When can trapping be used?

Question

This is the beginning of one of the functions inside NTDLL of Windows XP:

MOV EDI,EDI
PUSH EBP
MOV EBP,ESP
...

The book on reverse engineering I am reading(Eldad Eilam - Reversing: Secrets of Reverse Engineering) says this about the first line:

It is essentially dead code that was put in place by the compiler as a placeholder, in case someone wanted to trap this function. Trapping means that some external component adds a JMP instruction that is used as a notification whenever the trapped function is called.

Can you show me how exactly can trapping be used in practice? I assume that trapping is just calling a function with trapping instruction inside the other function, but I don't realize how the outside function can get "notified" about the call... Is it possible the author meant by "some external component" the debugger? It can make sense because if I set a breakpoint for some strange assembly insruction like MOV EDI, EDI, I'll get to where trapped function is...

Answer 1

mov edi, edi is an instruction that is called hotpatch point

there are several articles about it on the internet, notable among them are:

1. Raymond Chens old new thing 1
2. Raymond Chens old new thing 2
3. Johannas passing's Hot patch walkthrough

The main utility for this instruction is to enable a third party app or Windows update to patch an existing function to a newer function with minimal side effects when obscure race conditions become a reality (hard patching any function with a detour will work most of the time or as raymond puts will work 99% of the time

quoting from the article linked

The MOV EDI, EDI instruction is a two-byte NOP, which is just enough space to patch in a jump instruction so that the function can be updated on the fly. The intention is that the MOV EDI, EDI instruction will be replaced with a two-byte JMP $-5 instruction to redirect control to five bytes of patch space that comes immediately before the start of the function. Five bytes is enough for a full jump instruction, which can send control to the replacement function installed somewhere else in the address space.

the mov edi, edi is used in conjunction with five space holders emitted by the compiler before the mov edi, edi like 0xcc or 0x90

so the patching software can patch in an atomically replaceable short jump and a long jump to a control area