How would I find 3 bytes of data from a buffer and replace it with another 3 bytes until the whole buffer is read? (Find:00 AA 00 | Replace:FF AA 00)
Posted on 2001-01-06 01:42:00 by moxy
mmh, i would say you should use scas (scan string) to find the bytes, there are scasb, scasw and scasd (b=byte w=word d=doubleword). for example If you want to search a string for a single char (lets say "A") then you have to do this: .DATA string db "BBBBABBBB",0 .CODE cld ;clear direction flag (take a look in your opcode manual) lea edi,string ;edi->offset string mov al,"A" mov ecx,SIZEOF string ;length repz scasb ;search string until "A" appears (zf is set) jnz @notfound: ;zero flag is 0 -> no "A" found in string ;found one jmp @continue @notfound: ;found nothing @continue: note that i used scasb in this example, Look in your opcodes manual and you'll see that scasB uses AL for the search-pattern, if you use scasW then AX is used (scasd = EAX!). ok, and if you want to replace bytes then i would use movs (movsb/movsw/movsd). something like this: .DATA string1 db "ABC",0 string2 db "abc",0 .CODE cld lea edi,string1 ;edi(destination)->offset string1 lea esi,string2 ;esi(source)->offset string2 mov ecx,SIZEOF string1 ;length rep movsb ;move string2(source) to string1(destination) now both strings are lowercase! i don't know exactly what you want (until the whole buffer is read?) but i hope this op's will solve your problems ;)
Posted on 2001-01-06 08:15:00 by drcmda
; How would I find 3 bytes of data from a buffer and replace ; it with another 3 bytes until the whole buffer is read? ; (Find:00 AA 00 | Replace:FF AA 00) mov ecx,SIZEOF buffer ;length lea esi,buffer ;edi->offset string myloop: lodsb cmp al,00h je yes_first ;first byte located LOOPNZ myloop yes_first: lodsb ;load next byte cmp al,0AAh ;is it what we are looking for je yes_second LOOPNZ myloop ; if not then loop back yes_second: lodsb cmp al,00 je yes_match LOOPNZ myloop jmp sorry ; match is not existent yes_match: mov edi,esi ; prepare destination sub edi,3 ; for replace mov al,0FFh stosb mov al,0AAh stosb mov al,00h stosb jmp replaced sorry: nop nop replaced: nop nop John
Posted on 2001-01-07 03:05:00 by john