Monday, September 21, 2009

Useless mov edi,edi in the Prologue

The seemingly useless statement is used to enable hot patching (patching without stopping the component). The 2-byte instruction can be changed to a short jmp operation (within a range of 127 bytes in either direction). To extend the jmp target, NOP statements are generated before the function labels so that a long jmp statement could be patched in:

xor eax,eax
jmp xyz
nop
nop
nop
nop
nop
func-abc:
mov edi,edi
push ebp
mov ebp,esp
:

No comments: