Why does the compiler generate a MOV EDI, EDI instruction at the beginning of functions?
为何编译器在函数开始处,生成MOV EDI,EDI指令?
I’ve recently noticed that on the XPSP2 Beta that I am running the function prologs look like this:
我最近注意到 XP sp2测试版 当我运行函数的时候,开端如下:
MOV EDI, EDI
PUSH EBP
MOV EBP, ESP
The PUSH EBP and MOV EBP, ESP instructions are standard frame establishment, but what is the purpose of the MOV EDI,EDI instruction? Seems like a 2-byte NOP instruction.
PUSH EBP 和 MOV EBP,ESP指令是标准框架建立,但是MOV EDI,EDI指令的目的是什么?
看起来像是2字节的NOP指令。
MOV EDI,EDI is indeed a 2-byte no-op that is there to enable hot-patching.
MOV EDI,EDI 确实是2字节的NOP 用来实现hot-patching技术。
It enables the application of a hot-fix to a function without a need for a reboot, or even a restart of a running application.
它确保了程序可以热修复一个函数不需要重启,甚至不需要重新开启一个运行的程序。
Instead, at runtime, the 2-byte NOP is replaced by a short jump to a long jump instruction that jumps to the hot-fix function.
相反,在运行时,2字节的NOP 被替换成一个短跳到一个长跳指令来热修复函数。
A 2-byte instruction is required so that when patching the instruction pointer will not point in a middle of an instruction.
这个2字节指令要求当打指令补丁的时候不要指向一个中间指令。