6 ms·

My favorite Chen article: Why do Windows functions all begin with a pointless MOV EDI, EDI instruction? https://devblogs.microsoft.com/oldnewthing/20110921-00

My favorite Chen article: Why do Windows functions all begin with a pointless MOV EDI, EDI instruction? https://devblogs.microsoft.com/oldnewthing/20110921-00/?p=9583 https://devblogs.microsoft.com/oldnewthing/20110921-00/?p=95...

omnibrain 4y ago
It's such a shame that they killed (twice now?) all the comments in the blog.
- game-of-throws 4y ago
  They also changed the URL at least once and broke all links to it. His posts deserve better.
- password4321 4y ago
  Yes, I miss my weekly-ish from Raymond's arch nemesis Yuhong Bao. For this specific blog post there's an HN discussion¹ and archive.today² (beware!?³) did grab comments while the Internet Archive does not load them: ¹ https://news.ycombinator.com/item?id=3022224 https://news.ycombinator.com/item?id=3022224 ² http://archive.today/2015.07.08-134638/http://blogs.msdn.com/b/oldnewthing/archive/2011/09/21/10214405.aspx http://archive.today/2015.07.08-134638/http://blogs.msdn.com... ³ https://news.ycombinator.com/item?id=31945924#31946453 https://news.ycombinator.com/item?id=31945924#31946453
  - m463 4y ago
    nice use of superscripts
- mananaysiempre 4y ago
  There is a more-or-less comprehensive archive[1] up to 2019 (which should probably be scraped and hoarded). The article in question is there, comments included[2]. Side note: Michael Kaplan’s blog, which Microsoft took down in a remarkably shameful manner, has also been archived[3], while Eric Lippert reposted (most of?) his old articles on his personal WordPress instance[4]. [1] http://bytepointer.com/resources/old_new_thing/index.htm http://bytepointer.com/resources/old_new_thing/index.htm [2] http://bytepointer.com/resources/old_new_thing/20110921_226_why_do_windows_functions_all_begin_with_a_pointless_mov_edi_edi_instruction.htm http://bytepointer.com/resources/old_new_thing/20110921_226_... [3] http://archives.miloush.net/michkap/archive/ http://archives.miloush.net/michkap/archive/ [4] https://ericlippert.com/ https://ericlippert.com/
  - omnibrain 4y ago
    Larry Osterman's Blog seems to be gone too...
    - deleted 4y ago
      [deleted]
    - stevekemp 4y ago
      I haven't heard that name in a few years, but I remember quite vividly that I found his blog by searching for "+int03 +blog". At the time that seemed like a good way of getting low-level code-related posts.
    - mananaysiempre 4y ago
      It’s still there[1], although a number of the posts seem to be missing. Inexplicably, (most of) the comments are in place. (There are other Microsoft blogs that have disappeared without a trace, but not this one.) [1] https://docs.microsoft.com/en-us/archive/blogs/larryosterman/ https://docs.microsoft.com/en-us/archive/blogs/larryosterman...
mFixman 4y ago
I don't understand the reasoning behind this. Why do you need 5 bytes of unexecuted patch space before the program _and_ 2 bytes of patch space at the beginning of the program? Wouldn't it be the same to have a single 5-byte effectless operation to patch a single long jump instead of needing space for two jumps?
- saagarjha 4y ago
  5 bytes of nops takes longer than 2 bytes?
  - jahewson 4y ago
    Longer time to execute.
- layer8 4y ago
  The article explains why a MOV is used instead of two NOPs. Five NOPs would obviously be even worse.
  - mFixman 4y ago
    But isn't there a 5-byte single instruction that has no effect, like `NOP DWORD ptr [EAX + EAX*1 + 00H]`? I thought that multibyte NOPs were executed in a single instruction?
    - layer8 4y ago
      I’m pretty sure it would be slower, if only by taking up more space in the instruction cache (in the common case where no hotpatch is applied).
    - MBCook 4y ago
      They may not have been coalesced at the time the decision was made.
  - colejohnson66 4y ago
    But NOPs aren’t even executed. They’re swallowed by either the decoder or dispatcher.
Waterluvian 4y ago
Would this instruction be optimized away by… I dunno, out of my league here… the CPU microcode or CPU design itself? Or is it that when you get to assembly-level instructions, you can have total confidence that everything you’re reading will be executed as-is ?

omnibrain 4y ago

It's such a shame that they killed (twice now?) all the comments in the blog.

game-of-throws 4y ago
They also changed the URL at least once and broke all links to it. His posts deserve better.
password4321 4y ago
Yes, I miss my weekly-ish from Raymond's arch nemesis Yuhong Bao. For this specific blog post there's an HN discussion¹ and archive.today² (beware!?³) did grab comments while the Internet Archive does not load them: ¹ https://news.ycombinator.com/item?id=3022224 https://news.ycombinator.com/item?id=3022224 ² http://archive.today/2015.07.08-134638/http://blogs.msdn.com/b/oldnewthing/archive/2011/09/21/10214405.aspx http://archive.today/2015.07.08-134638/http://blogs.msdn.com... ³ https://news.ycombinator.com/item?id=31945924#31946453 https://news.ycombinator.com/item?id=31945924#31946453
- m463 4y ago
  nice use of superscripts
mananaysiempre 4y ago
There is a more-or-less comprehensive archive[1] up to 2019 (which should probably be scraped and hoarded). The article in question is there, comments included[2]. Side note: Michael Kaplan’s blog, which Microsoft took down in a remarkably shameful manner, has also been archived[3], while Eric Lippert reposted (most of?) his old articles on his personal WordPress instance[4]. [1] http://bytepointer.com/resources/old_new_thing/index.htm http://bytepointer.com/resources/old_new_thing/index.htm [2] http://bytepointer.com/resources/old_new_thing/20110921_226_why_do_windows_functions_all_begin_with_a_pointless_mov_edi_edi_instruction.htm http://bytepointer.com/resources/old_new_thing/20110921_226_... [3] http://archives.miloush.net/michkap/archive/ http://archives.miloush.net/michkap/archive/ [4] https://ericlippert.com/ https://ericlippert.com/
- omnibrain 4y ago
  Larry Osterman's Blog seems to be gone too...
  - deleted 4y ago
    [deleted]
  - stevekemp 4y ago
    I haven't heard that name in a few years, but I remember quite vividly that I found his blog by searching for "+int03 +blog". At the time that seemed like a good way of getting low-level code-related posts.
  - mananaysiempre 4y ago
    It’s still there[1], although a number of the posts seem to be missing. Inexplicably, (most of) the comments are in place. (There are other Microsoft blogs that have disappeared without a trace, but not this one.) [1] https://docs.microsoft.com/en-us/archive/blogs/larryosterman/ https://docs.microsoft.com/en-us/archive/blogs/larryosterman...

mFixman 4y ago

I don't understand the reasoning behind this. Why do you need 5 bytes of unexecuted patch space before the program _and_ 2 bytes of patch space at the beginning of the program? Wouldn't it be the same to have a single 5-byte effectless operation to patch a single long jump instead of needing space for two jumps?

saagarjha 4y ago
5 bytes of nops takes longer than 2 bytes?
- jahewson 4y ago
  Longer time to execute.
layer8 4y ago
The article explains why a MOV is used instead of two NOPs. Five NOPs would obviously be even worse.
- mFixman 4y ago
  But isn't there a 5-byte single instruction that has no effect, like `NOP DWORD ptr [EAX + EAX*1 + 00H]`? I thought that multibyte NOPs were executed in a single instruction?
  - layer8 4y ago
    I’m pretty sure it would be slower, if only by taking up more space in the instruction cache (in the common case where no hotpatch is applied).
  - MBCook 4y ago
    They may not have been coalesced at the time the decision was made.
- colejohnson66 4y ago
  But NOPs aren’t even executed. They’re swallowed by either the decoder or dispatcher.

Waterluvian 4y ago

Would this instruction be optimized away by… I dunno, out of my league here… the CPU microcode or CPU design itself? Or is it that when you get to assembly-level instructions, you can have total confidence that everything you’re reading will be executed as-is ?