How would I find 3 bytes of data from a buffer and replace it with another 3 bytes until the whole buffer is read? (Find:00 AA 00 | Replace:FF AA 00)
mmh, i would say you should use scas (scan string) to find the bytes, there are scasb, scasw and scasd (b=byte w=word d=doubleword). for example If you want to search a string for a single char (lets say "A") then you have to do this:
.DATA
string db "BBBBABBBB",0
.CODE
cld ;clear direction flag (take a look in your opcode manual)
lea edi,string ;edi->offset string
mov al,"A"
mov ecx,SIZEOF string ;length
repz scasb ;search string until "A" appears (zf is set)
jnz @notfound: ;zero flag is 0 -> no "A" found in string
;found one
jmp @continue
@notfound:
;found nothing
@continue:
note that i used scasb in this example, Look in your opcodes manual and you'll see that scasB uses AL for the search-pattern, if you use scasW then AX is used (scasd = EAX!).
ok, and if you want to replace bytes then i would use movs (movsb/movsw/movsd). something like this:
.DATA
string1 db "ABC",0
string2 db "abc",0
.CODE
cld
lea edi,string1 ;edi(destination)->offset string1
lea esi,string2 ;esi(source)->offset string2
mov ecx,SIZEOF string1 ;length
rep movsb ;move string2(source) to string1(destination)
now both strings are lowercase!
i don't know exactly what you want (until the whole buffer is read?) but i hope this op's will solve your problems ;)
; How would I find 3 bytes of data from a buffer and replace
; it with another 3 bytes until the whole buffer is read?
; (Find:00 AA 00 | Replace:FF AA 00)
mov ecx,SIZEOF buffer ;length
lea esi,buffer ;edi->offset string
myloop:
lodsb
cmp al,00h
je yes_first ;first byte located
LOOPNZ myloop
yes_first:
lodsb ;load next byte
cmp al,0AAh ;is it what we are looking for
je yes_second
LOOPNZ myloop ; if not then loop back
yes_second:
lodsb
cmp al,00
je yes_match
LOOPNZ myloop
jmp sorry ; match is not existent
yes_match:
mov edi,esi ; prepare destination
sub edi,3 ; for replace
mov al,0FFh
stosb
mov al,0AAh
stosb
mov al,00h
stosb
jmp replaced
sorry:
nop
nop
replaced:
nop
nop
John