Anyone knows what “mov edi,edi ” does?

Question

69A8AB13  int         3    
69A8AB14  int         3    
69A8AB15  mov         edi,edi 
69A8AB17  push        ebp  
69A8AB18  mov         ebp,esp 

mov edi,edi doesn't make sense for me,what's it for?

Answer 1

It's a 2 byte NOP instruction. It gets included at the beginning of any function in an image compiled with the /hotpatch option:

http://msdn.microsoft.com/en-us/library/ms173507.aspx

-scott

Answer 2

See also http://blogs.msdn.com/b/oldnewthing/archive/2011/09/21/10214405.aspx

Answer 3

According to this page: StackExchange's Reverse Engineering

In x86-64 mov edi,edi is not a NOP. In x86-64 it zeroes the top 32 bits of rdi.

I though it was important enough to point it out, in supplement to snoone's answer.