Runtime code patching is the act of changing a program’s instructions while it is already running. An attacker may modify functions in memory, overwrite branches, hook APIs, or inject new logic so the software behaves differently without changing the on-disk file. This can be used to disable security checks, alter execution flow, hide malicious activity, or make an implant more flexible against analysis.
In cyber security, runtime patching matters because it reduces the value of static inspection alone. A clean binary on disk may behave very differently after it is loaded, which complicates detection and reverse engineering. Defenders look for memory modifications, unexpected code hooks, process injection, and mismatches between loaded modules and known hashes. Legitimate software also patches itself at runtime for compatibility or instrumentation, so context and telemetry are essential.