What does this combination SCAS and STOS?

Question

I have a simple snippet with several instructions:

01:    mov   edi, [ebp+8]
02:    mov   edx, edi
03:    xor   eax, eax
04:    or    ecx, 0FFFFFFFFh
05:    repne scasb
06:    add   ecx, 2
07:    neg   ecx
08:    mov   al, [ebp+0Ch]
09:    mov   edi, edx
10:    rep   stosb
11:    mov   eax, edx

I should explain:

1.What is the type of the [ebp+8] in line 01 and [ebp+C] in line 08, respectively.

2.What this code does?

1. Line 01 is something like edi = *(ebp+8), it stores destination address, not sure. But i can't explain line 08

2. By following the intel manual SCASB (scan byte string) i assume what this code does initialize a buffer for the string, repeatedly writes 0 byte eax times, then assign al to edi.

Answer 1

• ebp points to the stack, which is where function parameters are stored. ebp+8 is your first parameter, and ebp+0C the second one.
• The first parameter is a pointer to a 0-terminated string, and gets loaded into edi.
• The repne scasb instruction will increment edi, and decrement ecx, until either ecx is zero or edi points to a byte that is equal to the one in al - 0 in your case, so this scans for the end of a C string.
• Adding 2 to ecx, then negating it, will make it equal to the string length. Try it out yourself on paper with an example or two.
• eax gets the second pararmeter of the function, from ebp+0C.
• The string (the address of the string has been saved in edx and is back in edi) gets overwritten with the byte in al - your second function parameter.

So what this function does is overwrite a null-terminated string of unknown length (parameter 1) with a sequence of identical bytes (parameter 2).

Answer 2

emulating the sequence with powershell

cat scasb.ps1
$edx=$edi=$args[0];  $eax=0; $ecx=-1;
while($edi[$ecx--]){}; $ecx+=2;  $ecx=-$ecx;
"length of string using .net method "+$edi.length;
"length of string using repne scasb "+$ecx;
$edi=$edx.tochararray()
while($ecx){$edi[--$ecx]=$args[1]};  $ofs=""; $edx;[string]$edi

result

powershell -f scasb.ps1 "abracadabra gili gili choo" r
length of string using .net method 26
length of string using repne scasb 26
abracadabra gili gili choo
rrrrrrrrrrrrrrrrrrrrrrrrrr