{"id":5663,"date":"2013-01-02T07:00:00","date_gmt":"2013-01-02T07:00:00","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/oldnewthing\/2013\/01\/02\/a-few-stray-notes-on-windows-patching-and-hot-patching\/"},"modified":"2013-01-02T07:00:00","modified_gmt":"2013-01-02T07:00:00","slug":"a-few-stray-notes-on-windows-patching-and-hot-patching","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20130102-00\/?p=5663","title":{"rendered":"A few stray notes on Windows patching and hot patching"},"content":{"rendered":"<p> Miscellaneous notes, largely unorganized. <\/p>\n<ul>\n<li>A lot of people questioned the specific choice of     <a href=\"http:\/\/blogs.msdn.com\/b\/oldnewthing\/archive\/2011\/09\/21\/10214405.aspx\">     <code>MOV EDI, EDI<\/code> as the two-byte NOP<\/a>,     with many people suggesting alternatives.     The decision to use <code>MOV EDI, EDI<\/code> as the two-byte NOP     instruction came after consulting with CPU manufacturers for     their recommendations for the best two-byte NOP.     So if you think something better should have been used,     go take it up with the CPU manufacturers.     They&#8217;re the ones who came up with the recommendation.     (Though I suspect they know more about the best way to optimize     code for their CPUs than you do.) <\/li>\n<li>     You can enable hotpatching on your own binaries by     <a href=\"http:\/\/msdn.microsoft.com\/en-us\/library\/ms173507.aspx\">     passing the <code>\/hotpatch<\/code> flag to the compiler<\/a>. <\/li>\n<li>     The primary audience for hotpatching is server administrators     who want to     <a href=\"http:\/\/support.microsoft.com\/kb\/897341\">     install a security update without having to reboot the computer<\/a>. <\/li>\n<li>There were some people who interpreted the presence of hotpatch     points as a security hole, since it makes it easier for malware     to redirect OS code.     Well, yes, but it didn&#8217;t enable     anything that they didn&#8217;t already know how to do.     If malware can patch your process,     then it has already made it     to the other side of the airtight hatchway.     And besides, malware authors aren&#8217;t going to bother carefully     patching code to avoid obscure race conditions.     They&#8217;re just going to patch the first five bytes     of the function without regard for safety,     because that&#8217;ll work 99% of the time.     (It&#8217;s not like the other 1% are going to call the virus     authors when the patch fails.) <\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Miscellaneous notes, largely unorganized. A lot of people questioned the specific choice of MOV EDI, EDI as the two-byte NOP, with many people suggesting alternatives. The decision to use MOV EDI, EDI as the two-byte NOP instruction came after consulting with CPU manufacturers for their recommendations for the best two-byte NOP. So if you think [&hellip;]<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[26],"class_list":["post-5663","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-other"],"acf":[],"blog_post_summary":"<p>Miscellaneous notes, largely unorganized. A lot of people questioned the specific choice of MOV EDI, EDI as the two-byte NOP, with many people suggesting alternatives. The decision to use MOV EDI, EDI as the two-byte NOP instruction came after consulting with CPU manufacturers for their recommendations for the best two-byte NOP. So if you think [&hellip;]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/5663","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=5663"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/5663\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=5663"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=5663"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=5663"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}