I am analyzing a piece of malware that has a sequence of instructions with
0047094C |. 8B0D 34935E00 |MOV ECX,DWORD PTR DS:[5E9334] 00470952 |. F2: |PREFIX REPNE: 00470953 |. 0F2AC1 |CVTPI2PS XMM0,MM1 00470956 |. F2: |PREFIX REPNE: 00470957 |. 0F100D 88905E00 |MOVUPS XMM1,DQWORD PTR DS:[5E9088] 0047095E |. F2: |PREFIX REPNE: 0047095F |. 0F5CC8 |SUBPS XMM1,XMM0 00470962 |. F2: |PREFIX REPNE: 00470963 |. 0F2CD1 |CVTTPS2PI MM2,XMM1 00470966 |. 8915 5C925E00 |MOV DWORD PTR DS:[5E925C],EDX
what's strange however is when Im debugging, the instructions immediately following the prefix repne are skipped (when single stepped). My instincts tell me it is just junk code but I want to make sure that something else isn't happening as I have to rewrite this particular function (there's plenty more sse instructions that are used)
If anyone can shed some light, I'd appreciate it. Thank you
repneis mnemonic for "repeat while not equal" - so if the zero flag is set when execution arrives at that address, the instruction won't get executed. If the zero flag is clear, it may get executed up to n times with n being the value of
ecx; if the instruction may change the zero flag, there may be less repetitions. So, if you can be sure
ZFis set before your instructions execute, this is junk code, but the instructions not getting executed in a single debugger trace doesn't mean this is always the case.