What's the point of LEA EAX, [EAX]?

问题:

LEA EAX, [EAX]

I encountered this instruction in a binary compiled with the Microsoft C compiler. It clearly can't change the value of EAX. Then why is it there?

回答1:

It is a NOP.

The following are typcially used as NOP. They all do the same thing but they result in machine code of different length. Depending on the alignment requirement one of them is chosen:

xchg eax, eax         = 90
mov eax, eax          = 89 C0 
lea eax, [eax + 0x00] = 8D 40 00 

回答2:

From this article:

This trick is used by MSVC++ compiler to emit the NOP instructions of different length (for padding before jump targets). For example, MSVC++ generates the following code if it needs 4-byte and 6-byte padding:

8d6424 00 lea [ebx+00],ebx ; 4-byte padding 8d9b 00000000
lea [esp+00000000],esp ; 6-byte padding

The first line is marked as "npad 4" in assembly listings generated by the compiler, and the second is "npad 6". The registers (ebx, esp) can be chosen from the rarely used ones to avoid false dependencies in the code.

So this is just a kind of NOP, appearing right before targets of jmp instructions in order to align them.

Interestingly, you can identify the compiler from the characteristic nature of such instructions.

回答3:

LEA EAX, [EAX]

Indeed doesn't change the value of EAX. As far as I understand, it's identical in function to:

MOV EAX, EAX

Did you see it in optimized code, or unoptimized code?