1

I have a simple snippet with several instructions:

01:    mov   edi, [ebp+8]
02:    mov   edx, edi
03:    xor   eax, eax
04:    or    ecx, 0FFFFFFFFh
05:    repne scasb
06:    add   ecx, 2
07:    neg   ecx
08:    mov   al, [ebp+0Ch]
09:    mov   edi, edx
10:    rep   stosb
11:    mov   eax, edx

I should explain:

1.What is the type of the [ebp+8] in line 01 and [ebp+C] in line 08, respectively.

2.What this code does?

  1. Line 01 is something like edi = *(ebp+8), it stores destination address, not sure. But i can't explain line 08

  2. By following the intel manual SCASB (scan byte string) i assume what this code does initialize a buffer for the string, repeatedly writes 0 byte eax times, then assign al to edi.

2
  • ebp points to the stack, which is where function parameters are stored. ebp+8 is your first parameter, and ebp+0C the second one.
  • The first parameter is a pointer to a 0-terminated string, and gets loaded into edi.
  • The repne scasb instruction will increment edi, and decrement ecx, until either ecx is zero or edi points to a byte that is equal to the one in al - 0 in your case, so this scans for the end of a C string.
  • Adding 2 to ecx, then negating it, will make it equal to the string length. Try it out yourself on paper with an example or two.
  • eax gets the second pararmeter of the function, from ebp+0C.
  • The string (the address of the string has been saved in edx and is back in edi) gets overwritten with the byte in al - your second function parameter.

So what this function does is overwrite a null-terminated string of unknown length (parameter 1) with a sequence of identical bytes (parameter 2).

0

emulating the sequence with powershell

cat scasb.ps1
$edx=$edi=$args[0];  $eax=0; $ecx=-1;
while($edi[$ecx--]){}; $ecx+=2;  $ecx=-$ecx;
"length of string using .net method "+$edi.length;
"length of string using repne scasb "+$ecx;
$edi=$edx.tochararray()
while($ecx){$edi[--$ecx]=$args[1]};  $ofs=""; $edx;[string]$edi

result

powershell -f scasb.ps1 "abracadabra gili gili choo" r
length of string using .net method 26
length of string using repne scasb 26
abracadabra gili gili choo
rrrrrrrrrrrrrrrrrrrrrrrrrr

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.