I disassembled a file with OllyDbg and it had the following instruction:
REPNE SCAS BYTE PTR ES:[EDI]
What does that exactly mean ?
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.Sign up to join this community
SCAS instruction is used to scan a string (
SCAS = SCan A String). It compares the content of the accumulator (
EAX) against the current value pointed at by
When used together with the
REPNE prefix (REPeat while Not Equal),
SCAS scans the string searching for the first string element which is equal to the value in the accumulator.
The Intel manual (Vol. 1, p.231) says:
The SCAS instruction subtracts the destination string element from the contents of the EAX, AX, or AL register (depending on operand length) and updates the status flags according to the results. The string element and register contents are not modified. The following “short forms” of the SCAS instruction specify the operand length: SCASB (scan byte string), SCASW (scan word string), and SCASD (scan doubleword string).
So, basically, this instruction scan a string and look for the same character than the one stored in
EAX. It won't touch any registers other than ECX (counter) and EDI (address) but the status flags according to the results.