# What does this combination SCAS and STOS?

I have a simple snippet with several instructions:

``````01:    mov   edi, [ebp+8]
02:    mov   edx, edi
03:    xor   eax, eax
04:    or    ecx, 0FFFFFFFFh
05:    repne scasb
07:    neg   ecx
08:    mov   al, [ebp+0Ch]
09:    mov   edi, edx
10:    rep   stosb
11:    mov   eax, edx
``````

I should explain:

1.What is the type of the `[ebp+8]` in line `01` and `[ebp+C]` in line `08`, respectively.

2.What this code does?

1. Line `01` is something like `edi = *(ebp+8)`, it stores destination address, not sure. But i can't explain line `08`

2. By following the `intel` manual `SCASB (scan byte string)` i assume what this code does initialize a buffer for the string, repeatedly writes `0` byte `eax` times, then assign `al` to `edi`.

• `ebp` points to the stack, which is where function parameters are stored. `ebp+8` is your first parameter, and `ebp+0C` the second one.
• The first parameter is a pointer to a 0-terminated string, and gets loaded into `edi`.
• The `repne scasb` instruction will increment `edi`, and decrement `ecx`, until either `ecx` is zero or `edi` points to a byte that is equal to the one in `al` - 0 in your case, so this scans for the end of a C string.
• Adding 2 to `ecx`, then negating it, will make it equal to the string length. Try it out yourself on paper with an example or two.
• `eax` gets the second pararmeter of the function, from `ebp+0C`.
• The string (the address of the string has been saved in `edx` and is back in `edi`) gets overwritten with the byte in `al` - your second function parameter.

So what this function does is overwrite a null-terminated string of unknown length (parameter 1) with a sequence of identical bytes (parameter 2).

emulating the sequence with powershell

``````cat scasb.ps1
\$edx=\$edi=\$args;  \$eax=0; \$ecx=-1;
while(\$edi[\$ecx--]){}; \$ecx+=2;  \$ecx=-\$ecx;
"length of string using .net method "+\$edi.length;
"length of string using repne scasb "+\$ecx;
\$edi=\$edx.tochararray()
while(\$ecx){\$edi[--\$ecx]=\$args};  \$ofs=""; \$edx;[string]\$edi
``````

result

``````powershell -f scasb.ps1 "abracadabra gili gili choo" r
length of string using .net method 26
length of string using repne scasb 26