I see this instruction in the beginning of several Windows programs.
It's copying a register to itself, so basically, this acts as a
What's the purpose of this instruction?
Raymond Chen (Microsoft) has a blog post discussing this in detail:
In short, it's a compile time addition applied in order to support run time hot patching, so the function can have the first two bytes overwritten with a JMP instruction to redirect execution to another piece of code.
It's intended to jump to a specific location, 5 bytes before the mov instruction. From there, you have 5 bytes which are intended to be modified to a long jump to somewhere else in 32-bit memory space. Note that when hot-patching, that 5 bytes jump should be placed first, and then the mov can be replaced. Going the other way, you risk the replaced mov-jmp running first, and jumping to the 5 bytes of whatever happens to be there (it's all nops by default, but you never know).
Regarding writing the 5 bytes jump - there's also the problem of there is only one instruction that will let you write more than 4 bytes atomically - cmpxchg8b, and that's not an ideal instruction for the purpose. If you write the 0xe9 first and then a dword, then you have a race condition if the 0xe9 is executed before you place the dword. Yet another reason to write the long jump first.
courtsey Hotpatching and the Rise of Third-Party Patches presentation at BlackHat USA 2006 by Alexander Sotirov
What Is Hotpatching? Hotpatching is a method for modifying the behavior of an application by modifying its binary code at runtime. It is a common technique with many uses:
• debugging (software breakpoints)
• runtime instrumentation
• hooking Windows API functions
• modifying the execution or adding new functionality to closed-source applications
• deploying software updates without rebooting
• fixing security vulnerabilities
Hotpatches are generated by an automated tool that compares the original and patched binaries. The functions that have changed are included in a file with a .hp.dll extension. When the hotpatch DLL is loaded in a running process, the first instruction of the vulnerable function is replaced with a jump to the hotpatch.
The /hotpatch compiler option ensures that the first instruction of every function is a mov edi, edi instruction that can be safely overwritten by the hotpatch. Older versions of Windows are not compiled with this option and cannot be hotpatched.