TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Why do Windows functions begin with a pointless MOV EDI, EDI instruction? (2011)

136 pointsby mauover 9 years ago

7 comments

makecheckover 9 years ago
It&#x27;s kind of cool, so many things (computers or otherwise) have padding built in.<p>Remember BASIC, the classic 10&#x2F;20&#x2F;30 line numbering scheme? Don&#x27;t want to be caught without room to expand your program.<p>Microprocessors manufacture in extra gates in case they need to fix something.<p>Even in large construction projects you see evidence of mystery tunnels, pipes and other things that enable post-construction changes. Some of the road fly-overs in my area have branch points that are only connected in one direction (since obviously it would be ridiculously hard to retrofit the piers at the intersection 10 years from now to add a road going the other way).
praseodymover 9 years ago
Apparently, hotpatching never really took off: <a href="http:&#x2F;&#x2F;www.itwalkthru.com&#x2F;2010&#x2F;10&#x2F;hotpatching-great-idea-microsoft-but.html" rel="nofollow">http:&#x2F;&#x2F;www.itwalkthru.com&#x2F;2010&#x2F;10&#x2F;hotpatching-great-idea-mic...</a><p>Not sure if anything has changed in recent years, though.
评论 #11079928 未加载
评论 #11082600 未加载
osullivjover 9 years ago
Raymond mentions MS Detours in this article on patching. I&#x27;ve had great success troubleshooting 3rd party DLLs with Detours interception of function dispatch, specifically Excel XLLs.
评论 #11081211 未加载
pklauslerover 9 years ago
If it weren&#x27;t for the &quot;fastcall&quot; convention using ECX for an actual argument value, they could have used &quot;MOV ECX,EDI&quot; and then the change to a &quot;JMP $-5&quot; would have been possible with a single byte store to the opcode (0x89 -&gt; 0xeb), removing any worries about a two-byte store straddling a cache-line or page boundary.
mlexover 9 years ago
More articles like this in Raymond&#x27;s blog, which is full of anecdotes from his time at Microsoft.<p><a href="https:&#x2F;&#x2F;blogs.msdn.microsoft.com&#x2F;oldnewthing&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blogs.msdn.microsoft.com&#x2F;oldnewthing&#x2F;</a>
评论 #11079425 未加载
评论 #11080769 未加载
TazeTSchnitzelover 9 years ago
I miss the old The Old New Thing look. I also miss when all links to it weren&#x27;t broken.
评论 #11079356 未加载
jezfromfutureover 9 years ago
for patching if i remember right.
评论 #11080572 未加载