to update\ncode in a process sounds an awful lot like the customer\nis writing a virus.\nOne of my colleagues who studies malware agreed,\nadding,\n“On the other hand, some anti-malware products also use\nthat approach, as dubious as it is.\nFor the record, I would like to add, ‘yuck’.”\nMy colleague asked the customer for further details\non what they are doing, and why they think that\nWrite­Process­Memory<\/code> is what they need,\nso that a proper solution to their\nunderlying problem could be developed.\n<\/p>\n

\nWe never heard back from the customer.<\/p>\n","protected":false},"excerpt":{"rendered":"

How could it be?<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[25],"class_list":["post-983","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-code"],"acf":[],"blog_post_summary":"

How could it be?<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/983","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=983"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/983\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=983"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=983"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=983"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}