I disassembled a file with OllyDbg and it had the following instruction:REPNE SCAS BYTE PTR ES:[EDI]What does that exactly mean ?
What does the assembly instruction 'REPNE SCAS BYTE PTR ES:[EDI]'?
assembly;ollydbg
The SCAS instruction is used to scan a string (SCAS = SCan A String). It compares the content of the accumulator (AL, AX, or EAX) against the current value pointed at by ES:[EDI].When used together with the REPNE prefix (REPeat while Not Equal), SCAS scans the string searching for the first string element which is equal to the value in the accumulator. The Intel manual (Vol. 1, p.231) says:The SCAS instruction subtracts the destination string element from the contents of the EAX, AX, or AL register (depending on operand length) and updates the status flags according to the results. The string element and register contents are not modified. The following short forms of the SCAS instruction specify the operand length: SCASB (scan byte string), SCASW (scan word string), and SCASD (scan doubleword string).So, basically, this instruction scan a string and look for the same character than the one stored in EAX. It won't touch any registers other than ECX (counter) and EDI (address) but the status flags according to the results.