14

I disassembled a file with OllyDbg and it had the following instruction:

REPNE SCAS BYTE PTR ES:[EDI]

What does that exactly mean ?

18

The SCAS instruction is used to scan a string (SCAS = SCan A String). It compares the content of the accumulator (AL, AX, or EAX) against the current value pointed at by ES:[EDI].

When used together with the REPNE prefix (REPeat while Not Equal), SCAS scans the string searching for the first string element which is equal to the value in the accumulator.

The Intel manual (Vol. 1, p.231) says:

The SCAS instruction subtracts the destination string element from the contents of the EAX, AX, or AL register (depending on operand length) and updates the status flags according to the results. The string element and register contents are not modified. The following “short forms” of the SCAS instruction specify the operand length: SCASB (scan byte string), SCASW (scan word string), and SCASD (scan doubleword string).

So, basically, this instruction scan a string and look for the same character than the one stored in EAX. It won't touch any registers other than ECX (counter) and EDI (address) but the status flags according to the results.

  • The value pointed by EAX, or the value of EAX? Also, what accumulators does it update? what should look after a REPNE SCAS ? – aclokay Sep 9 '13 at 20:43
  • The value of EAX and pointed at by ES:[EDI]. The address where the string differ from the character stored in the accumulator is the one currently stored in ES:[EDI]. – perror Sep 9 '13 at 21:14
  • Shouldn't a REPNE SCAS be repeat until a match of the value of EAX is found? So i thought it should be "look for a character that is the same from the one stored in EAX."? – user2797 Sep 10 '13 at 3:36
  • @guestme: Yes. Sorry, I did write the opposite of what I meant. I edit the text. – perror Sep 10 '13 at 12:45
  • 2
    @dnivra: but that's not all it can do. Specifically, repnz scasb is the equivalent of memchr(). – peter ferrie Sep 11 '13 at 17:36

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.