I disassembled a file with OllyDbg and it had the following instruction:
REPNE SCAS BYTE PTR ES:[EDI]
What does that exactly mean ?
Add a comment
|
1 Answer
The SCAS instruction is used to scan a string (SCAS = SCan A String). It compares the content of the accumulator (AL, AX, or EAX) against the current value pointed at by ES:[EDI].
When used together with the REPNE prefix (REPeat while Not Equal), SCAS scans the string searching for the first string element which is equal to the value in the accumulator.
The Intel manual (Vol. 1, p.231) says:
The SCAS instruction subtracts the destination string element from the contents of the EAX, AX, or AL register (depending on operand length) and updates the status flags according to the results. The string element and register contents are not modified. The following “short forms” of the SCAS instruction specify the operand length: SCASB (scan byte string), SCASW (scan word string), and SCASD (scan doubleword string).
So, basically, this instruction scan a string and look for the same character than the one stored in EAX. It won't touch any registers other than ECX (counter) and EDI (address) but the status flags according to the results.
-
The value pointed by EAX, or the value of EAX? Also, what accumulators does it update? what should look after a REPNE SCAS ?– aclowkayCommented Sep 9, 2013 at 20:43
-
The value of EAX and pointed at by ES:[EDI]. The address where the string differ from the character stored in the accumulator is the one currently stored in
ES:[EDI].– perrorCommented Sep 9, 2013 at 21:14 -
Shouldn't a REPNE SCAS be repeat until a match of the value of EAX is found? So i thought it should be "look for a character that is the same from the one stored in EAX."?– user2797Commented Sep 10, 2013 at 3:36
-
@guestme: Yes. Sorry, I did write the opposite of what I meant. I edit the text.– perrorCommented Sep 10, 2013 at 12:45
-
3@dnivra: but that's not all it can do. Specifically, repnz scasb is the equivalent of memchr(). Commented Sep 11, 2013 at 17:36