mov [some_other_memory], 1
mov [some_other_memory + 1], 2
jmp label_back_to_static_code    

Tyler: Any change to memory will be reflected back into the CPU at all cache levels. This is by design so that self modifying code will work. It might not be fast or efficient but it will work.

format PE GUI
entry start

section '.text' code readable writeable executable

start:
 mov  al, 90h   ; NOP instruction
 mov     ecx, last_eip - get_eip
 call        get_eip
get_eip:
 mov edi, [esp]
 rep stosb   ; rewrite bytes from get_eip to last_eip by NOPs
is_40:
 DB 40h   ; dummy INC EAX
last_eip:
 pop edi

 ; if byte 40h was rewitten, REP STOSB didn't rewrite itself
 ; - code cache was not updated

 cmp byte [edi+(is_40-get_eip)], 40h
 jne cache_not_updated

cache_updated:
 push    0
 push      caption
 push        updated
 push        0
 call      [MessageBoxA]

 push      1
 call      [ExitProcess]

cache_not_updated:
 push    0
 push      caption
 push        not_updated
 push    0
 call      [MessageBoxA]

 push      0
 call      [ExitProcess]

section '.data' data readable writeable

 caption     db 'x',0
 not_updated db 'cache not updated',0
 updated     db 'cache updated',0

section '.idata' import data readable writeable

  dd 0,0,0,RVA kernel_name,RVA kernel_table
  dd 0,0,0,RVA user_name,RVA user_table
  dd 0,0,0,0,0

  kernel_table:
    ExitProcess dd RVA _ExitProcess
    dd 0
  user_table:
    MessageBoxA dd RVA _MessageBoxA
    dd 0

  kernel_name db 'KERNEL32.DLL',0
  user_name db 'USER32.DLL',0

  _ExitProcess dw 0
    db 'ExitProcess',0
  _MessageBoxA dw 0
    db 'MessageBoxA',0
    

On the Intel486 processor, a write to an instruction in the cache will modify it in both the cache and memory. If the instruction was prefetched before the write, however, the old version of the instruction could be the one executed. To prevent this problem, it is necessary to flush the instruction prefetch unit of the Intel486 processor by coding a jump instruction immediately after any write that modifies an instruction. The P6 family and Pentium processors, however, check whether a write may modify an instruction that has been prefetched for execution. This check is based on the linear address of the instruction. If the linear address of an instruction is found to be present in the prefetch queue, the P6 family and Pentium processors flush the prefetch queue, eliminating the need to code a jump instruction after any writes that modify an instruction.

Is it enough the check if ecx is zero? Single stepping make ecx=2, and direct execution makes ecx=0.

I guess this is a consequence of the special circuitry for rep stosx speed-ups.

rep_stosb:
test ecx, ecx
jz .out
.stosb:
stosb
loop .stosb
.out:    

Or perhaps "REP STOSB" is defined as an instruction rather than just a prefixed instruction ...

But then interrupts might screw you if you tried to rely upon that idea.

MAXIMUM_LENGTH = 1 shl 26

      format pe console
   include 'win32ax.inc'

.code

    virtual
             inc     eax
         load instr_inc_eax byte from $$
     end virtual

     virtual
             ret
         load instr_ret byte from $$
 end virtual

     virtual
             nop
         load instr_nop byte from $$
 end virtual

     virtual
             nop
         nop
         rep     stosb
               load instr_rep_stosb dword from $$
  end virtual

     virtual
             nop
         rep     stosw
               load instr_rep_stosw dword from $$
  end virtual

     virtual
             nop
         nop
         rep     stosd
               load instr_rep_stosd dword from $$
  end virtual

proc begin uses ebx
      invoke  GetStdHandle,STD_OUTPUT_HANDLE
      mov     ebx,eax
     stdcall test_lengths,instr_rep_stosb,'STOSB',ebx,0
        stdcall print_string,ebx,<13,10>
      stdcall test_lengths,instr_rep_stosw,'STOSW',ebx,1
        stdcall print_string,ebx,<13,10>
      stdcall test_lengths,instr_rep_stosd,'STOSD',ebx,2
        stdcall print_string,ebx,<13,10>
      invoke  ExitProcess,0
endp

proc test_lengths uses ebx,rep_instruction,name,handle,shift
   mov     ebx,4
    .loop:
     mov     ecx,[shift]
 lea     eax,[ebx+4]
 shr     eax,cl
      stdcall make_code_section,eax,[rep_instruction]
     ccall   cprint_formatted_string,[handle],<'%s length = 0x%08x, bytes written before interrupt: 0x%08x',13,10>,[name],ebx,eax
    add     ebx,ebx
     cmp     ebx,MAXIMUM_LENGTH
  jbe     .loop
       ret
endp

proc make_code_section uses edi,run_length,rep_instruction
       mov     eax,[rep_instruction]
       mov     edi,rep_stos_test
   stosd
       mov     eax,instr_inc_eax * 0x01010101
      mov     ecx,MAXIMUM_LENGTH shr 2
    rep     stosd
       mov     eax,instr_ret * 0x01010101
  stosd
       mov     edi,rep_stos_test
   mov     ecx,[run_length]
    mov     eax,instr_nop * 0x01010101
  call    rep_stos_test
       sub     eax,instr_nop * 0x01010101
  sub     eax,MAXIMUM_LENGTH
  neg     eax
 ret
endp

proc cprint_formatted_string c handle,format,parameters
  stdcall print_formatted_string,[handle],[format],addr parameters
    ret
endp

proc print_formatted_string handle,format,parameters
     locals
              string rb 1024
      endl
        invoke  wvsprintf,addr string,[format],[parameters]
 stdcall print_string,[handle],addr string
   ret
endp

proc print_string handle,string
  locals
              written dd ?
        endl
        invoke  lstrlen,[string]
    invoke  WriteFile,[handle],[string],eax,addr written,NULL
   ret
endp

section 'rep_stos' code readable writeable executable

rep_stos_test: rb MAXIMUM_LENGTH + 1 shl 12

.end begin    

...
STOSB length = 0x00100000, bytes written before interrupt: 0x00100000
STOSB length = 0x00200000, bytes written before interrupt: 0x001bda5c
STOSB length = 0x00400000, bytes written before interrupt: 0x00400000
STOSB length = 0x00800000, bytes written before interrupt: 0x004558dc
...